Releases: edgelesssys/constellation
Releases · edgelesssys/constellation
v2.9.0
What's Changed
🛠 Breaking changes
- config: drop support for deprecated Azure's service principal authentication by @elchead in #1906
- cli: change generate-config flag to update-config flag by @miampf in #1897
🎁 New features
- attestation: add
awsSEVSNPas new variant by @derpsteb in #1900 - cli:
statusshows attestation config by @elchead in #2056 - experimental Windows variant of the Constellation cli by @malt3 in #2075
- config: support 'latest' as TCB version value for Azure SEV-SNP by @elchead in #1899
🐛 Bug fixes
- bootstraper: fix 'cannot re-use a name that is still in use' error during init by @daniel-weisse in #1977
🔧 Other changes
- cli: store upgrade files in versioned folders by @msanft in #1929
- cli:
upgrade apply --forceskips all compatibility checks by @elchead in #1940 - cli: deploy aws csi driver per default by @msanft in #1981
- csi: add required policies for aws csi driver by @msanft in #1945
- cli: fail fast when CLI and Constellation versions don't match by @elchead in #1972
- docs: explain the role of PCR[10] and why it is not reproducible by @malt3 in #2011
Full Changelog: v2.8.0...v2.9.0
Contributors
malt3, derpsteb, and 4 other contributors
Assets 16
v2.8.0
What's Changed
🛠 Breaking changes
- config: add separate option for handling attestation parameters by @daniel-weisse in #1623
🎁 New features
- Terraform log support by @msanft in #1620
- OpenStack service type loadbalancer (yawol) by @malt3 in #1705
- deps: add Kubernetes v1.27, remove Kubernetes v1.24 by @katexochen in #1669
- cli: OpenStack encrypted csi block storage (cinder) by @m1ghtym0 in #1771
- cli: new flag to set the attestation type for
config generateby @elchead in #1769 - Add autoscaling and cluster upgrade support for AWS by @3u13r in #1758
- cli: Terraform migrations on upgrade by @msanft in #1685
🐛 Bug fixes
🔧 Other changes
- docs: add short explanation on attestation config options by @daniel-weisse in #1654
- docs: update state of clouds by @m1ghtym0 in #1732
New Contributors
Full Changelog: v2.7.1...v2.8.0
Contributors
malt3, m1ghtym0, and 6 other contributors
Assets 14
v2.7.1
What's Changed
🐛 Bug fixes
- fix broken configuration generation in the macOS CLI by @malt3 in #1632
- cli: fix misleading error while applying kubernetes-only upgrade by @derpsteb in #1630
- cli: fix
constellation iam destroyerror on Azure by force-deleting resource group by @msanft in #1667 - upgrade: fix 2.6 -> 2.7 migration for 2.7.1 patch by @derpsteb in #1649
- cli: create namespaced folders for upgrade backups in
upgrade applyby @derpsteb in #1702
Full Changelog: v2.7.0...v2.7.1
Contributors
malt3, derpsteb, and msanft
Assets 10
v2.7.0
What's Changed
🛠 Breaking changes
- config: remove deprecated
upgradeConfigand requirenameandmicroserviceVersionfields by @daniel-weisse in #1541
🎁 New features
- attestation: add options to the
EnforceIDKeyDigestconfig field to enable Microsoft Azure Attestation fallback when verifying AMD SNP-SEV id key digest by @daniel-weisse in #1257 - cli:
upgrade applynow allows upgrading measurements only by @derpsteb in #1432 - config: deprecate
confidentialVMconfig option for Azure clusters in favor ofattestationVariantby @daniel-weisse in #1539 - docs: list minimal permissions set required for Constellation setup by @msanft in #1442
- cli: add
statuscommand to print upgrade and version status of cluster by @derpsteb in #1520 - cli: show available cli upgrades with
upgrade checkcommand by @msanft in #1394 - cli: print attestation document during verification with
constellation verifyby @msanft in #1577
🐛 Bug fixes
- bootstrapper: mitigate timeout issue during Cilium deployment by @Nirusu in #1403
- cli: prevent double initialization in cases where an error was mistakenly retried by @Nirusu in #1404
- cli: fix
upgrade applyfor image-only upgrades by @derpsteb in #1468 - ci: correctly determine PCR5 value by measuring it during build time by @derpsteb in #1521
🔧 Other changes
- attestation: create issuer based on kernel cmd line by @daniel-weisse in #1355
- docs: embedd asciinema casts by @datosh in #1154
- cli: only create resource backups if upgrade is executed by @derpsteb in #1437
- cli: grant Azure user-assigned managed identities all permissions previously granted to app registration by @malt3 in #1334
- experimental support for OpenStack by @malt3 in #1443
- cli: warn about missing support for upgrades on AWS, OpenStack, QEMU by @derpsteb in #1518
Full Changelog: v2.6.0...v2.7.0
Contributors
malt3, datosh, and 4 other contributors
Assets 10
v2.6.0
What's Changed
🛡 Security improvements
- Fix a vulnerability where an attacker with access to the victim's cloud subscription could gain code execution on a booting node through the initramfs emergency shell. See the accompanying security advisory for more information.
