mirror of
https://github.com/edgelesssys/constellation.git
synced 2024-12-14 02:14:21 -05:00
cf5d9c2f12
* deps: update Kubernetes versions * deps: tidy all modules --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: edgelessci <edgelessci@users.noreply.github.com>
242 lines
9.0 KiB
Markdown
242 lines
9.0 KiB
Markdown
---
|
|
# generated by https://github.com/hashicorp/terraform-plugin-docs
|
|
page_title: "constellation_cluster Resource - constellation"
|
|
subcategory: ""
|
|
description: |-
|
|
Resource for a Constellation cluster.
|
|
---
|
|
|
|
# constellation_cluster (Resource)
|
|
|
|
Resource for a Constellation cluster.
|
|
|
|
## Example Usage
|
|
|
|
```terraform
|
|
data "constellation_attestation" "foo" {} # Fill accordingly for the CSP and attestation variant
|
|
|
|
data "constellation_image" "bar" {} # Fill accordingly for the CSP
|
|
|
|
resource "random_bytes" "master_secret" {
|
|
length = 32
|
|
}
|
|
|
|
resource "random_bytes" "master_secret_salt" {
|
|
length = 32
|
|
}
|
|
|
|
resource "random_bytes" "measurement_salt" {
|
|
length = 32
|
|
}
|
|
|
|
resource "constellation_cluster" "azure_example" {
|
|
csp = "azure"
|
|
name = "constell"
|
|
uid = "..."
|
|
image = data.constellation_image.bar.image
|
|
attestation = data.constellation_attestation.foo.attestation
|
|
init_secret = "..."
|
|
master_secret = random_bytes.master_secret.hex
|
|
master_secret_salt = random_bytes.master_secret_salt.hex
|
|
measurement_salt = random_bytes.measurement_salt.hex
|
|
out_of_cluster_endpoint = "123.123.123.123"
|
|
kubernetes_version = "v1.2.3"
|
|
azure = {
|
|
tenant_id = "..."
|
|
subscription_id = "..."
|
|
uami_client_id = "..."
|
|
uami_resource_id = "..."
|
|
location = "..."
|
|
resource_group = "..."
|
|
load_balancer_name = "..."
|
|
network_security_group_name = "..."
|
|
}
|
|
network_config = {
|
|
ip_cidr_node = "192.168.176.0/20"
|
|
ip_cidr_service = "10.96.0.0/12"
|
|
}
|
|
}
|
|
```
|
|
|
|
<!-- schema generated by tfplugindocs -->
|
|
## Schema
|
|
|
|
### Required
|
|
|
|
- `attestation` (Attributes) Attestation comprises the measurements and CVM specific parameters. The output of the [constellation_attestation](../data-sources/attestation.md) data source provides sensible defaults. (see [below for nested schema](#nestedatt--attestation))
|
|
- `constellation_microservice_version` (String) The version of Constellation's microservices used within the cluster.
|
|
- `csp` (String) CSP (Cloud Service Provider) to use. (e.g. `azure`)
|
|
See the [full list of CSPs](https://docs.edgeless.systems/constellation/overview/clouds) that Constellation supports.
|
|
- `image` (Attributes) Constellation OS Image to use on the nodes. (see [below for nested schema](#nestedatt--image))
|
|
- `init_secret` (String) Secret used for initialization of the cluster.
|
|
- `kubernetes_version` (String) The Kubernetes version to use for the cluster. The supported versions are [v1.28.12 v1.29.7 v1.30.3].
|
|
- `master_secret` (String) Hex-encoded 32-byte master secret for the cluster.
|
|
- `master_secret_salt` (String) Hex-encoded 32-byte master secret salt for the cluster.
|
|
- `measurement_salt` (String) Hex-encoded 32-byte measurement salt for the cluster.
|
|
- `name` (String) Name used in the cluster's named resources / cluster name.
|
|
- `network_config` (Attributes) Configuration for the cluster's network. (see [below for nested schema](#nestedatt--network_config))
|
|
- `out_of_cluster_endpoint` (String) The endpoint of the cluster. Typically, this is the public IP of a loadbalancer.
