mirror of
https://github.com/kairos-io/kcrypt-challenger.git
synced 2025-09-26 13:04:30 +00:00
Compare commits
2 Commits
test_itxak
...
challenger
| Author | SHA1 | Date | |
|---|---|---|---|
|
7a21b879c4 | ||
|
ebe316363a |
70
.github/workflows/e2e-tests.yml
vendored
70
.github/workflows/e2e-tests.yml
vendored
@@ -1,70 +0,0 @@
|
|||||||
name: End to end tests
|
|
||||||
on:
|
|
||||||
push:
|
|
||||||
paths-ignore:
|
|
||||||
- 'README.md'
|
|
||||||
branches:
|
|
||||||
- main
|
|
||||||
pull_request:
|
|
||||||
paths-ignore:
|
|
||||||
- 'README.md'
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
e2e-tests:
|
|
||||||
runs-on: self-hosted
|
|
||||||
strategy:
|
|
||||||
fail-fast: false
|
|
||||||
matrix:
|
|
||||||
include:
|
|
||||||
- label: "local-encryption"
|
|
||||||
- label: "remote-auto"
|
|
||||||
- label: "remote-static"
|
|
||||||
- label: "remote-https-pinned"
|
|
||||||
- label: "remote-https-bad-cert"
|
|
||||||
steps:
|
|
||||||
- name: Checkout code
|
|
||||||
uses: actions/checkout@v3
|
|
||||||
with:
|
|
||||||
fetch-depth: 0
|
|
||||||
- name: Install Go
|
|
||||||
uses: actions/setup-go@v4
|
|
||||||
with:
|
|
||||||
go-version: ^1.20
|
|
||||||
- name: Run tests
|
|
||||||
env:
|
|
||||||
LABEL: ${{ matrix.label }}
|
|
||||||
KVM: true
|
|
||||||
run: |
|
|
||||||
sudo apt update && \
|
|
||||||
sudo apt install -y git qemu-system-x86 qemu-utils swtpm jq make glibc-tools \
|
|
||||||
openssl curl gettext ca-certificates curl gnupg lsb-release
|
|
||||||
|
|
||||||
curl -L https://github.com/mudler/luet/releases/download/0.33.0/luet-0.33.0-linux-amd64 -o luet
|
|
||||||
chmod +x luet
|
|
||||||
sudo mv luet /usr/bin/luet
|
|
||||||
sudo mkdir -p /etc/luet/repos.conf.d/
|
|
||||||
sudo luet repo add -y kairos --url quay.io/kairos/packages --type docker
|
|
||||||
LUET_NOLOCK=true sudo -E luet install -y container/kubectl utils/k3d utils/earthly
|
|
||||||
|
|
||||||
earthly -P +iso
|
|
||||||
export ISO=$PWD/build/challenger.iso
|
|
||||||
|
|
||||||
go install -mod=mod github.com/onsi/ginkgo/v2/ginkgo
|
|
||||||
go get github.com/onsi/gomega/...
