Constellation is the first Confidential Kubernetes. Constellation shields entire Kubernetes clusters from the (cloud) infrastructure using confidential computing.
Go to file
Malte Poll df4e8b2c1e [node operator] node state util function
Signed-off-by: Malte Poll <mp@edgeless.systems>
2022-08-09 10:29:04 +02:00
.github AB#2266: Test all supported version with e2e-tests 2022-08-09 10:02:15 +02:00
3rdparty/coreos-assembler Update HACKING.md 2022-08-05 12:37:22 +02:00
access_manager AB#2222 replace unlicensed passwd package with own implementation 2022-07-25 15:10:29 +02:00
bootstrapper Upgrade Azure SDK 2022-08-05 10:35:38 +02:00
cli AB#2215 Perform sanity check on GCP projectID (#349) 2022-08-09 10:26:29 +02:00
conformance Fix/bootstrapper regressions (#274) 2022-07-15 11:53:14 +02:00
debugd Update debugd README (#340) 2022-08-05 12:28:57 +02:00
docs [RFC] Secure Software Distribution (#234) 2022-08-01 16:52:32 +02:00
hack Export and import of Azure VM images (#341) 2022-08-08 16:19:34 +02:00
image Export and import of Azure VM images (#341) 2022-08-08 16:19:34 +02:00
internal AB#2278 Remove hardcoded values from config (#346) 2022-08-08 11:04:17 +02:00
joinservice AB#2278 Remove hardcoded values from config (#346) 2022-08-08 11:04:17 +02:00
kms Upgrade Azure SDK 2022-08-05 10:35:38 +02:00
mount linter cleanup (#344) 2022-08-05 15:30:23 +02:00
operators/constellation-node-operator [node operator] node state util function 2022-08-09 10:29:04 +02:00
proto Enable integrity protection on boot (#300) 2022-08-02 12:35:23 +02:00
state linter cleanup (#344) 2022-08-05 15:30:23 +02:00
terraform/libvirt Use go pseudo versions for container images 2022-07-14 17:34:33 +02:00
verify fix linter issues (#329) 2022-08-02 16:25:47 +02:00
.dockerignore Rename coordinator to bootstrapper and rename roles 2022-07-14 17:25:18 +02:00
.gitignore Rename coordinator to bootstrapper and rename roles 2022-07-14 17:25:18 +02:00
.golangci.yml monorepo 2022-03-22 16:09:39 +01:00
CHANGELOG.md AB#2266: Test all supported version with e2e-tests 2022-08-09 10:02:15 +02:00
CMakeLists.txt Enable integrity protection on boot (#300) 2022-08-02 12:35:23 +02:00
CONTRIBUTING.md Bootstrapper 2022-07-14 17:25:18 +02:00
Dockerfile.build Rename coordinator to bootstrapper and rename roles 2022-07-14 17:25:18 +02:00
go.mod Replace armnetworks module until https://github.com/Azure/azure-sdk-for-go/issues/18704 is fixed 2022-08-05 10:35:38 +02:00
go.sum Replace armnetworks module until https://github.com/Azure/azure-sdk-for-go/issues/18704 is fixed 2022-08-05 10:35:38 +02:00
README.md Update README 2022-08-05 12:37:22 +02:00

Constellation

This is the main repository of Constellation.

E2ETestAzure E2ETestGCP Go Report Card Discord Chat

Core components:

  • access_manager: Contains the access-manager pod used to persist SSH users based on a K8s ConfigMap
  • cli: The CLI is used to manage a Constellation cluster
  • bootstrapper: The bootstrapper is a node agent whose most important task is to bootstrap a node
  • image: Build files for the Constellation disk image
  • kms: Constellation's key management client and server
  • mount: Package used by CSI plugins to create and mount encrypted block devices
  • state: Contains the disk-mapper that maps the encrypted node data disk during boot

Development components:

  • 3rdparty: Contains the third party dependencies used by Constellation
  • conformance: Kubernetes conformance tests
  • debugd: Debug daemon and client
  • hack: Development tools
  • proto: Proto files generator
  • terraform: Infrastructure management using terraform (instead of constellation create/destroy)
    • libvirt: Deploy local cluster using terraform, libvirt and QEMU
  • test: Integration test

Additional repositories:

Build

Prerequisites:

  • Go 1.18

  • Docker

  • Packages on Ubuntu:

    sudo apt install build-essential cmake libssl-dev pkg-config libcryptsetup12 libcryptsetup-dev
    
  • Packages on Fedora:

    sudo dnf install @development-tools pkg-config cmake openssl-devel cryptsetup-libs cryptsetup-devel
    
mkdir build
cd build
cmake ..
make -j`nproc`

Testing

You can run all integration and unitttests like this:

ctest -j `nproc`

Cloud credentials

Using the CLI requires the user to make authorized API calls to the CSP API. See the docs for configuration.

Deploying a locally compiled bootstrapper binary

By default, constellation create ... will spawn cloud provider instances with a pre-baked bootstrapper binary. For testing, you can use the constellation debug daemon (debugd) to upload your local bootstrapper binary to running instances and to obtain SSH access. Follow this introduction on how to install and setup cdbg

Development Guides

Deployment Guides