|
|
- `uid` (String) The UID of the cluster.
|
|
|
|
### Optional
|
|
|
|
- `api_server_cert_sans` (List of String) List of Subject Alternative Names (SANs) for the API server certificate. Usually, this will be the out-of-cluster endpoint and the in-cluster endpoint, if existing.
|
|
- `azure` (Attributes) Azure-specific configuration. (see [below for nested schema](#nestedatt--azure))
|
|
- `extra_microservices` (Attributes) Extra microservice settings. (see [below for nested schema](#nestedatt--extra_microservices))
|
|
- `gcp` (Attributes) GCP-specific configuration. (see [below for nested schema](#nestedatt--gcp))
|
|
- `in_cluster_endpoint` (String) The endpoint of the cluster. When not set, the out-of-cluster endpoint is used.
|
|
- `license_id` (String) Constellation license ID. When not set, the community license is used.
|
|
- `openstack` (Attributes) OpenStack-specific configuration. (see [below for nested schema](#nestedatt--openstack))
|
|
|
|
### Read-Only
|
|
|
|
- `cluster_id` (String) The cluster ID of the cluster.
|
|
- `kubeconfig` (String, Sensitive) The kubeconfig of the cluster.
|
|
- `owner_id` (String) The owner ID of the cluster.
|
|
|
|
<a id="nestedatt--attestation"></a>
|
|
### Nested Schema for `attestation`
|
|
|
|
Required:
|
|
|
|
- `amd_root_key` (String)
|
|
- `bootloader_version` (Number)
|
|
- `measurements` (Attributes Map) (see [below for nested schema](#nestedatt--attestation--measurements))
|
|
- `microcode_version` (Number)
|
|
- `snp_version` (Number)
|
|
- `tee_version` (Number)
|
|
- `variant` (String) Attestation variant the image should work with. Can be one of:
|
|
* `aws-sev-snp`
|
|
* `aws-nitro-tpm`
|
|
* `azure-sev-snp`
|
|
* `azure-tdx`
|
|
* `gcp-sev-snp`
|
|
* `gcp-sev-es`
|
|
* `qemu-vtpm`
|
|
|
|
Optional:
|
|
|
|
- `azure_firmware_signer_config` (Attributes) (see [below for nested schema](#nestedatt--attestation--azure_firmware_signer_config))
|
|
- `tdx` (Attributes) (see [below for nested schema](#nestedatt--attestation--tdx))
|
|
|
|
<a id="nestedatt--attestation--measurements"></a>
|
|
### Nested Schema for `attestation.measurements`
|
|
|
|
Required:
|
|
|
|
- `expected` (String)
|
|
- `warn_only` (Boolean)
|
|
|
|
|
|
<a id="nestedatt--attestation--azure_firmware_signer_config"></a>
|
|
### Nested Schema for `attestation.azure_firmware_signer_config`
|
|
|
|
Optional:
|
|
|
|
- `accepted_key_digests` (List of String)
|
|
- `enforcement_policy` (String)
|
|
- `maa_url` (String)
|
|
|
|
|
|
<a id="nestedatt--attestation--tdx"></a>
|
|
### Nested Schema for `attestation.tdx`
|
|
|
|
Optional:
|
|
|
|
- `intel_root_key` (String)
|
|
- `mr_seam` (String)
|
|
- `pce_svn` (Number)
|
|
- `qe_svn` (Number)
|
|
- `qe_vendor_id` (String)
|
|
- `tee_tcb_svn` (String)
|
|
- `xfam` (String)
|
|
|
|
|
|
|
|
<a id="nestedatt--image"></a>
|
|
### Nested Schema for `image`
|
|
|
|
Required:
|
|
|
|
- `reference` (String) CSP-specific unique reference to the image. The format differs per CSP.
|
|
- `short_path` (String) CSP-agnostic short path to the image. The format is `vX.Y.Z` for release images and `ref/$GIT_REF/stream/$STREAM/$SEMANTIC_VERSION` for pre-release images.