|
|
||||||
go get github.com/onsi/ginkgo/v2/ginkgo/internal@v2.7.1
|
|
||||||
go get github.com/onsi/ginkgo/v2/ginkgo/generators@v2.7.1
|
|
||||||
go get github.com/onsi/ginkgo/v2/ginkgo/labels@v2.7.1
|
|
||||||
|
|
||||||
# Configure earthly to use the docker mirror in CI
|
|
||||||
# https://docs.earthly.dev/ci-integration/pull-through-cache#configuring-earthly-to-use-the-cache
|
|
||||||
cat << EOF > ~/.earthly/config.yml
|
|
||||||
global:
|
|
||||||
buildkit_additional_config: |
|
|
||||||
[registry."docker.io"]
|
|
||||||
mirrors = ["registry.docker-mirror.svc.cluster.local:5000"]
|
|
||||||
[registry."registry.docker-mirror.svc.cluster.local:5000"]
|
|
||||||
insecure = true
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# We run with sudo to be able to access /dev/kvm
|
|
||||||
sudo -E ./scripts/e2e-tests.sh
|
|
||||||
63
.github/workflows/image.yml
vendored
63
.github/workflows/image.yml
vendored
@@ -1,63 +0,0 @@
|
|||||||
---
|
|
||||||
name: 'build container images'
|
|
||||||
|
|
||||||
on:
|
|
||||||
push:
|
|
||||||
branches:
|
|
||||||
- main
|
|
||||||
tags:
|
|
||||||
- '*'
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
docker:
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
steps:
|
|
||||||
- name: Checkout
|
|
||||||
uses: actions/checkout@v2
|
|
||||||
|
|
||||||
- name: Prepare
|
|
||||||
id: prep
|
|
||||||
run: |
|
|
||||||
DOCKER_IMAGE=quay.io/kairos/kcrypt-challenger
|
|
||||||
VERSION=latest
|
|
||||||
SHORTREF=${GITHUB_SHA::8}
|
|
||||||
# If this is git tag, use the tag name as a docker tag
|
|
||||||
if [[ $GITHUB_REF == refs/tags/* ]]; then
|
|
||||||
VERSION=${GITHUB_REF#refs/tags/}
|
|
||||||
fi
|
|
||||||
TAGS="${DOCKER_IMAGE}:${VERSION},${DOCKER_IMAGE}:${SHORTREF}"
|
|
||||||
# If the VERSION looks like a version number, assume that
|
|
||||||
# this is the most recent version of the image and also
|
|
||||||
# tag it 'latest'.
|
|
||||||
if [[ $VERSION =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
|
|
||||||
TAGS="$TAGS,${DOCKER_IMAGE}:latest"
|
|
||||||
fi
|
|
||||||
# Set output parameters.
|
|
||||||
echo ::set-output name=tags::${TAGS}
|
|
||||||
echo ::set-output name=docker_image::${DOCKER_IMAGE}
|
|
||||||
- name: Set up QEMU
|
|
||||||
uses: docker/setup-qemu-action@master
|
|
||||||
with:
|
|
||||||
platforms: all
|
|
||||||
|
|
||||||
- name: Set up Docker Buildx
|
|
||||||
id: buildx
|
|
||||||
uses: docker/setup-buildx-action@master
|
|
||||||
|
|
||||||
- name: Login to DockerHub
|
|
||||||
if: github.event_name != 'pull_request'
|
|
||||||
uses: docker/login-action@v1
|
|
||||||
with:
|
|
||||||
registry: quay.io
|
|
||||||
username: ${{ secrets.QUAY_USERNAME }}
|
|
||||||
password: ${{ secrets.QUAY_PASSWORD }}
|
|
||||||
|
|
||||||
- name: Build
|
|
||||||
uses: docker/build-push-action@v2
|
|
||||||
with:
|
|
||||||
builder: ${{ steps.buildx.outputs.name }}
|
|
||||||
context: .
|
|
||||||
file: ./Dockerfile
|
|
||||||
platforms: linux/amd64,linux/arm64
|
|
||||||
push: true
|
|
||||||
tags: ${{ steps.prep.outputs.tags }}
|
|
||||||
30
.github/workflows/lint.yml
vendored
30
.github/workflows/lint.yml
vendored
@@ -1,30 +0,0 @@
|
|||||||
name: Lint
|
|
||||||
on:
|
|
||||||
push:
|
|
