fixup! test devbuild

edgelesssys · Jan 2, 2024 · 6487377 · 6487377
1 parent c05bcfe
commit 6487377
Show file tree

Hide file tree

Showing 19 changed files with 637 additions and 0 deletions.
diff --git a/.github/workflows/e2e-test-provider-example.yml b/.github/workflows/e2e-test-provider-example.yml
@@ -124,6 +124,21 @@ jobs:
           cd build
           bazel run //:devbuild --cli_edition=enterprise
 
+      - name: Remove local Terraform registry
+        if: inputs.providerVersion == ''
+        shell: bash
+        run: |
+          bazel build //bazel/settings:tag
+          repository_root=$(git rev-parse --show-toplevel)
+          out_rel=$(bazel cquery --output=files //bazel/settings:tag)
+          build_version=$(cat "$(realpath "${repository_root}/${out_rel}")")
+
+          terraform_provider_dir="${HOME}/.terraform.d/plugins/registry.terraform.io/edgelesssys/constellation/${build_version#v}/linux_amd64/"
+
+          # remove local registry if it was used and public registry should be used now
+          rm -rf "${terraform_provider_dir}"
+          echo "build_version=${build_version}" | tee -a "$GITHUB_OUTPUT"
+
       - name: Login to AWS (IAM + Cluster role)
         if: inputs.cloudProvider == 'aws'
         uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2.2.0

diff --git a/terraform-provider-constellation/examples/full/aws/.terraform.lock.hcl b/terraform-provider-constellation/examples/full/aws/.terraform.lock.hcl
diff --git a/terraform-provider-constellation/examples/full/aws/_override.tf b/terraform-provider-constellation/examples/full/aws/_override.tf
@@ -0,0 +1,28 @@
+terraform {
+  required_providers {
+    constellation = {
+      source  = "edgelesssys/constellation"
+      version = "2.15.0-pre.0.20231229125039-57f8888b02cf"
+    }
+  }
+}
+locals {
+  name                = "e2e-599" # try -1
+  image_version       = "ref/main/stream/nightly/v2.15.0-pre.0.20231229110237-07c884b94501"
+  worker_count        = 1
+  control_plane_count = 1
+}
+
+resource "constellation_cluster" "aws_example" {
+  constellation_microservice_version = "v2.15.0-pre.0.20231229125039-57f8888b02cf"
+  kubernetes_version                 = "v1.28.4"
+}
+
+module "aws_iam" {
