From 395531e8d7f461d38f7e7c436cb9ea6d7a4713fb Mon Sep 17 00:00:00 2001 From: Moritz Sanft <58110325+msanft@users.noreply.github.com> Date: Fri, 12 Apr 2024 16:08:11 +0200 Subject: [PATCH] attestationconfigapi: add GCP to uploading --- .github/actions/e2e_verify/action.yml | 2 +- .github/workflows/e2e-attestationconfigapi.yml | 2 +- .github/workflows/e2e-test-weekly.yml | 5 +++++ .../api/attestationconfigapi/attestationconfigapi.go | 2 +- internal/api/attestationconfigapi/cli/upload.go | 12 +++++++----- internal/api/attestationconfigapi/client.go | 2 +- internal/api/attestationconfigapi/reporter.go | 6 +++--- internal/api/attestationconfigapi/snp.go | 10 +++++----- internal/attestation/gcp/snp/issuer.go | 6 +++--- 9 files changed, 27 insertions(+), 20 deletions(-) diff --git a/.github/actions/e2e_verify/action.yml b/.github/actions/e2e_verify/action.yml index aca4fdceb48..c52d02f43b9 100644 --- a/.github/actions/e2e_verify/action.yml +++ b/.github/actions/e2e_verify/action.yml @@ -84,7 +84,7 @@ runs: aws-region: eu-central-1 - name: Upload extracted TCBs - if: github.ref_name == 'main' && (inputs.attestationVariant == 'azure-sev-snp' || inputs.attestationVariant == 'aws-sev-snp') + if: github.ref_name == 'main' && (inputs.attestationVariant == 'azure-sev-snp' || inputs.attestationVariant == 'aws-sev-snp' || inputs.attestationVariant == 'gcp-sev-snp') shell: bash env: COSIGN_PASSWORD: ${{ inputs.cosignPassword }} diff --git a/.github/workflows/e2e-attestationconfigapi.yml b/.github/workflows/e2e-attestationconfigapi.yml index a3605dafce3..e02c1d4db1f 100644 --- a/.github/workflows/e2e-attestationconfigapi.yml +++ b/.github/workflows/e2e-attestationconfigapi.yml @@ -22,7 +22,7 @@ jobs: fail-fast: false max-parallel: 1 matrix: - csp: ["azure", "aws"] + csp: ["azure", "aws", "gcp"] runs-on: ubuntu-22.04 permissions: id-token: write diff --git a/.github/workflows/e2e-test-weekly.yml b/.github/workflows/e2e-test-weekly.yml index fff76008405..f656775ab5d 100644 --- a/.github/workflows/e2e-test-weekly.yml +++ b/.github/workflows/e2e-test-weekly.yml @@ -281,6 +281,11 @@ jobs: attestationVariant: "gcp-sev-es" kubernetes-version: "v1.28" clusterCreation: "cli" + - test: "verify" + refStream: "ref/release/stream/stable/?" + attestationVariant: "gcp-sev-snp" + kubernetes-version: "v1.28" + clusterCreation: "cli" - test: "verify" refStream: "ref/release/stream/stable/?" attestationVariant: "azure-sev-snp" diff --git a/internal/api/attestationconfigapi/attestationconfigapi.go b/internal/api/attestationconfigapi/attestationconfigapi.go index e170da869b5..a0d84d7863b 100644 --- a/internal/api/attestationconfigapi/attestationconfigapi.go +++ b/internal/api/attestationconfigapi/attestationconfigapi.go @@ -15,7 +15,7 @@ information contained in the objects. Especially the paths used for the API are in these helper methods. Regarding the decision to implement new types over using the existing types from internal/config: -AttesationCfg objects for AttestationCfg API need to hold some version information (for sorting, recognizing latest). +AttestationCfg objects for AttestationCfg API need to hold some version information (for sorting, recognizing latest). Thus, existing config types (AWSNitroTPM, AzureSEVSNP, ...) can not be extended to implement apiObject interface. Instead, we need a separate type that wraps _all_ attestation types. In the codebase this is done using the AttestationCfg interface. The new type AttestationCfgGet needs to be located inside internal/config in order to implement UnmarshalJSON. diff --git a/internal/api/attestationconfigapi/cli/upload.go b/internal/api/attestationconfigapi/cli/upload.go index 54036009ab0..98303cae2d8 100644 --- a/internal/api/attestationconfigapi/cli/upload.go +++ b/internal/api/attestationconfigapi/cli/upload.go @@ -26,7 +26,7 @@ import ( func newUploadCmd() *cobra.Command { uploadCmd := &cobra.Command{ - Use: "upload {azure|aws} {snp-report|guest-firmware} ", + Use: "upload {aws|azure|gcp} {snp-report|guest-firmware} ", Short: "Upload an object to the attestationconfig API", Long: fmt.Sprintf("Upload a new object to the attestationconfig API. For snp-reports the new object is added to a cache folder first."