||||||
branches:
|
|
||||||
- main
|
|
||||||
pull_request:
|
|
||||||
paths:
|
|
||||||
- '**'
|
|
||||||
env:
|
|
||||||
FORCE_COLOR: 1
|
|
||||||
jobs:
|
|
||||||
lint:
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
steps:
|
|
||||||
- name: Checkout code
|
|
||||||
uses: actions/checkout@v3
|
|
||||||
with:
|
|
||||||
fetch-depth: 0
|
|
||||||
- name: Install Go
|
|
||||||
uses: actions/setup-go@v4
|
|
||||||
with:
|
|
||||||
go-version: ^1.20
|
|
||||||
- name: Install earthly
|
|
||||||
uses: Luet-lab/luet-install-action@v1
|
|
||||||
with:
|
|
||||||
repository: quay.io/kairos/packages
|
|
||||||
packages: utils/earthly
|
|
||||||
- name: Run Lint checks
|
|
||||||
run: |
|
|
||||||
earthly +lint
|
|
||||||
19
.github/workflows/unit-tests.yml
vendored
19
.github/workflows/unit-tests.yml
vendored
@@ -1,19 +0,0 @@
|
|||||||
---
|
|
||||||
name: Unit tests
|
|
||||||
on:
|
|
||||||
push:
|
|
||||||
branches:
|
|
||||||
- master
|
|
||||||
pull_request:
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
unit-tests:
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
steps:
|
|
||||||
- name: Checkout code
|
|
||||||
uses: actions/checkout@v3
|
|
||||||
with:
|
|
||||||
fetch-depth: 0
|
|
||||||
- name: Run tests
|
|
||||||
run: |
|
|
||||||
./earthly.sh +test
|
|
||||||
3
.gitignore
vendored
3
.gitignore
vendored
@@ -1,3 +1,4 @@
|
|||||||
|
|
||||||
# Binaries for programs and plugins
|
# Binaries for programs and plugins
|
||||||
*.exe
|
*.exe
|
||||||
*.exe~
|
*.exe~
|
||||||
@@ -23,4 +24,4 @@ testbin/*
|
|||||||
*.swo
|
*.swo
|
||||||
*~
|
*~
|
||||||
|
|
||||||
/helm-chart
|
/helm-chart
|
||||||
21
.yamllint
21
.yamllint
@@ -1,21 +0,0 @@
|
|||||||
extends: default
|
|
||||||
|
|
||||||
rules:
|
|
||||||
# 80 chars should be enough, but don't fail if a line is longer
|
|
||||||
line-length:
|
|
||||||
max: 150
|
|
||||||
level: warning
|
|
||||||
|
|
||||||
# accept both key:
|
|
||||||
# - item
|
|
||||||
#
|
|
||||||
# and key:
|
|
||||||
# - item
|
|
||||||
indentation:
|
|
||||||
indent-sequences: whatever
|
|
||||||
|
|
||||||
truthy:
|
|
||||||
check-keys: false
|
|
||||||
|
|
||||||
document-start:
|
|
||||||
present: false
|
|
||||||
@@ -1,5 +1,5 @@
|
|||||||
# Build the manager binary
|
# Build the manager binary
|
||||||
FROM golang:1.20 as builder
|
FROM golang:1.18 as builder
|
||||||
|
|
||||||
WORKDIR /workspace
|
WORKDIR /workspace
|
||||||
# Copy the Go Modules manifests
|
# Copy the Go Modules manifests
|
||||||
|
|||||||
123
Earthfile
123
Earthfile
@@ -1,123 +0,0 @@
|
|||||||
VERSION 0.6
|
|
||||||
ARG BASE_IMAGE=quay.io/kairos/core-ubuntu:latest
|
|
||||||
ARG OSBUILDER_IMAGE=quay.io/kairos/osbuilder-tools
|
|
||||||
# renovate: datasource=docker depName=golang
|
|
||||||
ARG GO_VERSION=1.20
|
|
||||||
ARG LUET_VERSION=0.33.0
|
|
||||||
|
|
||||||
build-challenger:
|
|
||||||
FROM golang:alpine
|
|
||||||
COPY . /work
|
|
||||||
WORKDIR /work
|
|
||||||
RUN CGO_ENABLED=0 go build -o kcrypt-discovery-challenger ./cmd/discovery
|
|
||||||
SAVE ARTIFACT /work/kcrypt-discovery-challenger AS LOCAL kcrypt-discovery-challenger
|
|
||||||
|
|
||||||
image:
|
|
||||||
FROM github.com/Itxaka/kairos:drop_kcrypt_dracut+image
|
|
||||||
