These 72 commits are when the Protocol Buffers files have changed:
| Commit: | bdbad4a | |
|---|---|---|
| Author: | miampf | |
| Committer: | miampf | |
feat: valid host certificates on nodes
| Commit: | 987e71b | |
|---|---|---|
| Author: | miampf | |
| Committer: | miampf | |
feat: valid host certificates on nodes
| Commit: | c2e10d9 | |
|---|---|---|
| Author: | miampf | |
| Committer: | miampf | |
feat: valid host certificates on nodes
| Commit: | f3d1b41 | |
|---|---|---|
| Author: | miampf | |
| Committer: | miampf | |
feat: valid host certificates on nodes
| Commit: | d42d22a | |
|---|---|---|
| Author: | miampf | |
fix: join service
| Commit: | dbcdd18 | |
|---|---|---|
| Author: | miampf | |
feat: somewhat working host key signing
| Commit: | ba3b7bf | |
|---|---|---|
| Author: | miampf | |
| Committer: | miampf | |
chore: adjust protobuf + generate
| Commit: | ccaac2a | |
|---|---|---|
| Author: | miampf | |
| Committer: | miampf | |
chore: adjust protobuf + generate
| Commit: | d95b3d8 | |
|---|---|---|
| Author: | miampf | |
| Committer: | miampf | |
chore: adjust protobuf + generate
| Commit: | 706d1df | |
|---|---|---|
| Author: | miampf | |
| Committer: | GitHub | |
cli: add `ssh` command to securely connect with nodes over ssh (#3568)
The documentation is generated from this commit.
| Commit: | 3258833 | |
|---|---|---|
| Author: | Daniel Weiße | |
| Committer: | GitHub | |
cdbg: better error reporting on `deploy` failure (#3155) * Don't report `UPLOAD_FILES_START_FAILED` as unknown error * Return error to `cdbg` if present --------- Signed-off-by: Daniel Weiße <dw@edgeless.systems>
| Commit: | 489e076 | |
|---|---|---|
| Author: | Adrian Stobbe | |
| Committer: | GitHub | |
ref: pre v2.15 cleanup (#2871)
| Commit: | 6f1b6b5 | |
|---|---|---|
| Author: | Markus Rudy | |
| Committer: | Markus Rudy | |
upgrade-agent: allow more than one KubernetesComponent
| Commit: | 4d714f2 | |
|---|---|---|
| Author: | Markus Rudy | |
| Committer: | Leonard Cohnen | |
upgrade-agent: allow more than one KubernetesComponent
| Commit: | a1dbd13 | |
|---|---|---|
| Author: | Markus Rudy | |
| Committer: | Markus Rudy | |
versions: consolidate various types of Components There used to be three definitions of a Component type, and conversion routines between the three. Since the use case is always the same, and the Component semantics are defined by versions.go and the installer, it seems appropriate to define the Component type there and import it in the necessary places.
| Commit: | 63cdd03 | |
|---|---|---|
| Author: | 3u13r | |
| Committer: | GitHub | |
Make Kubernetes serviceCIDR configurable in config (#2660) * config: pass serviceCIDR to kubeadm init * terraform: add serviceCIDR
| Commit: | 656cdbb | |
|---|---|---|
| Author: | Adrian Stobbe | |
| Committer: | GitHub | |
remove unused CloudServiceAccountUri from init request (#2182)
| Commit: | 8dbe795 | |
|---|---|---|
| Author: | Daniel Weiße | |
| Committer: | GitHub | |
cli: fix incorrect usage of masterSecret salt for clusterID generation (#2169) * Fix incorrect use of masterSecret salt for clusterID generation Signed-off-by: Daniel Weiße <dw@edgeless.systems> --------- Signed-off-by: Daniel Weiße <dw@edgeless.systems> Co-authored-by: Leonard Cohnen <lc@edgeless.systems>
| Commit: | 13eea1c | |
|---|---|---|
| Author: | Adrian Stobbe | |
| Committer: | GitHub | |
cli: install cilium in cli instead of bootstrapper (#2146) * add wait and restartDS * cilium working (tested on azure + gcp) * clean helm code from bootstrapper * fixup! clean helm code from bootstrapper * fixup! clean helm code from bootstrapper * fixup! clean helm code from bootstrapper * add patchnode for gcp * fix gcp * patch node inside bootstrapper * apply renaming of client * fixup! apply renaming of client * otto feedback