+  source = "https://github.com/edgelesssys/constellation/releases/download/v2.14.2/terraform-module.zip//terraform-module/iam/aws"
+  #source = "../../../../terraform/infrastructure/iam/gcp"
+}
+module "aws_infrastructure" {
+  source = "https://github.com/edgelesssys/constellation/releases/download/v2.14.2/terraform-module.zip//terraform-module/aws"
+  #source = "../../../../terraform/infrastructure/gcp"
+}
diff --git a/terraform-provider-constellation/examples/full/aws/constellation-admin.conf b/terraform-provider-constellation/examples/full/aws/constellation-admin.conf
@@ -0,0 +1,19 @@
+apiVersion: v1
+clusters:
+- cluster:
+    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURCVENDQWUyZ0F3SUJBZ0lJTVlpTC9ldVErZG93RFFZSktvWklodmNOQVFFTEJRQXdGVEVUTUJFR0ExVUUKQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TXpFeU1qa3hNek14TWpsYUZ3MHpNekV5TWpZeE16TTJNamxhTUJVeApFekFSQmdOVkJBTVRDbXQxWW1WeWJtVjBaWE13Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLCkFvSUJBUUROdVV4aExSRVc2ZFlQdDlaUUViS1F5aXNrQnEwRVNxaXlKa1RCT1lEMEJRa0x2bnBDSStoKzNWNjYKazMzREV1bkE2YU1mUXhpVElaMVNWYVRCZ1k0ekJGNFlRekFlckhEa1JWSmwvamN4ZEJuSlJIdXphNFpLd0MxMgo1U1NOcEJWTHc0TzQyS2kvenJ6M2s4VFJIMUtJZExEdWpKR0xIM0Y0ZVJjNnp0MWlweC9VOEVjbjZUMjMzb1YzCkhPVFp5L1E0NEFJZTZ3VDFRZDJUb2pSWFh4UTBMVEs1L3RYM1ZHRGU4V1NKVElkMjErdjNoSVFVTm8wejNhVGIKQUVZdU03VGF3OTI0Q0YyRmZMVWZMS3lVcXVacDhxQ21HUE0ybC9nc1VKa0RkU05vbFYzcFVTQzBIZGxMb3dFKwpJQ3NyZHkrQlFTS3dQdC9ReDBtMlp4OTV5VHNIQWdNQkFBR2pXVEJYTUE0R0ExVWREd0VCL3dRRUF3SUNwREFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUIwR0ExVWREZ1FXQkJRMTJZc2pNcGdERzlNcDhOakxoTWJiSTZzRm5qQVYKQmdOVkhSRUVEakFNZ2dwcmRXSmxjbTVsZEdWek1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRRENObEFGK0tyRgpMVHh5andROTVLRU5Ec3VDdGhtQmZ6WS9oTXVKOTBuMEswdGlJTURZdkpGSUgwMVZRSkVwVlZJV0tXMTE0TnhZCmNPZ2lqMjJPcGQ4ZkpYczVQaGUrVVlreU5NMUdmbUx0a0dsNFJONWU1ZmNKcTk2SHk1Qkd2OFhFSDhvdytDdDkKaHRwYXBBMHpFRFdLYkhHZWlHN05KUmpoOFlYRjdFS0oxamFUZFp2Z0hXMmt3a0ZGZmM5N0ZmWXNTNFZSRW5GQgpQQjVtN1pZYzBxcDQ4UE5ERWp4T3VzaGlpdUdHTU0xbklobHRVWFdhVExxY1pHT3hVREhGWHNmWVhyUDhhdXpFCmVOZnc1RVEyYWtBTUVqcVk3V0pTaURKcDEydU9EdjBxZ2Zlb0lhRlJoMnQ1MEpRK3ExMFhKZzZSUGNoV1Zpd04KUkpETFhIemJXMHlWCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+    server: https://e2e-599-3d8128a6-loadbalancer-2fcf81a64538d695.elb.us-east-2.amazonaws.com:6443