ARG IMAGE
|
|
||||||
RUN cat /etc/os-release
|
|
||||||
COPY +build-challenger/kcrypt-discovery-challenger /system/discovery/kcrypt-discovery-challenger
|
|
||||||
SAVE IMAGE $IMAGE
|
|
||||||
|
|
||||||
image-rootfs:
|
|
||||||
FROM +image
|
|
||||||
SAVE ARTIFACT --keep-own /. rootfs
|
|
||||||
|
|
||||||
grub-files:
|
|
||||||
FROM alpine
|
|
||||||
RUN apk add wget
|
|
||||||
RUN wget https://raw.githubusercontent.com/c3os-io/c3os/master/overlay/files-iso/boot/grub2/grub.cfg -O grub.cfg
|
|
||||||
SAVE ARTIFACT --keep-own grub.cfg grub.cfg
|
|
||||||
|
|
||||||
iso:
|
|
||||||
ARG OSBUILDER_IMAGE
|
|
||||||
ARG ISO_NAME=challenger
|
|
||||||
FROM $OSBUILDER_IMAGE
|
|
||||||
WORKDIR /build
|
|
||||||
COPY --keep-own +grub-files/grub.cfg /build/files-iso/boot/grub2/grub.cfg
|
|
||||||
COPY --keep-own +image-rootfs/rootfs /build/rootfs
|
|
||||||
RUN /entrypoint.sh --name $ISO_NAME --debug build-iso --squash-no-compression --date=false --local --overlay-iso /build/files-iso --output /build/ dir:/build/rootfs
|
|
||||||
SAVE ARTIFACT /build/$ISO_NAME.iso kairos.iso AS LOCAL build/$ISO_NAME.iso
|
|
||||||
SAVE ARTIFACT /build/$ISO_NAME.iso.sha256 kairos.iso.sha256 AS LOCAL build/$ISO_NAME.iso.sha256
|
|
||||||
|
|
||||||
test:
|
|
||||||
ARG GO_VERSION
|
|
||||||
FROM golang:$GO_VERSION
|
|
||||||
ENV CGO_ENABLED=0
|
|
||||||
|
|
||||||
WORKDIR /work
|
|
||||||
|
|
||||||
# Cache layer for modules
|
|
||||||
COPY go.mod go.sum ./
|
|
||||||
RUN go mod download && go mod verify
|
|
||||||
|
|
||||||
RUN go get github.com/onsi/gomega/...
|
|
||||||
RUN go get github.com/onsi/ginkgo/v2/ginkgo/internal@v2.1.4
|
|
||||||
RUN go get github.com/onsi/ginkgo/v2/ginkgo/generators@v2.1.4
|
|
||||||
RUN go get github.com/onsi/ginkgo/v2/ginkgo/labels@v2.1.4
|
|
||||||
RUN go install -mod=mod github.com/onsi/ginkgo/v2/ginkgo
|
|
||||||
|
|
||||||
COPY . /work
|
|
||||||
RUN PATH=$PATH:$GOPATH/bin ginkgo run --covermode=atomic --coverprofile=coverage.out -p -r pkg/challenger cmd/discovery/client
|
|
||||||
SAVE ARTIFACT coverage.out AS LOCAL coverage.out
|
|
||||||
|
|
||||||
# Generic targets
|
|
||||||
# usage e.g. ./earthly.sh +datasource-iso --CLOUD_CONFIG=tests/assets/qrcode.yaml
|
|
||||||
datasource-iso:
|
|
||||||
ARG OSBUILDER_IMAGE
|
|
||||||
ARG CLOUD_CONFIG
|
|
||||||
FROM $OSBUILDER_IMAGE
|
|
||||||
RUN zypper in -y mkisofs
|
|
||||||
WORKDIR /build
|
|
||||||
RUN touch meta-data
|
|
||||||
|
|
||||||
COPY ${CLOUD_CONFIG} user-data
|
|
||||||
RUN cat user-data
|
|
||||||
RUN mkisofs -output ci.iso -volid cidata -joliet -rock user-data meta-data
|
|
||||||
SAVE ARTIFACT /build/ci.iso iso.iso AS LOCAL build/datasource.iso
|
|
||||||
|
|
||||||
luet:
|
|
||||||
FROM quay.io/luet/base:$LUET_VERSION
|
|
||||||
SAVE ARTIFACT /usr/bin/luet /luet
|
|
||||||
|
|
||||||
e2e-tests-image:
|
|
||||||
FROM opensuse/tumbleweed
|
|
||||||
RUN zypper in -y go git qemu-x86 qemu-arm qemu-tools swtpm docker jq docker-compose make glibc libopenssl-devel curl gettext-runtime
|
|
||||||
ENV GOPATH="/go"
|
|
||||||
|
|
||||||
COPY . /test
|
|
||||||
WORKDIR /test
|
|
||||||
|
|
||||||
RUN go install -mod=mod github.com/onsi/ginkgo/v2/ginkgo
|
|
||||||
RUN go get github.com/onsi/gomega/...