| Commit: | 8da6a23 | |
|---|---|---|
| Author: | Malte Poll | |
| Committer: | GitHub | |
bootstrapper: add fallback endpoint and custom endpoint to SAN field (#2108) terraform: collect apiserver cert SANs and support custom endpoint constants: add new constants for cluster configuration and custom endpoint cloud: support apiserver cert sans and prepare for endpoint migration on AWS config: add customEndpoint field bootstrapper: use per-CSP apiserver cert SANs cli: route customEndpoint to terraform and add migration for apiserver cert SANs bootstrapper: change interface of GetLoadBalancerEndpoint to return host and port separately
| Commit: | 8686c5e | |
|---|---|---|
| Author: | miampf | |
| Committer: | GitHub | |
bootstrapper: collect journald logs on failure (#1618)
| Commit: | b57413c | |
|---|---|---|
| Author: | Daniel Weiße | |
| Committer: | GitHub | |
cli: set cluster's initial measurements from user's config using Helm (#1540) * Remove using measurements from the initial control-plane node for the cluster's initial measurements * Add using measurements from the user's config for the cluster's initial measurements to align behavior with upgrade command --------- Signed-off-by: Daniel Weiße <dw@edgeless.systems>
| Commit: | e7fc541 | |
|---|---|---|
| Author: | Paul Meyer | |
| Committer: | GitHub | |
bazel: add buf as protobuf formatter to //:tidy (#1511) Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
| Commit: | 5a0234b | |
|---|---|---|
| Author: | Daniel Weiße | |
| Committer: | GitHub | |
attestation: add option for MAA fallback to verify azure's snp-sev id key digest (#1257) * Convert enforceIDKeyDigest setting to enum * Use MAA fallback in Azure SNP attestation * Only create MAA provider if MAA fallback is enabled --------- Signed-off-by: Daniel Weiße <dw@edgeless.systems> Co-authored-by: Thomas Tendyck <tt@edgeless.systems>
| Commit: | a34ef8a | |
|---|---|---|
| Author: | Nils Hanke | |
| Committer: | Nils Hanke | |
cli/bootstrapper: remove deprecated master secret & KMS related fields
| Commit: | c29107f | |
|---|---|---|
| Author: | Daniel Weiße | |
| Committer: | GitHub | |
init: create kubeconfig file with unique user/cluster name (#1133) * Generate kubeconfig with unique name * Move create name flag to config * Add name validation to config * Move name flag in e2e tests to config generation * Remove name flag from create * Update ascii cinema flow --------- Signed-off-by: Daniel Weiße <dw@edgeless.systems>
| Commit: | 6f56ed6 | |
|---|---|---|
| Author: | Malte Poll | |
| Committer: | Malte Poll | |
debugd: implement upload of multiple binaries
| Commit: | 690b50b | |
|---|---|---|
| Author: | Daniel Weiße | |
| Committer: | GitHub | |
dev-docs: Go package docs (#958) * Remove unused package * Add Go package docs to most packages Signed-off-by: Daniel Weiße <dw@edgeless.systems> Signed-off-by: Fabian Kammel <fk@edgeless.systems> Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com> Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com> Co-authored-by: Fabian Kammel <fk@edgeless.systems>
| Commit: | 9a1f52e | |
|---|---|---|
| Author: | Otto Bittner | |
| Committer: | Otto Bittner | |
Refactor init/recovery to use kms URI So far the masterSecret was sent to the initial bootstrapper on init/recovery. With this commit this information is encoded in the kmsURI that is sent during init. For recover, the communication with the recoveryserver is changed. Before a streaming gRPC call was used to exchanges UUID for measurementSecret and state disk key. Now a standard gRPC is made that includes the same kmsURI & storageURI that are sent during init.