+  name: e2e-599-3d8128a6
+contexts:
+- context:
+    cluster: e2e-599-3d8128a6
+    user: e2e-599-3d8128a6-admin
+  name: e2e-599-3d8128a6-admin@e2e-599-3d8128a6
+current-context: e2e-599-3d8128a6-admin@e2e-599-3d8128a6
+kind: Config
+preferences: {}
+users:
+- name: e2e-599-3d8128a6-admin
+  user:
+    client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lJRU9EOVNkZTJRakl3RFFZSktvWklodmNOQVFFTEJRQXdGVEVUTUJFR0ExVUUKQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TXpFeU1qa3hNek14TWpsYUZ3MHlOREV5TWpneE16TTJOVE5hTURveApGekFWQmdOVkJBb1REbk41YzNSbGJUcHRZWE4wWlhKek1SOHdIUVlEVlFRREV4WmxNbVV0TlRrNUxUTmtPREV5Ck9HRTJMV0ZrYldsdU1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBNUZZU1ZGWksKSncvQjRzR0lxdld0SHN1ejdTaVpNZlY0V2lnTmV6dU1qQWhGMXpvaVo5TDczazRFNGlKOFlEWDUrVGwzVU1vNApVQUp4RUtBbVp2OWdMTmFsUXNXMGV6Nzl4S2Z4SWZsUmxtbVI2K2FVZjU4ZFJaUVZOSDZLYkZoVnVmOXNwcjRmCklORXd6Sk5VVUhONklkL0V4cDJSTHdlTWswK0tONlY1VWtXVUd2RzErZkROaHVsWTRtSENyQkZlOWlzNFMxU1IKQnhteDVtZzNrdUZxdm9uOWFvT3ZScUdHZFA2MFJPRVVGMHFQUlBPZHFIVTZNdUtwL0ZySXYvbGtQaGMydmhXWgorbldPeVI3d25OTHZDWmZWdHJvaXlNdFdoSTJzTEV2aVFtSUpNcEVWaHppbXVPdVExZ1l3WUQzV2V5QWVRalV3CmtPWmVUSnFCWm5MWTF3SURBUUFCbzFZd1ZEQU9CZ05WSFE4QkFmOEVCQU1DQmFBd0V3WURWUjBsQkF3d0NnWUkKS3dZQkJRVUhBd0l3REFZRFZSMFRBUUgvQkFJd0FEQWZCZ05WSFNNRUdEQVdnQlExMllzak1wZ0RHOU1wOE5qTApoTWJiSTZzRm5qQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUF0TnFBWi8vc1pqMmlDZEJOTi9HV1JOV0FSMHV5ClUxckp5OG1IQjgxVHZ1SFpLZTAxOE4yNHhlZ01oYzkvSzBGbWwreUNUSm5ubnBuemdsTmhEbm5FaTNBVFhlbVgKaW9pN3BqcTJVdXNmNWxqTjVMNWpFMHhDcUtabU5YN2h6REVsSVlRT3RPdHh3NWx1b1NDRG4yU0JSTTZsamE2cgp1TmFtcDJiS0VzbGYrTWQwdjBwM0FGN0lKRUdCWml3bXFjR3VabS8yUUNHQVY5SDJLcFI1L0hyVS9TcDc2a3VUCm9Bem5Ob3dxa21yVDh0SXBGenNYY3hhUkU0c0xDSExsbTZPQVFHVklpQUJXWGthcE1HN2x2bUhlOGxNeGI1TEYKZGdCWTIrTXZmVkVqRFVwQWZIWHIwNDZnR2lFTXNSQXU2NFZVdEpMMm43NWgrRUw1WGJuUkQ2SWpPdz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+    