|
|
||||||
RUN go get github.com/onsi/ginkgo/v2/ginkgo/internal@v2.7.1
|
|
||||||
RUN go get github.com/onsi/ginkgo/v2/ginkgo/generators@v2.7.1
|
|
||||||
RUN go get github.com/onsi/ginkgo/v2/ginkgo/labels@v2.7.1
|
|
||||||
|
|
||||||
IF [ -e /test/build/kairos.iso ]
|
|
||||||
ENV ISO=/test/build/kairos.iso
|
|
||||||
ELSE
|
|
||||||
COPY +iso/kairos.iso kairos.iso
|
|
||||||
ENV ISO=/test/kairos.iso
|
|
||||||
END
|
|
||||||
|
|
||||||
COPY +luet/luet /usr/bin/luet
|
|
||||||
RUN mkdir -p /etc/luet/repos.conf.d/
|
|
||||||
RUN luet repo add -y kairos --url quay.io/kairos/packages --type docker
|
|
||||||
RUN LUET_NOLOCK=true luet install -y container/kubectl utils/k3d
|
|
||||||
|
|
||||||
e2e-tests:
|
|
||||||
FROM +e2e-tests-image
|
|
||||||
ARG LABEL
|
|
||||||
|
|
||||||
WITH DOCKER --allow-privileged
|
|
||||||
RUN ./scripts/e2e-tests.sh
|
|
||||||
END
|
|
||||||
|
|
||||||
lint:
|
|
||||||
BUILD +yamllint
|
|
||||||
|
|
||||||
yamllint:
|
|
||||||
FROM cytopia/yamllint
|
|
||||||
COPY . .
|
|
||||||
RUN yamllint .github/workflows/
|
|
||||||
4
Makefile
4
Makefile
@@ -103,7 +103,7 @@ vet: ## Run go vet against code.
|
|||||||
|
|
||||||
.PHONY: test
|
.PHONY: test
|
||||||
test: manifests generate fmt vet envtest ## Run tests.
|
test: manifests generate fmt vet envtest ## Run tests.
|
||||||
KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) -p path)" go test ./pkg/... -coverprofile cover.out
|
KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) -p path)" go test ./... -coverprofile cover.out
|
||||||
|
|
||||||
##@ Build
|
##@ Build
|
||||||
|
|
||||||
@@ -257,4 +257,4 @@ undeploy-dev: ## Undeploy controller from the K8s cluster specified in ~/.kube/c
|
|||||||
kubesplit: manifests kustomize
|
kubesplit: manifests kustomize
|
||||||
rm -rf helm-chart
|
rm -rf helm-chart
|
||||||
mkdir helm-chart
|
mkdir helm-chart
|
||||||
$(KUSTOMIZE) build config/default | kubesplit -helm helm-chart
|
$(KUSTOMIZE) build config/default | kubesplit -helm helm-chart
|
||||||
172
README.md
172
README.md
@@ -1,92 +1,94 @@
|
|||||||
<h1 align="center">
|
# kcrypt-controller
|
||||||
<br>
|
// TODO(user): Add simple overview of use/purpose
|
||||||
<img width="184" alt="kairos-white-column 5bc2fe34" src="https://user-images.githubusercontent.com/2420543/193010398-72d4ba6e-7efe-4c2e-b7ba-d3a826a55b7d.png"><br>
|
|
||||||
Kcrypt challenger
|
|
||||||
<br>
|
|
||||||
</h1>
|
|
||||||
|
|
||||||
<h3 align="center">Kcrypt TPM challenger</h3>
|
## Description
|
||||||
<p align="center">
|
// TODO(user): An in-depth paragraph about your project and overview of use
|
||||||
<a href="https://opensource.org/licenses/">
|
|
||||||
<img src="https://img.shields.io/badge/licence-APL2-brightgreen"
|
|
||||||
alt="license">
|
|
||||||
</a>
|
|
||||||
<a href="https://github.com/kairos-io/kcrypt-challenger/issues"><img src="https://img.shields.io/github/issues/kairos-io/kcrypt-challenger"></a>
|
|
||||||
<a href="https://kairos.io/docs/" target=_blank> <img src="https://img.shields.io/badge/Documentation-blue"
|
|
||||||
alt="docs"></a>
|
|
||||||
<img src="https://img.shields.io/badge/made%20with-Go-blue">
|
|
||||||
<img src="https://goreportcard.com/badge/github.com/kairos-io/kcrypt-challenger" alt="go report card" />
|
|
||||||
<a href="https://github.com/kairos-io/kcrypt-challenger/actions/workflows/e2e-tests.yml?query=branch%3Amain"> <img src="https://github.com/kairos-io/kcrypt-challenger/actions/workflows/e2e-tests.yml/badge.svg?branch=main"></a>
|
|
||||||
</p>
|
|
||||||
|
|
||||||
|
## Getting Started
|
||||||
|
You’ll need a Kubernetes cluster to run against. You can use [KIND](https://sigs.k8s.io/kind) to get a local cluster for testing, or run against a remote cluster.