| Commit: | f0f109a | |
|---|---|---|
| Author: | Thomas Tendyck | |
| Committer: | Thomas Tendyck | |
verify: use fixed user data
| Commit: | 90b88e1 | |
|---|---|---|
| Author: | Otto Bittner | |
| Committer: | Otto Bittner | |
kms: rename kms to keyservice In the light of extending our eKMS support it will be helpful to have a tighter use of the word "KMS". KMS should refer to the actual component that manages keys. The keyservice, also called KMS in the constellation code, does not manage keys itself. It talks to a KMS backend, which in turn does the actual key management.
| Commit: | 9859b30 | |
|---|---|---|
| Author: | Moritz Sanft | |
| Committer: | GitHub | |
AB#2544 add upgrade agent for automatic version updates (#745)
| Commit: | 0c71cc7 | |
|---|---|---|
| Author: | Leonard Cohnen | |
| Committer: | 3u13r | |
joinservice: use configmap for k8s components
| Commit: | 983c2c4 | |
|---|---|---|
| Author: | Paul Meyer | |
| Committer: | Paul Meyer | |
debugd: sent info from cdbg to debugd Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
| Commit: | 3b6bc3b | |
|---|---|---|
| Author: | Leonard Cohnen | |
| Committer: | 3u13r | |
initserver: add client verification
| Commit: | f8001ef | |
|---|---|---|
| Author: | Daniel Weiße | |
| Committer: | GitHub | |
Refactor enforced/expected PCRs (#553) * Merge enforced and expected measurements * Update measurement generation to new format * Write expected measurements hex encoded by default * Allow hex or base64 encoded expected measurements * Allow hex or base64 encoded clusterID * Allow security upgrades to warnOnly flag * Upload signed measurements in JSON format * Fetch measurements either from JSON or YAML * Use yaml.v3 instead of yaml.v2 * Error on invalid enforced selection * Add placeholder measurements to config * Update e2e test to new measurement format Signed-off-by: Daniel Weiße <dw@edgeless.systems>
| Commit: | 1e98b68 | |
|---|---|---|
| Author: | Leonard Cohnen | |
| Committer: | 3u13r | |
kubernetes: verify Kubernetes components
| Commit: | b92b377 | |
|---|---|---|
| Author: | Fabian Kammel | |
| Committer: | GitHub | |
Remove access manager (#470) * remove access manager from code base * document new node ssh workflow * keep config backwards compatible * slow down link checking to prevent http 429 Signed-off-by: Fabian Kammel <fk@edgeless.systems>
| Commit: | 53c8c9e | |
|---|---|---|
| Author: | katexochen | |
| Committer: | Paul Meyer | |
Update proto files to v2
| Commit: | 88d2002 | |
|---|---|---|
| Author: | katexochen | |
| Committer: | Paul Meyer | |
Remove autoscaling from CLI and bootstrapper
| Commit: | 774e300 | |
|---|---|---|
| Author: | 3u13r | |
| Committer: | GitHub | |
Constellation conformance mode (#161) * add conformance mode
| Commit: | 8cb155d | |
|---|---|---|
| Author: | Daniel Weiße | |
| Committer: | GitHub | |
AB#2260 Refactor disk-mapper recovery (#82) * Refactor disk-mapper recovery * Adapt constellation recover command to use new disk-mapper recovery API * Fix Cilium connectivity on rebooting nodes (#89) * Lower CoreDNS reschedule timeout to 10 seconds (#93) Signed-off-by: Daniel Weiße <dw@edgeless.systems>
| Commit: | 4adc19b | |
|---|---|---|
| Author: | Otto Bittner | |
| Committer: | Otto Bittner | |
AB#2350: Configurably enforce idkeydigest on Azure * Add join-config entry for "enforceIdKeyDigest" bool * Add join-config entry for "idkeydigest" * Initially filled with TPM value from bootstrapper * Add config entries for idkeydigest and enforceIdKeyDigest * Extend azure attestation validator to check idkeydigest, if configured. * Update unittests * Add logger to NewValidator for all CSPs * Add csp to Updateable type Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com> Co-authored-by: Daniel Weiße <dw@edgeless.systems>