client-key-data: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBNUZZU1ZGWktKdy9CNHNHSXF2V3RIc3V6N1NpWk1mVjRXaWdOZXp1TWpBaEYxem9pClo5TDczazRFNGlKOFlEWDUrVGwzVU1vNFVBSnhFS0FtWnY5Z0xOYWxRc1cwZXo3OXhLZnhJZmxSbG1tUjYrYVUKZjU4ZFJaUVZOSDZLYkZoVnVmOXNwcjRmSU5Fd3pKTlVVSE42SWQvRXhwMlJMd2VNazArS042VjVVa1dVR3ZHMQorZkROaHVsWTRtSENyQkZlOWlzNFMxU1JCeG14NW1nM2t1RnF2b245YW9PdlJxR0dkUDYwUk9FVUYwcVBSUE9kCnFIVTZNdUtwL0ZySXYvbGtQaGMydmhXWituV095Ujd3bk5MdkNaZlZ0cm9peU10V2hJMnNMRXZpUW1JSk1wRVYKaHppbXVPdVExZ1l3WUQzV2V5QWVRalV3a09aZVRKcUJabkxZMXdJREFRQUJBb0lCQVFDUStCaXhGUXdGV3RyRgpaZ3lvUmt6QTFhSUp1NUh3QnlKL1V4aWtHZjIwMW5mSkd5N0c3a3hkS3Ztc3ZTcHNSempMUS9IK0NEWFNqb3BNCmZQR0V5VFM5b3hYUG5BaG5pMm5BMXNPZ3gxTkdoUVpSV05jRlkvZEl1cWp2NkR0b2FIa2RHdzlYbWpQWE9SbWIKZVJxNTdXY29aSkxoYXg3SFZpcXBTSUcvckw2blBUUzI0MzViN285cUJvQlhLTXAxckJ5R0E3MjNBalhscXdnMwpHZGVIakNYbVh0emN6Q0VUcTZIUXF1Nm5hMEhxNnBCc2UrNjlEbkVFb25kQy9qNkI2enRvUThrVzdhMHVDMVNUCmpyU0RSd0J1Ym8xVEg5UWd5MGY2Q2cyZHFqRTV2cWxqZytJdEVSNHl4Zk44eS9lQXVTZENPRUV6a096cXNteDUKZXRyb3g3WUJBb0dCQVBGMW5iTVlkdWE4WG1vd0crN1pOUXFxd3NJd1F4UGUySERYWjNYZklGdzlueUlqbk1wMgpSMnlySHQyaEVremxNMDVrYWdYSXVBN2lZZW5YV21CRnB0TlF5a0l2SitOVWFsYStWUzd1UGdLSDFXWlVZUGExCmZQeEZNY0hHT3FDUHFsYTE2eldEVytMVGpmMXNoVllnRlVvN0NpQXV0MWt6eVhVQTErTXBiNGtCQW9HQkFQSVcKSlVOT3FsVDl6bFM1d25MdjZseXBST250cWNoZHlEOUhteEgxbG9pcnZ4eFpHZUw1dXJxcHBpZ1kxZE9xYmxvOAp5dENRTmQ1b1ZiVk5EU1dhNmZ2UlZJQ1VPakhaS1hSbnVGbkZzWTJsRE9tc2JnaW16RHdCZzRjVEFPUkJEUENDCll2WlRETEVSNXhVN1UyN09GS0JKYW9hRDhrc0lpRDg5c3grcU5jblhBb0dBVW5oSmxKSVdpbGhzSnZpbmtieSsKVVJaaHp0R05GNHhWZ0xVUnNVQzBYTXp2UFVuTWs1b3lhdnRIWDR0VUpNOWo1cktGUTlSNmlScnBObVZIaVBwQgpNSXUzaVVOeDdFTTR6c2ZUY0dRTzZlNWJCTWh0RmRhSENlTFlTOGJZMzE0eVg4dGl1clJTL2ZZajJScm5yN0xsCmtxVDNvR1pVV1RORzY1K09IUmhaOEFFQ2dZQUptNWxrLzNWQkpFV1JGVUpEWDRRMG96OHA3WlhFYnZ4b2pvWDQKQTRBeThtWUdVUDczQkNSR0RqK2E3Y2xtdWlmaEN2S2RybXVFNVMwcG9lSTRzTnBDZFQ5ZVR3TzBRTU1sYkl4agplN1lkUWdTdUxYcThleW8xNDNWOTRlSXlMT2Eva04wdW00TXdiOTUwK0VMS2JnRmhqeWhjS0Zad1plbEtZVDkvCnJUaXZSd0tCZ0JnSE45N29scFZQazBCdW5HMDRsVXNSRGUwa3QwV3N0aGhLbDRJK1crT05zWERlT1RkRGgrMm4KVlJ5TXRSdVI1M1E5SldpS1BzUmhQbW5aYjVaS2V6bjBBM1ovT01SZmx0UUpWWkh6UEVxa2RzZnJXZ201QTZDRApxZ0JkYm0zNHdUN2UrTUZtWFYwNmMyNlNzWW1yTG5HK2lLWVVGcDd4UTBzQ0c0TU9VREg4Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
diff --git a/terraform-provider-constellation/examples/full/aws/constellation-conf.yaml b/terraform-provider-constellation/examples/full/aws/constellation-conf.yaml
@@ -0,0 +1,119 @@
+version: v4 # Schema version of this configuration file.
