mirror of
https://github.com/edgelesssys/constellation.git
synced 2024-12-11 08:54:21 -05:00
913b09aeb8
* terraform: enable creation of SEV-SNP VMs on GCP * variant: add SEV-SNP attestation variant * config: add SEV-SNP config options for GCP * measurements: add GCP SEV-SNP measurements * gcp: separate package for SEV-ES * attestation: add GCP SEV-SNP attestation logic * gcp: factor out common logic * choose: add GCP SEV-SNP * cli: add TF variable passthrough for GCP SEV-SNP variables * cli: support GCP SEV-SNP for `constellation verify` * Adjust usage of GCP SEV-SNP throughout codebase * ci: add GCP SEV-SNP * terraform-provider: support GCP SEV-SNP * docs: add GCP SEV-SNP reference * linter fixes * gcp: only run test with TPM simulator * gcp: remove nonsense test * Update cli/internal/cmd/verify.go Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com> * Update docs/docs/overview/clouds.md Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com> * Update terraform-provider-constellation/internal/provider/attestation_data_source_test.go Co-authored-by: Adrian Stobbe <stobbe.adrian@gmail.com> * linter fixes * terraform_provider: correctly pass down CC technology * config: mark attestationconfigapi as unimplemented * gcp: fix comments and typos * snp: use nonce and PK hash in SNP report * snp: ensure we never use ARK supplied by Issuer (#3025) * Make sure SNP ARK is always loaded from config, or fetched from AMD KDS * GCP: Set validator `reportData` correctly --------- Signed-off-by: Daniel Weiße <dw@edgeless.systems> Co-authored-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * attestationconfigapi: add GCP to uploading * snp: use correct cert Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * terraform-provider: enable fetching of attestation config values for GCP SEV-SNP * linter fixes --------- Signed-off-by: Daniel Weiße <dw@edgeless.systems> Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com> Co-authored-by: Adrian Stobbe <stobbe.adrian@gmail.com>
71 lines
2.0 KiB
HCL
71 lines
2.0 KiB
HCL
locals {
|
|
region = substr(var.zone, 0, length(var.zone) - 2)
|
|
}
|
|
|
|
module "gcp_iam" {
|
|
source = "../../infrastructure/iam/gcp"
|
|
project_id = var.project
|
|
service_account_id = var.service_account_id
|
|
region = local.region
|
|
zone = var.zone
|
|
}
|
|
|
|
|
|
resource "null_resource" "ensure_yq" {
|
|
provisioner "local-exec" {
|
|
command = <<EOT
|
|
../common/install-yq.sh
|
|
EOT
|
|
}
|
|
triggers = {
|
|
always_run = timestamp()
|
|
}
|
|
}
|
|
|
|
module "fetch_image" {
|
|
source = "../common/fetch-image"
|
|
csp = "gcp"
|
|
attestation_variant = "gcp-sev-es"
|
|
image = var.image
|
|
depends_on = [null_resource.ensure_yq]
|
|
}
|
|
|
|
|
|
module "gcp" {
|
|
source = "../../infrastructure/gcp"
|
|
project = var.project
|
|
image_id = module.fetch_image.image
|
|
name = var.name
|
|
node_groups = var.node_groups
|
|
region = local.region
|
|
zone = var.zone
|
|
debug = var.debug
|
|
custom_endpoint = var.custom_endpoint
|
|
cc_technology = var.cc_technology
|
|
}
|
|
|
|
module "constellation" {
|
|
source = "../constellation-cluster"
|
|
csp = "gcp"
|
|
debug = var.debug
|
|
name = var.name
|
|
image = var.image
|
|
microservice_version = var.microservice_version
|
|
kubernetes_version = var.kubernetes_version
|
|
uid = module.gcp.uid
|
|
clusterEndpoint = module.gcp.out_of_cluster_endpoint
|
|
inClusterEndpoint = module.gcp.in_cluster_endpoint
|
|
initSecretHash = module.gcp.init_secret
|
|
ipCidrNode = module.gcp.ip_cidr_node
|
|
apiServerCertSANs = module.gcp.api_server_cert_sans
|
|
node_groups = var.node_groups
|
|
gcp_config = {
|
|
region = local.region
|
|
zone = var.zone
|
|
project = var.project
|
|
ipCidrPod = module.gcp.ip_cidr_pod
|
|
serviceAccountKey = module.gcp_iam.service_account_key
|
|
}
|
|
depends_on = [module.gcp, null_resource.ensure_yq]
|
|
}
|