|
||||||
|
**Note:** Your controller will automatically use the current context in your kubeconfig file (i.e. whatever cluster `kubectl cluster-info` shows).
|
||||||
|
|
||||||
With Kairos you can build immutable, bootable Kubernetes and OS images for your edge devices as easily as writing a Dockerfile. Optional P2P mesh with distributed ledger automates node bootstrapping and coordination. Updating nodes is as easy as CI/CD: push a new image to your container registry and let secure, risk-free A/B atomic upgrades do the rest.
|
### Running on the cluster
|
||||||
|
1. Install Instances of Custom Resources:
|
||||||
|
|
||||||
<table>
|
|
||||||
<tr>
|
|
||||||
<th align="center">
|
|
||||||
<img width="640" height="1px">
|
|
||||||
<p>
|
|
||||||
<small>
|
|
||||||
Documentation
|
|
||||||
</small>
|
|
||||||
</p>
|
|
||||||
</th>
|
|
||||||
<th align="center">
|
|
||||||
<img width="640" height="1">
|
|
||||||
<p>
|
|
||||||
<small>
|
|
||||||
Contribute
|
|
||||||
</small>
|
|
||||||
</p>
|
|
||||||
</th>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>
|
|
||||||
|
|
||||||
📚 [Getting started with Kairos](https://kairos.io/docs/getting-started) <br> :bulb: [Examples](https://kairos.io/docs/examples) <br> :movie_camera: [Video](https://kairos.io/docs/media/) <br> :open_hands:[Engage with the Community](https://kairos.io/community/)
|
|
||||||
|
|
||||||
</td>
|
|
||||||
<td>
|
|
||||||
|
|
||||||
🙌[ CONTRIBUTING.md ]( https://github.com/kairos-io/kairos/blob/master/CONTRIBUTING.md ) <br> :raising_hand: [ GOVERNANCE ]( https://github.com/kairos-io/kairos/blob/master/GOVERNANCE.md ) <br>:construction_worker:[Code of conduct](https://github.com/kairos-io/kairos/blob/master/CODE_OF_CONDUCT.md)
|
|
||||||
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
| :exclamation: | This is experimental! |
|
|
||||||
|-|:-|
|
|
||||||
|
|
||||||
This is the Kairos kcrypt-challenger Kubernetes Native Extension.
|
|
||||||
|
|
||||||
## Usage
|
|
||||||
|
|
||||||
See the documentation in our website: https://kairos.io/docs/advanced/partition_encryption/.
|
|
||||||
|
|
||||||
## Installation
|
|
||||||
|
|
||||||
To install, use helm:
|
|
||||||
|
|
||||||
|
```sh
|
||||||
|
kubectl apply -f config/samples/
|
||||||
```
|
```
|
||||||
# Adds the kairos repo to helm
|
|
||||||
$ helm repo add kairos https://kairos-io.github.io/helm-charts
|
|
||||||
"kairos" has been added to your repositories
|
|
||||||
$ helm repo update
|
|
||||||
Hang tight while we grab the latest from your chart repositories...