+image: ref/main/stream/nightly/v2.15.0-pre.0.20231229110237-07c884b94501 # Machine image version used to create Constellation nodes.
+name: constell # Name of the cluster.
+kubernetesVersion: v1.28.4 # Kubernetes version to be installed into the cluster.
+microserviceVersion: v2.15.0-pre.0.20231229125039-57f8888b02cf # Microservice version to be installed into the cluster. Defaults to the version of the CLI.
+debugCluster: false # DON'T USE IN PRODUCTION: enable debug mode and use debug images.
+customEndpoint: "" # Optional custom endpoint (DNS name) for the Constellation API server.
+internalLoadBalancer: false # Flag to enable/disable the internal load balancer. If enabled, the Constellation is only accessible from within the VPC.
+serviceCIDR: 10.96.0.0/12 # The Kubernetes Service CIDR to be used for the cluster. This value will only be used during the first initialization of the Constellation.
+# Supported cloud providers and their specific configurations.
+provider:
+    # Configuration for AWS as provider.
+    aws:
+        region: us-east-2 # AWS data center region. See: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html#concepts-available-regions
+        zone: us-east-2c # AWS data center zone name in defined region. See: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html#concepts-availability-zones
+        iamProfileControlPlane: demoControlPlaneIAMProfile # Name of the IAM profile to use for the control-plane nodes.
+        iamProfileWorkerNodes: demoWorkerNodesIAMProfile # Name of the IAM profile to use for the worker nodes.
+        deployCSIDriver: true # Deploy Persistent Disk CSI driver with on-node encryption. For details see: https://docs.edgeless.systems/constellation/architecture/encrypted-storage
+# Node groups to be created in the cluster.
+nodeGroups:
+    control_plane_default:
+        role: control-plane # Role of the nodes in this group. Valid values are "control-plane" and "worker".
+        zone: eu-central-1a # Availability zone to place the VMs in.
+        instanceType: m6a.xlarge # VM instance type to use for the nodes.
+        stateDiskSizeGB: 30 # Size (in GB) of a node's disk to store the non-volatile state.
+        stateDiskType: gp3 # Type of a node's state disk. The type influences boot time and I/O performance.
+        initialCount: 3 # Number of nodes to be initially created.
+    worker_default:
+        role: worker # Role of the nodes in this group. Valid values are "control-plane" and "worker".
+        zone: eu-central-1a # Availability zone to place the VMs in.
+        instanceType: m6a.xlarge # VM instance type to use for the nodes.
+        stateDiskSizeGB: 30 # Size (in GB) of a node's disk to store the non-volatile state.
+        stateDiskType: gp3 # Type of a node's state disk. The type influences boot time and I/O performance.
+        initialCount: 1 # Number of nodes to be initially created.
+# Configuration for attestation validation. This configuration provides sensible defaults for the Constellation version it was created for.
+# See the docs for an overview on attestation: https://docs.edgeless.systems/constellation/architecture/attestation
+attestation:
+    # AWS SEV-SNP attestation.
+    awsSEVSNP:
+        # Expected TPM measurements.
+        measurements:
+            0:
+                expected: 7b068c0c3ac29afe264134536b9be26f1d4ccd575b88d3c3ceabf36ac99c0278
+                warnOnly: true
+            2:
+                expected: 3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
+                warnOnly: true
+            3:
+                expected: 3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
+                warnOnly: true
+            4:
+                expected: 22f43c9d426f730a02530f58a38d5c20c711a27eba0c3e0f1c1cdec56c00c6c3
+                warnOnly: false
+            6:
+                expected: 3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
+                warnOnly: true
+            8:
+                expected: "0000000000000000000000000000000000000000000000000000000000000000"
+                warnOnly: false
+            9:
+                expected: 1ea2e1b1526698f21b1d969c85f726deedbe4f74c2c2b94464b20f060115b83b
+                warnOnly: false
+            11:
+                expected: 9721f64b41479b32a7577351a0a2f70f7144293844b8407857792c9e2024134a
+                warnOnly: false
+            12:
+                expected: "0000000000000000000000000000000000000000000000000000000000000000"
+                warnOnly: false
+            13:
+                expected: "0000000000000000000000000000000000000000000000000000000000000000"
+                warnOnly: false
+            14:
+                expected: "0000000000000000000000000000000000000000000000000000000000000000"
+                warnOnly: true
+            15:
+                expected: "0000000000000000000000000000000000000000000000000000000000000000"
+                warnOnly: false
+        bootloaderVersion: latest # Lowest acceptable bootloader version.