|
|
- `$GIT_REF` is the git reference (i.e. branch name) the image was built on, e.g. `main`.
|
|
- `$STREAM` is the stream the image was built on, e.g. `nightly`.
|
|
- `$SEMANTIC_VERSION` is the semantic version of the image, e.g. `vX.Y.Z` or `vX.Y.Z-pre...`.
|
|
- `version` (String) Semantic version of the image.
|
|
|
|
Optional:
|
|
|
|
- `marketplace_image` (Boolean) Whether a marketplace image should be used.
|
|
|
|
|
|
<a id="nestedatt--network_config"></a>
|
|
### Nested Schema for `network_config`
|
|
|
|
Required:
|
|
|
|
- `ip_cidr_node` (String) CIDR range of the cluster's node network.
|
|
- `ip_cidr_service` (String) CIDR range of the cluster's service network.
|
|
|
|
Optional:
|
|
|
|
- `ip_cidr_pod` (String) CIDR range of the cluster's pod network. Only required for clusters running on GCP.
|
|
|
|
|
|
<a id="nestedatt--azure"></a>
|
|
### Nested Schema for `azure`
|
|
|
|
Required:
|
|
|
|
- `load_balancer_name` (String) Name of the Azure load balancer used by the cluster.
|
|
- `location` (String) Azure Location of the cluster.
|
|
- `network_security_group_name` (String) Name of the Azure network security group used for the cluster.
|
|
- `resource_group` (String) Name of the Azure resource group the cluster resides in.
|
|
- `subscription_id` (String) ID of the Azure subscription the cluster resides in.
|
|
- `tenant_id` (String) Tenant ID of the Azure account.
|
|
- `uami_client_id` (String) Client ID of the User assigned managed identity (UAMI) used within the cluster.
|
|
- `uami_resource_id` (String) Resource ID of the User assigned managed identity (UAMI) used within the cluster.
|
|
|
|
|
|
<a id="nestedatt--extra_microservices"></a>
|
|
### Nested Schema for `extra_microservices`
|
|
|
|
Required:
|
|
|
|
- `csi_driver` (Boolean) Enable Constellation's [encrypted CSI driver](https://docs.edgeless.systems/constellation/workflows/storage).
|
|
|
|
|
|
<a id="nestedatt--gcp"></a>
|
|
### Nested Schema for `gcp`
|
|
|
|
Required:
|
|
|
|
- `project_id` (String) ID of the GCP project the cluster resides in.
|
|
- `service_account_key` (String) Base64-encoded private key JSON object of the service account used within the cluster.
|
|
|
|
|
|
<a id="nestedatt--openstack"></a>
|
|
### Nested Schema for `openstack`
|
|
|
|
Required:
|
|
|
|
- `cloud` (String) Name of the cloud in the clouds.yaml file.
|
|
- `floating_ip_pool_id` (String) Floating IP pool to use for the VMs.
|
|
- `network_id` (String) OpenStack network ID to use for the VMs.
|
|
- `subnet_id` (String) OpenStack subnet ID to use for the VMs.
|
|
|
|
Optional:
|
|
|
|
- `clouds_yaml_path` (String) Path to the clouds.yaml file.
|
|
- `deploy_yawol_load_balancer` (Boolean) Whether to deploy a YAWOL load balancer.
|
|
- `yawol_flavor_id` (String) OpenStack flavor used by the yawollet.
|
|
- `yawol_image_id` (String) OpenStack OS image used by the yawollet.
|
|
|
|
## Import
|
|
|
|
Import is supported using the following syntax:
|
|
|
|
```shell
|
|
terraform import constellation_cluster.constellation_cluster constellation-cluster://?kubeConfig=<base64-encoded-kubeconfig>&clusterEndpoint=<cluster-endpoint>&masterSecret=<hex-encoded-mastersecret>&masterSecretSalt=<hex-encoded-mastersecret-salt>
|
|
```
|