| Commit: | d770957 | |
|---|---|---|
| Author: | katexochen | |
| Committer: | Paul Meyer | |
Add debugd ssh key distribution
| Commit: | ba4471a | |
|---|---|---|
| Author: | Daniel Weiße | |
| Committer: | GitHub | |
AB#2316 Configurable enforced PCRs (#361) * Add warnings for non enforced, untrusted PCRs * Fix global state in Config PCR map Signed-off-by: Daniel Weiße <dw@edgeless.systems>
| Commit: | 9478303 | |
|---|---|---|
| Author: | 3u13r | |
| Committer: | GitHub | |
deploy cilium via helmchart (#321)
| Commit: | 19871ee | |
|---|---|---|
| Author: | Daniel Weiße | |
| Committer: | GitHub | |
Enable integrity protection on boot (#300) Signed-off-by: Daniel Weiße <dw@edgeless.systems>
| Commit: | 9a3bd38 | |
|---|---|---|
| Author: | Daniel Weiße | |
| Committer: | GitHub | |
Generate random salt for key derivation on init (#309) Signed-off-by: Daniel Weiße <dw@edgeless.systems>
| Commit: | db79784 | |
|---|---|---|
| Author: | Daniel Weiße | |
| Committer: | GitHub | |
AB#2200 Merge Owner and Cluster ID (#282) * Merge Owner and Cluster ID into single value * Remove aTLS from KMS, as it is no longer used for cluster external communication * Update verify command to use cluster-id instead of unique-id flag * Remove owner ID from init output Signed-off-by: Daniel Weiße <dw@edgeless.systems>
| Commit: | a68ee81 | |
|---|---|---|
| Author: | Otto Bittner | |
| Committer: | GitHub | |
AB#2074: Choosable K8S Version (#277) AB#2074: Add configurable k8s version Configurable version flow: * cli config holds/validates k8sVersion * InitCluster receive a k8sVersion arg * InitCluster creates CM "k8s-version" * kubeadm's InitConfiguration receives k8sVersion * joinservice spec mounts/reads k8s-version CM * joinservice supplies k8sVersion via JoinTicketResponse Other changes: * Remove unused test code (FakeK8SClient) * move VersionConfig map to /internal/versions * installk8sComponents is now a function instead of a method
| Commit: | c6ff34f | |
|---|---|---|
| Author: | Daniel Weiße | |
| Committer: | GitHub | |
Use Certificate Requests to issue Kubelet Certificates and set CA (#261) Signed-off-by: Daniel Weiße <dw@edgeless.systems>
| Commit: | 32f1f5f | |
|---|---|---|
| Author: | katexochen | |
| Committer: | Paul Meyer | |
Delete Coordinator core and apis
| Commit: | 2bcf001 | |
|---|---|---|
| Author: | Daniel Weiße | |
| Committer: | Paul Meyer | |
Distribute k8s CA certificates and key over join-service Signed-off-by: Daniel Weiße <dw@edgeless.systems>
| Commit: | 15adba9 | |
|---|---|---|
| Author: | katexochen | |
| Committer: | Paul Meyer | |
Simplify joinproto
| Commit: | dc9e8e7 | |
|---|---|---|
| Author: | katexochen | |
| Committer: | Paul Meyer | |
Rename activation to joinservice
| Commit: | 916e5d6 | |
|---|---|---|
| Author: | katexochen | |
| Committer: | Paul Meyer | |
Rename coordinator to bootstrapper and rename roles
| Commit: | f9a581f | |
|---|---|---|
| Author: | Daniel Weiße | |
| Committer: | GitHub | |
Add aTLS endpoint to KMS (#236) * Move file watcher and validator to internal * Add aTLS endpoint to KMS for Kubernetes external requests * Update Go version in Dockerfiles * Move most KMS packages to internal Signed-off-by: Daniel Weiße <dw@edgeless.systems>
| Commit: | 042f668 | |
|---|---|---|
| Author: | Daniel Weiße | |
| Committer: | GitHub | |
AB#2190 Verification service (#232) * Add verification service * Update verify command to use new Constellation verification service * Deploy verification service on cluster init * Update pcr-reader to use verification service * Add verification service build workflow Signed-off-by: Daniel Weiße <dw@edgeless.systems> Signed-off-by: Daniel Weiße <dw@edgeless.systems>