+        teeVersion: latest # Lowest acceptable TEE version.
+        snpVersion: latest # Lowest acceptable SEV-SNP version.
+        microcodeVersion: latest # Lowest acceptable microcode version.
+        amdRootKey: | # AMD Root Key certificate used to verify the SEV-SNP certificate chain.
+            -----BEGIN CERTIFICATE-----
+            MIIGYzCCBBKgAwIBAgIDAQAAMEYGCSqGSIb3DQEBCjA5oA8wDQYJYIZIAWUDBAIC
+            BQChHDAaBgkqhkiG9w0BAQgwDQYJYIZIAWUDBAICBQCiAwIBMKMDAgEBMHsxFDAS
+            BgNVBAsMC0VuZ2luZWVyaW5nMQswCQYDVQQGEwJVUzEUMBIGA1UEBwwLU2FudGEg
+            Q2xhcmExCzAJBgNVBAgMAkNBMR8wHQYDVQQKDBZBZHZhbmNlZCBNaWNybyBEZXZp
+            Y2VzMRIwEAYDVQQDDAlBUkstTWlsYW4wHhcNMjAxMDIyMTcyMzA1WhcNNDUxMDIy
+            MTcyMzA1WjB7MRQwEgYDVQQLDAtFbmdpbmVlcmluZzELMAkGA1UEBhMCVVMxFDAS
+            BgNVBAcMC1NhbnRhIENsYXJhMQswCQYDVQQIDAJDQTEfMB0GA1UECgwWQWR2YW5j
+            ZWQgTWljcm8gRGV2aWNlczESMBAGA1UEAwwJQVJLLU1pbGFuMIICIjANBgkqhkiG
+            9w0BAQEFAAOCAg8AMIICCgKCAgEA0Ld52RJOdeiJlqK2JdsVmD7FktuotWwX1fNg
+            W41XY9Xz1HEhSUmhLz9Cu9DHRlvgJSNxbeYYsnJfvyjx1MfU0V5tkKiU1EesNFta
+            1kTA0szNisdYc9isqk7mXT5+KfGRbfc4V/9zRIcE8jlHN61S1ju8X93+6dxDUrG2
+            SzxqJ4BhqyYmUDruPXJSX4vUc01P7j98MpqOS95rORdGHeI52Naz5m2B+O+vjsC0
+            60d37jY9LFeuOP4Meri8qgfi2S5kKqg/aF6aPtuAZQVR7u3KFYXP59XmJgtcog05
+            gmI0T/OitLhuzVvpZcLph0odh/1IPXqx3+MnjD97A7fXpqGd/y8KxX7jksTEzAOg
+            bKAeam3lm+3yKIcTYMlsRMXPcjNbIvmsBykD//xSniusuHBkgnlENEWx1UcbQQrs
+            +gVDkuVPhsnzIRNgYvM48Y+7LGiJYnrmE8xcrexekBxrva2V9TJQqnN3Q53kt5vi
+            Qi3+gCfmkwC0F0tirIZbLkXPrPwzZ0M9eNxhIySb2npJfgnqz55I0u33wh4r0ZNQ
+            eTGfw03MBUtyuzGesGkcw+loqMaq1qR4tjGbPYxCvpCq7+OgpCCoMNit2uLo9M18
+            fHz10lOMT8nWAUvRZFzteXCm+7PHdYPlmQwUw3LvenJ/ILXoQPHfbkH0CyPfhl1j
+            WhJFZasCAwEAAaN+MHwwDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBSFrBrRQ/fI
+            rFXUxR1BSKvVeErUUzAPBgNVHRMBAf8EBTADAQH/MDoGA1UdHwQzMDEwL6AtoCuG
+            KWh0dHBzOi8va2RzaW50Zi5hbWQuY29tL3ZjZWsvdjEvTWlsYW4vY3JsMEYGCSqG
+            SIb3DQEBCjA5oA8wDQYJYIZIAWUDBAICBQChHDAaBgkqhkiG9w0BAQgwDQYJYIZI
