-
Notifications
You must be signed in to change notification settings - Fork 54
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support SEV-SNP on GCP #3011
Support SEV-SNP on GCP #3011
Conversation
✅ Deploy Preview for constellation-docs canceled.
|
39a3f67
to
31edeaf
Compare
Testing the provider: Looked at the TF + config related code. Lgtm besides the open points |
terraform-provider-constellation/internal/provider/attestation_data_source_test.go
Outdated
Show resolved
Hide resolved
Won't work yet, as measurements are not yet available. |
I'm unable to review in the short term. I'll remove myself as a reviewer for now. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Code lgtm.
I understand that firmware version verification is currently missing (values are set to 0) and that it will be added as part of
https://dev.azure.com/Edgeless/Edgeless/_workitems/edit/4024
This will also be needed to support the attestation data source in the provider.
When will the OS measurements be available?
Once they are there, we should also add SNP to the weekly TF provider example matrix.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
some nits
@daniel-weisse could you take a look at the attestation again? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks mostly good to me now.
Opened a PR to address some things we talked about in person: #3025
the gcp provider is not yet supported in the |
395531e
to
52dac84
Compare
Co-authored-by: Daniel Weiße <[email protected]>
Co-authored-by: Daniel Weiße <[email protected]>
…_data_source_test.go Co-authored-by: Adrian Stobbe <[email protected]>
* Make sure SNP ARK is always loaded from config, or fetched from AMD KDS * GCP: Set validator `reportData` correctly --------- Signed-off-by: Daniel Weiße <[email protected]> Co-authored-by: Moritz Sanft <[email protected]>
Signed-off-by: Moritz Sanft <[email protected]>
d84d765
to
8fb087d
Compare
Coverage report
|
Context
GCP released a public preview for AMD SEV-SNP, which means that we can now use SEV-SNP on GCP in Constellation. This PR enables support for it on our side. It does not yet replace GCP SEV-ES as the default method for GCP on Constellation, which we can do once it's GA and prove to be stable to us in Constellation.
Proposed change(s)
InstanceInfo
within the TPMs attestation report, which is necessary for GCP to bind the TEE attestation to the TPM attestation, and should not affect security on other CSPs.Additional info
Checklist