|
|
||||||
...Successfully got an update from the "kairos" chart repository
|
|
||||||
Update Complete. ⎈Happy Helming!⎈
|
|
||||||
|
|
||||||
# Install the CRD chart
|
2. Build and push your image to the location specified by `IMG`:
|
||||||
$ helm install kairos-crd kairos/kairos-crds
|
|
||||||
NAME: kairos-crd
|
```sh
|
||||||
LAST DEPLOYED: Tue Sep 6 20:35:34 2022
|
make docker-build docker-push IMG=<some-registry>/kcrypt-controller:tag
|
||||||
NAMESPACE: default
|
|
||||||
STATUS: deployed
|
|
||||||
REVISION: 1
|
|
||||||
TEST SUITE: None
|
|
||||||
|
|
||||||
# Installs challenger
|
|
||||||
$ helm install kairos-challenger kairos/kcrypt-challenger
|
|
||||||
```
|
```
|
||||||
|
|
||||||
|
3. Deploy the controller to the cluster with the image specified by `IMG`:
|
||||||
|
|
||||||
|
```sh
|
||||||
|
make deploy IMG=<some-registry>/kcrypt-controller:tag
|
||||||
|
```
|
||||||
|
|
||||||
|
### Uninstall CRDs
|
||||||
|
To delete the CRDs from the cluster:
|
||||||
|
|
||||||
|
```sh
|
||||||
|
make uninstall
|
||||||
|
```
|
||||||
|
|
||||||
|
### Undeploy controller
|
||||||
|
UnDeploy the controller to the cluster:
|
||||||
|
|
||||||
|
```sh
|
||||||
|
make undeploy
|
||||||
|
```
|
||||||
|
|
||||||
|
## Contributing
|
||||||
|
// TODO(user): Add detailed information on how you would like others to contribute to this project
|
||||||
|
|
||||||
|
### How it works
|
||||||
|
This project aims to follow the Kubernetes [Operator pattern](https://kubernetes.io/docs/concepts/extend-kubernetes/operator/)
|
||||||
|
|
||||||
|
It uses [Controllers](https://kubernetes.io/docs/concepts/architecture/controller/)
|
||||||
|
which provides a reconcile function responsible for synchronizing resources untile the desired state is reached on the cluster
|
||||||
|
|
||||||
|
### Test It Out
|
||||||
|
1. Install the CRDs into the cluster:
|
||||||
|
|
||||||
|
```sh
|
||||||
|
make install
|
||||||
|
```
|
||||||
|
|
||||||
|
2. Run your controller (this will run in the foreground, so switch to a new terminal if you want to leave it running):
|
||||||
|
|
||||||
|
```sh
|
||||||
|
make run
|
||||||
|
```
|
||||||
|
|
||||||
|
**NOTE:** You can also run this in one step by running: `make install run`
|
||||||
|
|
||||||
|
### Modifying the API definitions
|
||||||
|
If you are editing the API definitions, generate the manifests such as CRs or CRDs using:
|
||||||
|
|
||||||
|
```sh
|
||||||
|
make manifests
|
||||||
|
```
|
||||||
|
|
||||||
|
**NOTE:** Run `make --help` for more information on all potential `make` targets
|
||||||
|
|
||||||
|
More information can be found via the [Kubebuilder Documentation](https://book.kubebuilder.io/introduction.html)
|
||||||
|
|
||||||
|
## License
|
||||||
|
|
||||||
|
Copyright 2022.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
|
||||||
|
|||||||
@@ -25,19 +25,10 @@ import (
|
|||||||
|
|
||||||
// SealedVolumeSpec defines the desired state of SealedVolume
|
// SealedVolumeSpec defines the desired state of SealedVolume
|
||||||
type SealedVolumeSpec struct {
|
type SealedVolumeSpec struct {
|
||||||
TPMHash string `json:"TPMHash,omitempty"`
|
TPMHash string `json:"TPMHash,omitempty"`
|
||||||
Partitions []PartitionSpec `json:"partitions,omitempty"`
|
Label string `json:"label,omitempty"`
|
||||||
Quarantined bool `json:"quarantined,omitempty"`
|
Passphrase *SecretSpec `json:"passphraseRef,omitempty"`
|
||||||
}
|
Quarantined bool `json:"quarantined,omitempty"`
|
||||||
|
|
||||||
// PartitionSpec defines a Partition. A partition can be identified using
|
|
||||||
// any of the fields: Label, DeviceName, UUID. The Secret defines the secret
|
|
||||||
// which decrypts the partition.