🎁 New features
- cli: refactor upgrade commands to support Kubernetes, microservice and image upgrades. Previously only supported image upgrades by @derpsteb in #1109, #1160
- cli: add
iam destroycommand to delete resources created byiam createby @miampf in #946 - cli: add basic support for
constellation createon OpenStack by @malt3 in #1283 - Enable cryptsetup read/write workqueue bypass by @daniel-weisse in #1150
- cli: add option to automatically merge new Constellation kubeconfig file into default configuration at
$HOME/.kube/configon init by @daniel-weisse in #1136 - init: create kubeconfig file with unique user/cluster name by @daniel-weisse in #1133
- cli: add
--kubernetesflag toconfig generateto let CLI extend the correct Kubernetes patch version by @derpsteb in #1226 - cli: add
--kubernetesflag toiam create(when used with--create-config) by @Nirusu in #1326 - cli: add
config kubernetes-versionssubcommand to print supported Kubernetes versions by @derpsteb in #1224 - ci: build microservices reproducibly using ko by @leongross in #1108
- apko: build apko base images with fixed packages by @katexochen in #1090
- join-service: more logging on error by @daniel-weisse in #1076
- cli: add debug logging to
iam createcommand by @msanft in #1127 - cli: add name of build type to version cmd output by @katexochen in #1179
- cli: option to disable spinner via environment variable by @datosh in #1207
- cli: add support for GCP C2D confidential VMs by @Nirusu in #1225
- cli: add debug logging to attestation validator/issuer by @daniel-weisse in #1262, #1264
- image: add verbose service logging for debug images by @leongross in #1159
- attestation: validate GCP machine state instead of PCR 0 by @thomasten in #1343
🐛 Bug fixes
- config: fix digest naming by @3u13r in #1064
- cli: set uid output for QEMU / MiniConstellation so Constellation on QEMU can be created correctly by @malt3 in #1069
- terraform: make control-planes stateful on gcp so the control-plane does not break when VMs are stopped and later restarted by @3u13r in #1087
- bootstrapper: retry helm chart installation so slow Konnectivity startup does not break cluster initialization by @derpsteb in #1151
- cli: throw an error when executing
iam createtwice in the same workspace. This prevents cases where existing IAM resources are mistakenly rolled back by @msanft in #1148 - cli: print previously hidden, but required GCP values (zone, region, projectID) to config/stdout when running
iam createby @msanft in #1149 - cli: fix pluralization in
createoutput by @daniel-weisse in #1209 - iam: correctly assign uami role to base resource group by @3u13r in #1247
- bootstrapper: retry helm chart installation on connection refused errors by @3u13r in #1245
- cli: allow existing config for IAM creation without
--generate-configby @Nirusu in #1285 - cli: upgrade libtpms in libvirt container by @malt3 in #1338
- bootstrapper: stop join-client earlier by @daniel-weisse in #1268
- bootstrapper: make sure InitServer is only shut down after Init has returned by @daniel-weisse in #1347
🔧 Other changes
- versions: remove Kubernetes v1.23 by @katexochen in #1080
- azure: add new idkeydigest by @3u13r in #1094
- cli: enable jumbo frames for GCP VPCs by @Nirusu in #1146
- cli: use pseudoversion and forward it into helm charts by @derpsteb in #1281
- docs: add docs on general Terraform usage by @msanft in #1263
- docs: adjust wording for resource provider troubleshooting by @Nirusu in #1317
- docs: upgrade docs now reflect the new upgrade commands by @derpsteb in #1331
New Contributors
Full Changelog: v2.5.0...v2.6.0
Contributors
malt3, datosh, and 9 other contributors
Assets 10
v2.5.3
What's Changed
🐛 Bug fixes
- bootstrapper: retry helm chart installation on
connection refusederrors by @3u13r in #1245 - bootstrapper: retry helm chart installation on
timeouterrors by @derpsteb in #1151 - cli: check local dir before executing
iam createto prevent erroneous rollback by @msanft in #1148 - cli: print gcp values to stdout and config (optionally) when running
iam createby @msanft in #1149 - cli: correctly assign uami role to base resource group by @3u13r in #1247
- cli: make control-planes stateful on gcp by @3u13r in #1087
- cli: set required uid output for QEMU / MiniConstellation by @malt3 in #1069
Full Changelog: v2.5.2...v2.5.3
Contributors
malt3, derpsteb, and 2 other contributors
Assets 10
v2.5.2
What's Changed
🔒 Security
- aTLS: a bug was fixed where a malicious CSP insider could have used a MITM attack to gain control over the cluster during initialization. See the accompanying security advisory for more information.
