cli: don't require file flags

cli/constants.go

@@ -8,7 +8,9 @@ const (
 	coordRootPEMFilename   = "coordinator-root.pem"
 	coordIntermPEMFilename = "mesh-root.pem"
 	manifestFilename       = "manifest.json"
+	settingsFilename       = "settings.json"
 	rulesFilename          = "rules.rego"
+	policyDir              = "."
 	verifyDir              = "./verify"
 )
 

cli/generate.go

@@ -21,17 +21,24 @@ const kataPolicyAnnotationKey = "io.katacontainers.config.agent.policy"
 
 func newGenerateCmd() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:   "generate",
-		Short: "generate",
-		RunE:  runGenerate,
+		Use:   "generate [flags] paths...",
+		Short: "generate policies and inject into Kubernetes resources",
+		Long: `
+		Generate policies and inject into the given Kubernetes resources.
+
+		This will download the referenced container images to calculate the dm-verity
+		hashes of the image layers. In addition, the Rego policy will be used as base
+		and updated with the given settings file. For each container workload, the policy
+		is added as annotaiton in the Kubernetes YAML.
+
+		The hashes of the policies are added to the manifest.
+		`,
+		RunE: runGenerate,
 	}
 
-	cmd.Flags().StringP("policy", "p", "", "path to policy (.rego) file")
-	must(cobra.MarkFlagRequired(cmd.Flags(), "policy"))
-	cmd.Flags().StringP("settings", "s", "", "path to settings (.json) file")
-	must(cobra.MarkFlagRequired(cmd.Flags(), "settings"))
-	cmd.Flags().StringP("manifest", "m", "", "path to manifest (.json) file")
-	must(cobra.MarkFlagRequired(cmd.Flags(), "manifest"))
+	cmd.Flags().StringP("policy", "p", policyDir, "path to policy (.rego) file")
+	cmd.Flags().StringP("settings", "s", settingsFilename, "path to settings (.json) file")
+	cmd.Flags().StringP("manifest", "m", manifestFilename, "path to manifest (.json) file")
 
 	return cmd
 }

cli/set.go

@@ -20,14 +20,24 @@ import (
 
 func newSetCmd() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:   "set",
-		Short: "Set a manifest",
-		Long:  `Set a manifest.`,
-		RunE:  runSet,
+		Use:   "set [flags] paths...",
+		Short: "Set the given manifest at the coordinator",
+		Long: `
+		Set the given manifest at the coordinator.
+
+		This will connect to the given Coordinator using aTLS. During the connection
+		initialization, the remote attestation of the Coordinator CVM happens and
+		the connection will only be successful if the Coordinator conforms with the
+		reference values embedded into the CLI.
+
+		After the connection is established, the manifest is set. The Coordinator
+		will re-generate the mesh root certificate and accept new workloads to
+		issuer certificates.
+		`,
+		RunE: runSet,
 	}
 
-	cmd.Flags().StringP("manifest", "m", "", "path to manifest (.json) file")
-	must(cobra.MarkFlagRequired(cmd.Flags(), "manifest"))
+	cmd.Flags().StringP("manifest", "m", manifestFilename, "path to manifest (.json) file")
 	cmd.Flags().StringP("coordinator", "c", "", "endpoint the coordinator can be reached at")
 	must(cobra.MarkFlagRequired(cmd.Flags(), "coordinator"))
 

cli/verify.go

@@ -21,14 +21,24 @@ import (
 func newVerifyCmd() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "verify",
-		Short: "Verify a manifest",
-		Long:  `Verify a manifest.`,
-		RunE:  runVerify,
+		Short: "Verify a nunki deployment",
+		Long: `
+		Verify a nunki deployment.
+
+		This will connect to the given Coordinator using aTLS. During the connection
+		initialization, the remote attestation of the Coordinator CVM happens and
+		the connection will only be successful if the Coordinator conforms with the
+		reference values embedded into the CLI.
+
+		After the connection is established, the CLI will request the manifest histroy,
+		all policies, and the certificates of the Coordinator certifcate authority.
+	`,
+		RunE: runVerify,
 	}
 
+	cmd.Flags().StringP("output", "o", verifyDir, "directory to write files to")
 	cmd.Flags().StringP("coordinator", "c", "", "endpoint the coordinator can be reached at")
 	must(cobra.MarkFlagRequired(cmd.Flags(), "coordinator"))
-	cmd.Flags().StringP("output", "o", "./verify", "directory to write files to")
 
 	return cmd
 }

justfile

@@ -65,6 +65,7 @@ set:
         ./{{worspace_dir}}/deployment/*.yml
     kill $PID
 
+# Verify the Coordinator.
 verify:
     #!/usr/bin/env bash
     rm -rf ./{{worspace_dir}}/verify
@@ -94,12 +95,33 @@ codegen:
 fmt:
     nix fmt
 
+# Lint code.
 lint:
     nix run .#golangci-lint -- run
 
+demodir:
+    #!/usr/bin/env bash
+    d=$(mktemp -d)
+    echo "Creating demo directory at ${d}"
+    nix build .#nunki.cli
+    cp ./result-cli/bin/cli "${d}/nunki"
+    cp -R ./deployments/emojivoto "${d}/deployment"
+    nix run .#yq-go -- -i ". \
+        | with(select(.spec.template.spec.containers[].image | contains(\"nunki/coordinator\")); \
+        .spec.template.spec.containers[0].image = \"${container_registry}/nunki/coordinator:latest\")" \
+        ${d}/deployment/coordinator.yml
+    for f in ${d}/deployment/*.yml; do
+        nix run .#yq-go -- -i ". \
+            | with(select(.spec.template.spec.initContainers[].image | contains(\"nunki/initializer\")); \
+            .spec.template.spec.initContainers[0].image = \"${container_registry}/nunki/initializer:latest\")" \
+            "${f}"
+    done
+    echo "Demo directory ready at ${d}"
+
 # Cleanup auxiliary files, caches etc.
 clean:
     rm -rf ./{{worspace_dir}}
+    rm -rf ./layers_cache
 
 # Template for the justfile.env file.
 rctemplate := '''