+ @@ -92,17 +92,19 @@ func runUpload(cmd *cobra.Command, args []string) (retErr error) { return fmt.Errorf("creating client: %w", err) } - var attesation variant.Variant + var attestation variant.Variant switch uploadCfg.provider { case cloudprovider.AWS: - attesation = variant.AWSSEVSNP{} + attestation = variant.AWSSEVSNP{} case cloudprovider.Azure: - attesation = variant.AzureSEVSNP{} + attestation = variant.AzureSEVSNP{} + case cloudprovider.GCP: + attestation = variant.GCPSEVSNP{} default: return fmt.Errorf("unsupported cloud provider: %s", uploadCfg.provider) } - return uploadReport(ctx, attesation, client, uploadCfg, file.NewHandler(afero.NewOsFs()), log) + return uploadReport(ctx, attestation, client, uploadCfg, file.NewHandler(afero.NewOsFs()), log) } func uploadReport(ctx context.Context, diff --git a/internal/api/attestationconfigapi/client.go b/internal/api/attestationconfigapi/client.go index 583e3bba4d8..204e12e947f 100644 --- a/internal/api/attestationconfigapi/client.go +++ b/internal/api/attestationconfigapi/client.go @@ -48,7 +48,7 @@ func NewClient(ctx context.Context, cfg staticupload.Config, cosignPwd, privateK return repo, clientClose, nil } -// uploadSEVSNPVersion uploads the latest version numbers of the Azure SEVSNP. Then version name is the UTC timestamp of the date. The /list entry stores the version name + .json suffix. +// uploadSEVSNPVersion uploads the latest version numbers of the SEVSNP. Then version name is the UTC timestamp of the date. The /list entry stores the version name + .json suffix. func (a Client) uploadSEVSNPVersion(ctx context.Context, attestation variant.Variant, version SEVSNPVersion, date time.Time) error { versions, err := a.List(ctx, attestation) if err != nil { diff --git a/internal/api/attestationconfigapi/reporter.go b/internal/api/attestationconfigapi/reporter.go index 00656e8816a..72a98034799 100644 --- a/internal/api/attestationconfigapi/reporter.go +++ b/internal/api/attestationconfigapi/reporter.go @@ -5,7 +5,7 @@ SPDX-License-Identifier: AGPL-3.0-only */ /* -The reporter contains the logic to determine a latest version for Azure SEVSNP based on cached version values observed on CVM instances. +The reporter contains the logic to determine a latest version for SEVSNP based on cached version values observed on CVM instances. Some code in this file (e.g. listing cached files) does not rely on dedicated API objects and instead uses the AWS SDK directly, for no other reason than original development speed. */ @@ -79,11 +79,11 @@ func (c Client) UploadSEVSNPVersionLatest(ctx context.Context, attestation varia if err := c.uploadSEVSNPVersion(ctx, attestation, minVersion, t); err != nil { return fmt.Errorf("uploading version: %w", err) } - c.s3Client.Logger.Info(fmt.Sprintf("Successfully uploaded new Azure SEV-SNP version: %+v", minVersion)) + c.s3Client.Logger.Info(fmt.Sprintf("Successfully uploaded new SEV-SNP version: %+v", minVersion)) return nil } -// cacheSEVSNPVersion uploads the latest observed version numbers of the Azure SEVSNP. This version is used to later report the latest version numbers to the API. +// cacheSEVSNPVersion uploads the latest observed version numbers of the SEVSNP. This version is used to later report the latest version numbers to the API. func (c Client) cacheSEVSNPVersion(ctx context.Context, attestation variant.Variant, version SEVSNPVersion, date time.Time) error { dateStr := date.Format(VersionFormat) + ".json" res := putCmd{ diff --git a/internal/api/attestationconfigapi/snp.go b/internal/api/attestationconfigapi/snp.go index 68098a3ad6b..a0f92700b60 100644 --- a/internal/api/attestationconfigapi/snp.go +++ b/internal/api/attestationconfigapi/snp.go @@ -19,15 +19,15 @@ import ( // AttestationURLPath is the URL path to the attestation versions. const AttestationURLPath = "constellation/v1/attestation" -// SEVSNPVersion tracks the latest version of each component of the Azure SEVSNP. +// SEVSNPVersion tracks the latest version of each component of the SEVSNP. type SEVSNPVersion struct { - // Bootloader is the latest version of the Azure SEVSNP bootloader. + // Bootloader is the latest version of the SEVSNP bootloader. Bootloader uint8 `json:"bootloader"` - // TEE is the latest version of the Azure SEVSNP TEE. + // TEE is the latest version of the SEVSNP TEE. TEE uint8 `json:"tee"` - // SNP is the latest version of the Azure SEVSNP SNP. + // SNP is the latest version of the SEVSNP SNP. SNP uint8 `json:"snp"` - // Microcode is the latest version of the Azure SEVSNP microcode. + // Microcode is the latest version of the SEVSNP microcode. Microcode uint8 `json:"microcode"` } diff --git a/internal/attestation/gcp/snp/issuer.go b/internal/attestation/gcp/snp/issuer.go index 806baa2619e..0ceb5e9601d 100644 --- a/internal/attestation/gcp/snp/issuer.go +++ b/internal/attestation/gcp/snp/issuer.go @@ -62,8 +62,8 @@ func getInstanceInfo(_ context.Context, _ io.ReadWriteCloser, extraData []byte) if len(extraData) > 64 { return nil, fmt.Errorf("extra data too long: %d, should be 64 bytes at most", len(extraData)) } - truncatedExtraData := make([]byte, 64) - copy(truncatedExtraData, extraData) + extraData64 := make([]byte, 64) + copy(extraData64, extraData) device, err := sevclient.OpenDevice() if err != nil { @@ -71,7 +71,7 @@ func getInstanceInfo(_ context.Context, _ io.ReadWriteCloser, extraData []byte) } defer device.Close() - report, certs, err := sevclient.GetRawExtendedReportAtVmpl(device, [64]byte(truncatedExtraData), 0) + report, certs, err := sevclient.GetRawExtendedReportAtVmpl(device, [64]byte(extraData64), 0) if err != nil { return nil, fmt.Errorf("getting extended report: %w", err) }