mirror of
https://github.com/edgelesssys/constellation.git
synced 2024-10-01 01:36:09 -04:00
03de71fdd2
The image-api's measurement.json includes a setting for warnOnly that should be followed by default. Enforcing all measurments is currently not possible as some of them are unstable.
34 lines
1.3 KiB
YAML
34 lines
1.3 KiB
YAML
name: Constellation verify
|
|
description: "Verify a Constellation cluster."
|
|
|
|
inputs:
|
|
osImage:
|
|
description: "The OS image used in the cluster."
|
|
required: true
|
|
cloudProvider:
|
|
description: "The cloud provider used in the cluster."
|
|
required: true
|
|
|
|
runs:
|
|
using: "composite"
|
|
steps:
|
|
- name: Clear current measurements
|
|
shell: bash
|
|
run: |
|
|
yq -i 'del(.provider.${{ inputs.cloudProvider }}.measurements)' constellation-conf.yaml
|
|
|
|
- name: Fetch & write measurements
|
|
shell: bash
|
|
run: |
|
|
MEASUREMENTS=$(curl -fsSL https://cdn.confidential.cloud/constellation/v1/${{ inputs.osImage }}/image/csp/${{ inputs.cloudProvider }}/measurements.json | jq '.measurements' -r)
|
|
for key in $(echo $MEASUREMENTS | jq 'keys[]' -r); do
|
|
echo Updating $key to $(echo $MEASUREMENTS | jq ".\"$key\"" -r)
|
|
yq -i ".provider.${{ inputs.cloudProvider }}.measurements.[$key] = $(echo $MEASUREMENTS | jq ".\"$key\"")" constellation-conf.yaml
|
|
done
|
|
yq -i '.provider.${{ inputs.cloudProvider }}.measurements |= array_to_map' constellation-conf.yaml
|
|
cat constellation-conf.yaml
|
|
|
|
- name: Constellation verify
|
|
shell: bash
|
|
run: constellation verify --cluster-id $(jq -r ".clusterID" constellation-id.json) --force
|