| Commit: | e6b1156 | |
|---|---|---|
| Author: | Daniel Weiße | |
| Committer: | GitHub | |
AB#2169 Implement control-plane activation in activation service (#217) * Implement Control Plane activation flow * Rename Activation RPCs Signed-off-by: Daniel Weiße <dw@edgeless.systems>
| Commit: | 963c6f9 | |
|---|---|---|
| Author: | Daniel Weiße | |
| Committer: | Daniel Weiße | |
Create kubernetes CA signed kubelet certificates on activation Signed-off-by: Daniel Weiße <dw@edgeless.systems>
| Commit: | b461c40 | |
|---|---|---|
| Author: | Daniel Weiße | |
| Committer: | Daniel Weiße | |
Implement activation service Signed-off-by: Daniel Weiße <dw@edgeless.systems>
| Commit: | ed071d3 | |
|---|---|---|
| Author: | Nils Hanke | |
| Committer: | Nils Hanke | |
Add SSH users on subsequent coordinators & nodes
| Commit: | 68092f2 | |
|---|---|---|
| Author: | Nils Hanke | |
| Committer: | GitHub | |
AB#2046 : Add option to create SSH users for the first coordinator upon initialization (#133) * Move `file`, `ssh` and `user` packages to internal * Rename `SSHKey` to `(ssh.)UserKey` * Rename KeyValue / Publickey to PublicKey * Rename SSH key file from "debugd" to "ssh-keys" * Add CreateSSHUsers function to Core * Call CreateSSHUsers users on first control-plane node, when defined in config Tests: * Make StubUserCreator add entries to /etc/passwd * Add NewLinuxUserManagerFake for unit tests * Add unit tests & adjust existing ones to changes
| Commit: | c63d712 | |
|---|---|---|
| Author: | cm | |
| Committer: | GitHub | |
AB#1943 Extract KMS package (#56) * Extract kmsapi from coordinator * Add kmsapi cmd server
| Commit: | ffb471d | |
|---|---|---|
| Author: | Malte Poll | |
| Committer: | Malte Poll | |
Add GetVPNPeers pubapi endpoint Signed-off-by: Malte Poll <mp@edgeless.systems>
| Commit: | d8241a1 | |
|---|---|---|
| Author: | Benedict Schlueter | |
| Committer: | Benedict Schlüter | |
proto: add new functions / modify ActivateAsCoordinatorRequest Signed-off-by: Benedict Schlueter <bs@edgeless.systems>
| Commit: | 78af3b1 | |
|---|---|---|
| Author: | Malte Poll | |
| Committer: | Malte Poll | |
debugd: Correctly handle direct coordinator upload if coordinator was uploaded previously (file already exists) Signed-off-by: Malte Poll <mp@edgeless.systems>
| Commit: | 152e398 | |
|---|---|---|
| Author: | Daniel Weiße | |
| Committer: | Daniel Weiße | |
AB#1903 Add grpc interface to push decryption keys Signed-off-by: Daniel Weiße <dw@edgeless.systems>
| Commit: | 3ce3978 | |
|---|---|---|
| Author: | Malte Poll | |
| Committer: | Malte Poll | |
update state disk passphrase on activation Signed-off-by: Malte Poll <mp@edgeless.systems>
| Commit: | f0e35a4 | |
|---|---|---|
| Author: | Benedict | |
| Committer: | Benedict Schlüter | |
peer: save PublicIP instead of publicEndpoint / add multi-coord gRPCs
| Commit: | 49a1a07 | |
|---|---|---|
| Author: | Daniel Weiße | |
| Committer: | GitHub | |
AB#1902 Ping Coordinator from initramfs for key (#53) Signed-off-by: Daniel Weiße <dw@edgeless.systems>
| Commit: | 2d8fcd9 | |
|---|---|---|
| Author: | Leonard Cohnen | |
| Committer: | Leonard Cohnen | |
monorepo Co-authored-by: Malte Poll <mp@edgeless.systems> Co-authored-by: katexochen <katexochen@users.noreply.github.com> Co-authored-by: Daniel Weiße <dw@edgeless.systems> Co-authored-by: Thomas Tendyck <tt@edgeless.systems> Co-authored-by: Benedict Schlueter <bs@edgeless.systems> Co-authored-by: leongross <leon.gross@rub.de> Co-authored-by: Moritz Eckert <m1gh7ym0@gmail.com>