mirror of
https://github.com/edgelesssys/constellation.git
synced 2024-12-14 18:34:31 -05:00
fafb9886b0
Co-authored-by: elchead <elchead@users.noreply.github.com>
9.1 KiB
9.1 KiB
Migrations
This document describes breaking changes and migrations between Constellation releases.
Use constellation config migrate
to automatically update an old config file to a new format.
Migrating from Azure's service principal authentication to managed identity authentication
- The
provider.azure.appClientID
andprovider.azure.appClientSecret
fields are no longer supported and should be removed. - To keep using an existing UAMI, add the
Owner
permission with the scope of yourresourceGroup
. - Otherwise, simply create new Constellation IAM credentials and use the created UAMI.
- To migrate the authentication for an existing cluster on Azure to an UAMI with the necessary permissions:
- Remove the
aadClientId
andaadClientSecret
from the azureconfig secret. - Set
useManagedIdentityExtension
totrue
and use theuserAssignedIdentity
from the Constellation config for the value ofuserAssignedIdentityID
. - Restart the CSI driver, cloud controller manager, cluster autoscaler, and Constellation operator pods.
- Remove the
Migrating from CLI versions before 2.10
- AWS cluster upgrades require additional IAM permissions for the newly introduced
aws-load-balancer-controller
. Please upgrade your IAM roles usingiam upgrade apply
. This will show necessary changes and apply them, if desired. - The global
nodeGroups
field was added. - The fields
instanceType
,stateDiskSizeGB
, andstateDiskType
for each cloud provider are now part of the configuration of individual node groups. - The
constellation create
command no longer uses the flags--control-plane-count
and--worker-count
. Instead, the initial node count is configured per node group in thenodeGroups
field.
Migrating from CLI versions before 2.9
- The
provider.azure.appClientID
andprovider.azure.clientSecretValue
fields were removed to enforce migration to managed identity authentication
Migrating from CLI versions before 2.8
- The
measurements
field for each cloud service provider was replaced with a globalattestation
field. - The
confidentialVM
,idKeyDigest
, andenforceIdKeyDigest
fields for the Azure cloud service provider were removed in favor of using the globalattestation
field. - The optional global field
attestationVariant
was replaced by the now requiredattestation
field.
Migrating from CLI versions before 2.3
- The
sshUsers
field was deprecated in v2.2 and has been removed from the configuration in v2.3. As an alternative for SSH, check the workflow section Connect to nodes. - The
image
field for each cloud service provider has been replaced with a globalimage
field. Use the following mapping to migrate your configuration:Show all
CSP old image new image AWS ami-06b8cbf4837a0a57c
v2.2.2
AWS ami-02e96dc04a9e438cd
v2.2.2
AWS ami-028ead928a9034b2f
v2.2.2
AWS ami-032ac10dd8d8266e3
v2.2.1
AWS ami-032e0d57cc4395088
v2.2.1
AWS ami-053c3e49e19b96bdd
v2.2.1
AWS ami-0e27ebcefc38f648b
v2.2.0
AWS ami-098cd37f66523b7c3
v2.2.0
AWS ami-04a87d302e2509aad
v2.2.0
Azure /subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/constellation-images/providers/Microsoft.Compute/galleries/Constellation/images/constellation/versions/2.2.2
v2.2.2
Azure /subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/constellation-images/providers/Microsoft.Compute/galleries/Constellation_CVM/images/constellation/versions/2.2.2
v2.2.2
Azure /subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/constellation-images/providers/Microsoft.Compute/galleries/Constellation/images/constellation/versions/2.2.1
v2.2.1
Azure /subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/constellation-images/providers/Microsoft.Compute/galleries/Constellation_CVM/images/constellation/versions/2.2.1
v2.2.1
Azure /subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/constellation-images/providers/Microsoft.Compute/galleries/Constellation/images/constellation/versions/2.2.0
v2.2.0
Azure /subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/constellation-images/providers/Microsoft.Compute/galleries/Constellation_CVM/images/constellation/versions/2.2.0
v2.2.0
Azure /subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/constellation-images/providers/Microsoft.Compute/galleries/Constellation/images/constellation/versions/2.1.0
v2.1.0
Azure /subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/constellation-images/providers/Microsoft.Compute/galleries/Constellation_CVM/images/constellation/versions/2.1.0
v2.1.0
Azure /subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/constellation-images/providers/Microsoft.Compute/galleries/Constellation/images/constellation/versions/2.0.0
v2.0.0
Azure /subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/constellation-images/providers/Microsoft.Compute/galleries/Constellation_CVM/images/constellation/versions/2.0.0
v2.0.0
GCP projects/constellation-images/global/images/constellation-v2-2-2
v2.2.2
GCP projects/constellation-images/global/images/constellation-v2-2-1
v2.2.1
GCP projects/constellation-images/global/images/constellation-v2-2-0
v2.2.0
GCP projects/constellation-images/global/images/constellation-v2-1-0
v2.1.0
GCP projects/constellation-images/global/images/constellation-v2-0-0
v2.0.0
- The
enforcedMeasurements
field has been removed and merged with themeasurements
field.-
To migrate your config containing a new image (
v2.3
or greater), remove the oldmeasurements
andenforcedMeasurements
entries from your config and runconstellation fetch-measurements
-
To migrate your config containing an image older than
v2.3
, remove theenforcedMeasurements
entry and replace the entries inmeasurements
as shown in the example below:measurements: - 0: DzXCFGCNk8em5ornNZtKi+Wg6Z7qkQfs5CfE3qTkOc8= + 0: + expected: DzXCFGCNk8em5ornNZtKi+Wg6Z7qkQfs5CfE3qTkOc8= + warnOnly: true - 8: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= + 8: + expected: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= + warnOnly: false -enforcedMeasurements: - - 8
-