+            AWUDBAICBQCiAwIBMKMDAgEBA4ICAQC6m0kDp6zv4Ojfgy+zleehsx6ol0ocgVel
+            ETobpx+EuCsqVFRPK1jZ1sp/lyd9+0fQ0r66n7kagRk4Ca39g66WGTJMeJdqYriw
+            STjjDCKVPSesWXYPVAyDhmP5n2v+BYipZWhpvqpaiO+EGK5IBP+578QeW/sSokrK
+            dHaLAxG2LhZxj9aF73fqC7OAJZ5aPonw4RE299FVarh1Tx2eT3wSgkDgutCTB1Yq
+            zT5DuwvAe+co2CIVIzMDamYuSFjPN0BCgojl7V+bTou7dMsqIu/TW/rPCX9/EUcp
+            KGKqPQ3P+N9r1hjEFY1plBg93t53OOo49GNI+V1zvXPLI6xIFVsh+mto2RtgEX/e
+            pmMKTNN6psW88qg7c1hTWtN6MbRuQ0vm+O+/2tKBF2h8THb94OvvHHoFDpbCELlq
+            HnIYhxy0YKXGyaW1NjfULxrrmxVW4wcn5E8GddmvNa6yYm8scJagEi13mhGu4Jqh
+            3QU3sf8iUSUr09xQDwHtOQUVIqx4maBZPBtSMf+qUDtjXSSq8lfWcd8bLr9mdsUn
+            JZJ0+tuPMKmBnSH860llKk+VpVQsgqbzDIvOLvD6W1Umq25boxCYJ+TuBoa4s+HH
+            CViAvgT9kf/rBq1d+ivj6skkHxuzcxbk1xv6ZGxrteJxVH7KlX7YRdZ6eARKwLe4
+            AFZEAwoKCQ==
+            -----END CERTIFICATE-----
diff --git a/terraform-provider-constellation/examples/full/aws/constellation-state.yaml b/terraform-provider-constellation/examples/full/aws/constellation-state.yaml
@@ -0,0 +1,18 @@
+version: v1 # Schema version of this state file.
+# State of the cluster's cloud resources. These values are retrieved during
+infrastructure:
+    uid: "" # Unique identifier the cluster's cloud resources are tagged with.
+    clusterEndpoint: "" # Endpoint the cluster can be reached at. This is the endpoint that is being used by the CLI.
+    inClusterEndpoint: "" # The Cluster uses to reach itself. This might differ from the ClusterEndpoint in case e.g.,
+    # Secret used to authenticate the bootstrapping node.
+    initSecret: []
+    # List of Subject Alternative Names (SANs) to add to the Kubernetes API server certificate.
+    apiServerCertSANs: []
+    name: "" # Name used in the cluster's named resources.
+    ipCidrNode: "" # CIDR range of the cluster's nodes.
+# DO NOT EDIT. State of the Constellation Kubernetes cluster.
+clusterValues:
+    clusterID: "" # Unique identifier of the cluster.
+    ownerID: "" # Unique identifier of the owner of the cluster.
+    # Salt used to generate the ClusterID on the bootstrapping node.
+    measurementSalt: []