Full Changelog: v2.5.1...v2.5.2
v2.5.1
Contributors
3u13r
Assets 10
v2.5.0
Hints
- Azure is currently rolling out a new ID key on Azure CVMs. Therefore
constellation-initmay report an invalididkeydigest. To circumvent the problem, add under the keyidKeyDigestin yourconstellation-conf.yamlan additional value:
934f68bd8ba01938eec21475c872e3a942b60c59fafc6df9e9a76ee66bc47f2d09c676f61c0315c578da26085fb13a71
We're working on a permanent solution for this.
What's Changed
🎁 New features
- cli: add
--generate-configflag toconstellation iam createcommand, which creates a config file with IAM values filled in by @msanft in #782 - image: enable serial console access for MiniConstellation to simplify troubleshooting by @malt3 in #964
- azure: allow a set of idkeydigest values by @3u13r in #991
🐛 Bug fixes
- upgrade: fix broken reference from constellation-os to constellation-version by @datosh in #939
- cli: remove registry_auth for Docker Terraform module by @Nirusu in #957
- cli: use non-authoritative methods to manage iam policy memberships by @malt3 in #989
- image: fix "ignored null byte in input" warning on AWS by @Nirusu in #998
- cli: fix Terraform resource group dependencies on Azure by @msanft in #1048
🔧 Other changes
- ci: build reproducible container images with ko by @leongross in #871
- kms: rename kms to keyservice by @derpsteb in #943
- cli: debug: various improvements by @Nirusu in #995
- docs: explain how to use Terraform for create/terminate by @3u13r in #1037
- config: detailed validation errors for k8s version by @derpsteb in #1018
Full Changelog: v2.4.0...v2.5.0
Contributors
malt3, datosh, and 5 other contributors
Assets 10
v2.4.0
Hints
- Azure is currently rolling out a new ID key on Azure CVMs. Therefore
constellation-initmay report an invalididkeydigest. To circumvent the problem change the keyidKeyDigestin yourconstellation-conf.yamlto the new value:0356215882a825279a85b300b0b742931d113bf7e32dde2e50ffde7ec743ca491ecdd7f336dc28a6e0b2bb57af7a44a3 - The original SBOM for the CLI uploaded with this release is invalid. The SBOMs for container images in the registry are unaffected by this issue. We uploaded a corrected for the CLI SBOM with the extension
.fixed.below. We keep the original ones uploaded with.original.to keep the provenance valid. In doubt, you can independently generate a SBOM of all components using Syft.
What's Changed
🎁 New features
- kubernetes: add support for v1.26; set default version to v1.25 by @katexochen in #775
- cli: add verbose logging with
--debugflag by @osintalex in #809
🐛 Bug fixes
- join: make Azure instance names k8s compliant by @3u13r in #807
- image: fix disk performance degradation on Azure by downgrading kernel by @malt3 in #862
🔧 Other changes
- cli: add microservice upgrades behind hidden flags by @derpsteb in #729
- Move Konnectivity socket to non-persistent /run by @Nirusu in #819
- Add upgrade agent for automatic version updates by @stdoutput in #745
- upgrade: support Kubernetes components by @3u13r in #839
- operator: add kubernetes cluster version to constellation-version by @3u13r in #865
- cli: create local backups before microservice upgrades by @derpsteb in #847
- cli: ask user to confirm cert-manager upgrades by @derpsteb in #853
- operator: reconcile Kubernetes cluster version by @3u13r in #879
New Contributors
- @osintalex made their first contribution in #809
Full Changelog: v2.3.0...v2.4.0
Contributors
malt3, derpsteb, and 5 other contributors