Make SEV-SNP the default attestation variant on GCP

[thomasten]

Context

SNP on GCP is GA

Proposed change(s)

• make attestation variant gcp-sev-snp the default on GCP

Checklist

• Run the E2E tests that are relevant to this PR's changes
• Update docs
• Add labels (e.g., for changelog category)
• Is PR title adequate for changelog?
• Link to Milestone

[netlify]

✅ Deploy Preview for constellation-docs ready!

Name	Link
🔨 Latest commit	5a3105f
🔍 Latest deploy log	https://app.netlify.com/sites/constellation-docs/deploys/669e3c932e2967000821209b
😎 Deploy Preview	https://deploy-preview-3267--constellation-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[thomasten]

@msanft does this TODO need to be resolved before we can make SNP the default?

constellation/.github/workflows/on-release.yml

Lines 158 to 166 in 3f6e7f9

	- name: Fetch GCP image reference
	id: fetch-reference
	shell: bash
	run: |
	# TODO(msanft): Implement marketplace images for GCP SEV-SNP
	aws s3 cp s3://cdn-constellation-backend/constellation/v2/ref/-/stream/stable/${{ steps.fetch-version.outputs.output }}/image/info.json .
	FULL_REF=$(yq e -r -oy '.list.[] | select(.attestationVariant == "gcp-sev-es") | .reference' info.json)
	IMAGE_NAME=$(echo "${FULL_REF}" | cut -d / -f 5)
	echo "reference=$IMAGE_NAME" | tee -a "$GITHUB_OUTPUT"

[msanft]

@msanft does this TODO need to be resolved before we can make SNP the default?

constellation/.github/workflows/on-release.yml

Lines 158 to 166 in 3f6e7f9

	- name: Fetch GCP image reference
	id: fetch-reference
	shell: bash
	run: |
	# TODO(msanft): Implement marketplace images for GCP SEV-SNP
	aws s3 cp s3://cdn-constellation-backend/constellation/v2/ref/-/stream/stable/${{ steps.fetch-version.outputs.output }}/image/info.json .
	FULL_REF=$(yq e -r -oy '.list.[] | select(.attestationVariant == "gcp-sev-es") | .reference' info.json)
	IMAGE_NAME=$(echo "${FULL_REF}" | cut -d / -f 5)
	echo "reference=$IMAGE_NAME" | tee -a "$GITHUB_OUTPUT"

Need to talk to the business side to clarify this, but I think it should not be too much work altogether.

I'll have a look at this PR generally on Monday. My mind isn't fresh enough anymore today 😄

[elchead]

should we change it here too?

constellation/.github/workflows/e2e-test-release.yml

Line 407 in 74e0f44

attestationVariant: ["gcp-sev-es", "azure-sev-snp", "azure-tdx", "aws-sev-snp"]

constellation/.github/workflows/e2e-test-weekly.yml

Line 416 in 74e0f44

attestationVariant: ["gcp-sev-es", "azure-sev-snp", "azure-tdx", "aws-sev-snp"]

constellation/.github/workflows/e2e-test-weekly.yml

Line 494 in 74e0f44

attestationVariant: ["gcp-sev-es", "azure-sev-snp", "azure-tdx", "aws-sev-snp"]

is this done?

constellation/.github/workflows/on-release.yml

Line 162 in 9cd1184

# TODO(msanft): Implement marketplace images for GCP SEV-SNP

let's switch the order here:

constellation/terraform-provider-constellation/internal/provider/shared_attributes.go

Line 34 in 913b09a

" * `gcp-sev-es`\n" +

[msanft]

LGTM. Marketplace images should not be critical for this PR, we'll just have to add them until we release a version containing the SEV-SNP default.

[msanft]

Suggested change

	Regarding (3), with their SEV-SNP offering Google provides direct access to remote-attestation statements.
	Regarding (3), with their SEV-SNP offering Google provides direct access to attestation statements.

nit

[github-actions]

Coverage report

Package	Old	New	Trend
cli/internal/cmd	41.00%	41.10%	↗️
internal/attestation/variant	0.00%	0.00%	🚧
internal/config	67.00%	67.00%	↔️
terraform-provider-constellation/internal/provider	3.60%	3.60%	🚧