8000 config: add separate option for handling attestation parameters by daniel-weisse · Pull Request #1623 · edgelesssys/constellation · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

config: add separate option for handling attestation parameters #1623

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 13 commits into from
May 3, 2023
Merged

config: add separate option for handling attestation parameters #1623

merged 13 commits into from
May 3, 2023

Conversation

daniel-weisse
Copy link
Member

Proposed change(s)

  • Add new attestation option to the Constellation config file
    • Use it to control specific aspects of the attestation validation. For example, a user may specify their own minimum acceptable microcode version for Azure SEV-SNP atestation
  • Move measurements option from the provider option to attestation
  • Move and rename idkeydigests and enforceIDKeyDigest option into attestation
  • Always create MAA provider/provider to allow users switching from Equal or WarnOnly policy to MAAFallback

Additional info

  • Since this is a breaking change for existing config files, we either need a migration guide, or an option for automatic config migration. Ticket has been created

Checklist

  • Update docs
  • Add labels (e.g., for changelog category)
  • Link to Milestone

@daniel-weisse daniel-weisse added feature This introduces new functionality breaking change Change breaks existing API or configuration. labels Apr 6, 2023
@daniel-weisse daniel-weisse added this to the v2.8.0 milestone Apr 6, 2023
@daniel-weisse daniel-weisse force-pushed the feat/attestation/config branch from 3e2fa54 to 188f4f2 Compare April 6, 2023 14:36
Base automatically changed from feat/attestation/config to main April 6, 2023 15:00
@daniel-weisse daniel-weisse force-pushed the feat/config/attestation-options branch from 6b4e9b0 to 9232e79 Compare April 11, 2023 06:59
@netlify

This comment was marked as spam.

Sign in to view
@daniel-weisse daniel-weisse force-pushed the feat/config/attestation-options branch 2 times, most recently from 44c81b6 to af32533 Compare April 11, 2023 07:58
@daniel-weisse daniel-weisse marked this pull request as ready for review April 11, 2023 08:03
@daniel-weisse daniel-weisse requested a review from thomasten April 11, 2023 08:03
thomasten
thomasten reviewed Apr 13, 2023
View reviewed changes
derpsteb
derpsteb reviewed Apr 13, 2023
View reviewed changes
derpsteb
derpsteb reviewed Apr 13, 2023
View reviewed changes
@katexochen katexochen removed their request for review April 13, 2023 13:26
derpsteb
derpsteb reviewed Apr 13, 2023
View reviewed changes
derpsteb
derpsteb reviewed Apr 13, 2023
View reviewed changes
derpsteb
derpsteb reviewed Apr 13, 2023
View reviewed changes
@daniel-weisse daniel-weisse force-pushed the feat/config/attestation-options branch from 6fce6b6 to 0e8f999 Compare April 14, 2023 07:12
@daniel-weisse daniel-weisse mentioned this pull request Apr 14, 2023
Merged
3 tasks
thomasten
thomasten approved these changes Apr 14, 2023
View reviewed changes
Copy link
Member
@thomasten thomasten left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. I'd like @derpsteb to have a look at the changes to the upgrade code of the CLI if he hasn't done that yet.

derpsteb
derpsteb reviewed Apr 17, 2023
View reviewed changes
derpsteb
derpsteb reviewed Apr 17, 2023
View reviewed changes
derpsteb
derpsteb reviewed Apr 17, 2023
View reviewed changes
derpsteb
derpsteb reviewed Apr 17, 2023
View reviewed changes
derpsteb
derpsteb approved these changes Apr 17, 2023
View reviewed changes
Copy link
Contributor
@derpsteb derpsteb left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Azure, 1+1, 2.7.0--> head
GCP, 1+1, 2.7.0 --> head

Code lgtm. Would wait for the upgrade to go through before merging. Should test the migration pretty acurately imo.
EDIT: ugh. we need migrations for the upgrade tests 😁

Tests do not support migration chaining (2.6.0 -> 2.7.0 -> 2.8.0), yet. We should implement that soon.

@daniel-weisse daniel-weisse force-pushed the feat/config/attestation-options branch from f684f21 to fe20fa4 Compare April 24, 2023 10:59
@daniel-weisse
Copy link
Member Author

Fix for the upgrade e2e test and config migration in general available here: #1678

@daniel-weisse daniel-weisse force-pushed the feat/config/attestation-options branch 4 times, most recently from 4fd9092 to 646c7f9 Compare May 2, 2023 09:19
@daniel-weisse
Copy link
Member Author
daniel-weisse commented May 2, 2023 •
edited
Loading

e2e upgrade tests:
Azure: v2.7.0 --> HEAD
GCP: v2.7.0 --> HEAD

daniel-weisse and others added 13 commits May 3, 2023 10:16
@daniel-weisse
Add attestation options to config
f62b80b 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
@daniel-weisse
Fix upgrades
3f5dfc8 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
@daniel-weisse
Add join-config migration path
568bcd6 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
@daniel-weisse
Fix openstack test
72ec533 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
@daniel-weisse
Regenerate config doc
a972397 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
@daniel-weisse
Suggestions
26ba009 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
@daniel-weisse
Replace NewerThan with EqualTo method
8c7a50b 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
@daniel-weisse
Fix missing maaURL in upgrade apply
db5115c 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
@daniel-weisse
Review suggestions
c10b772 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
@daniel-weisse
Remove confidential VM option from provider in favor of attestation o…
75badf1 
…ptions

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
@daniel-weisse
Regenerate config docs
f24b59e 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
@daniel-weisse
cli: add config migrate command (#1678)
3b73185 
* Add config migration command

* Use config migration in e2e test

* Auto accept upgrade in e2e test

* Delete GCP storageclass for migration

* Add container image pushing to upgrade e2e test

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
@daniel-weisse
Fix workflow and test
3a0bb63 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
@daniel-weisse daniel-weisse force-pushed the feat/config/attestation-options branch from 646c7f9 to 3a0bb63 Compare May 3, 2023 08:16
@daniel-weisse daniel-weisse merged commit d7a2ddd into main May 3, 2023
@daniel-weisse daniel-weisse deleted the feat/config/attestation-options branch May 3, 2023 09:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@derpsteb derpsteb derpsteb approved these changes

@thomasten thomasten thomasten approved these changes

Assignees
No one assigned
Labels
breaking change Change breaks existing API or configuration. feature This introduces new functionality
Projects
None yet
Milestone
v2.8.0
Development

Successfully merging this pull request may close these issues.
3 participants
@daniel-weisse @derpsteb @thomasten
0