mirror of
https://github.com/edgelesssys/constellation.git
synced 2024-09-23 09:46:05 +00:00
405db3286e
* There are now two attestation packages on azure. The issuer on the server side is created base on successfully querying the idkeydigest from the TPM. Fallback on err: Trusted Launch. * The bootstrapper's issuer choice is validated by the CLI's validator, which is created based on the local config. * Add "azureCVM" field to new "internal-config" cm. This field is populated by the bootstrapper. * Group attestation OIDs by CSP (#42) * Bootstrapper now uses IssuerWrapper type to pass the issuer (and some context info) to the initserver. * Introduce VMType package akin to cloudprovider. Used by IssuerWrapper. * Extend unittests. * Remove CSP specific attestation integration tests Co-authored-by: <dw@edgeless.systems> Signed-off-by: Otto Bittner <cobittner@posteo.net>
50 lines
980 B
Go
50 lines
980 B
Go
/*
|
|
Copyright (c) Edgeless Systems GmbH
|
|
|
|
SPDX-License-Identifier: AGPL-3.0-only
|
|
*/
|
|
|
|
package snp
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"net/http"
|
|
)
|
|
|
|
// Modified version of bootstrapper/cloudprovider/azure/imds.go
|
|
|
|
const (
|
|
imdsVcekURL = "http://169.254.169.254/metadata/THIM/amd/certification"
|
|
)
|
|
|
|
type imdsClient struct {
|
|
client *http.Client
|
|
}
|
|
|
|
// Retrieve retrieves instance metadata from the azure imds API.
|
|
func (c imdsClient) getVcek(ctx context.Context) (vcekResponse, error) {
|
|
req, err := http.NewRequestWithContext(ctx, http.MethodGet, imdsVcekURL, http.NoBody)
|
|
if err != nil {
|
|
return vcekResponse{}, err
|
|
}
|
|
req.Header.Add("Metadata", "True")
|
|
resp, err := c.client.Do(req)
|
|
if err != nil {
|
|
return vcekResponse{}, err
|
|
}
|
|
defer resp.Body.Close()
|
|
|
|
var res vcekResponse
|
|
if err := json.NewDecoder(resp.Body).Decode(&res); err != nil {
|
|
return vcekResponse{}, err
|
|
}
|
|
|
|
return res, nil
|
|
}
|
|
|
|
type vcekResponse struct {
|
|
VcekCert string
|
|
CertificateChain string
|
|
}
|