|
|
||||||
type PartitionSpec struct {
|
|
||||||
Label string `json:"label,omitempty"`
|
|
||||||
DeviceName string `json:"deviceName,omitempty"`
|
|
||||||
UUID string `json:"uuid,omitempty"`
|
|
||||||
Secret *SecretSpec `json:"secret,omitempty"`
|
|
||||||
}
|
}
|
||||||
|
|
||||||
type SecretSpec struct {
|
type SecretSpec struct {
|
||||||
|
|||||||
@@ -25,26 +25,6 @@ import (
|
|||||||
runtime "k8s.io/apimachinery/pkg/runtime"
|
runtime "k8s.io/apimachinery/pkg/runtime"
|
||||||
)
|
)
|
||||||
|
|
||||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
||||||
func (in *PartitionSpec) DeepCopyInto(out *PartitionSpec) {
|
|
||||||
*out = *in
|
|
||||||
if in.Secret != nil {
|
|
||||||
in, out := &in.Secret, &out.Secret
|
|
||||||
*out = new(SecretSpec)
|
|
||||||
**out = **in
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PartitionSpec.
|
|
||||||
func (in *PartitionSpec) DeepCopy() *PartitionSpec {
|
|
||||||
if in == nil {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
out := new(PartitionSpec)
|
|
||||||
in.DeepCopyInto(out)
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
func (in *SealedVolume) DeepCopyInto(out *SealedVolume) {
|
func (in *SealedVolume) DeepCopyInto(out *SealedVolume) {
|
||||||
*out = *in
|
*out = *in
|
||||||
@@ -107,12 +87,10 @@ func (in *SealedVolumeList) DeepCopyObject() runtime.Object {
|
|||||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
func (in *SealedVolumeSpec) DeepCopyInto(out *SealedVolumeSpec) {
|
func (in *SealedVolumeSpec) DeepCopyInto(out *SealedVolumeSpec) {
|
||||||
*out = *in
|
*out = *in
|
||||||
if in.Partitions != nil {
|
if in.Passphrase != nil {
|
||||||
in, out := &in.Partitions, &out.Partitions
|
in, out := &in.Passphrase, &out.Passphrase
|
||||||
*out = make([]PartitionSpec, len(*in))
|
*out = new(SecretSpec)
|
||||||
for i := range *in {
|
**out = **in
|
||||||
(*in)[i].DeepCopyInto(&(*out)[i])
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -1,147 +0,0 @@
|
|||||||
package client
|
|
||||||
|
|
||||||
import (
|
|
||||||
"encoding/base64"
|
|
||||||
"encoding/json"
|
|
||||||
"fmt"
|
|
||||||
"os"
|
|
||||||
"time"
|
|
||||||
|
|
||||||
"github.com/jaypipes/ghw/pkg/block"
|
|
||||||
"github.com/kairos-io/kairos-challenger/pkg/constants"
|
|
||||||
"github.com/kairos-io/kairos-challenger/pkg/payload"
|
|
||||||
"github.com/kairos-io/kcrypt/pkg/bus"
|
|
||||||
"github.com/kairos-io/tpm-helpers"
|
|
||||||
"github.com/mudler/go-pluggable"
|
|
||||||
"github.com/mudler/yip/pkg/utils"
|
|
||||||
)
|
|
||||||
|
|
||||||
var errPartNotFound error = fmt.Errorf("pass for partition not found")
|
|
||||||
var errBadCertificate error = fmt.Errorf("unknown certificate")
|
|
||||||
|
|
||||||
func NewClient() (*Client, error) {
|
|
||||||
conf, err := unmarshalConfig()
|
|
||||||
if err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
|
|
||||||
return &Client{Config: conf}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// ❯ echo '{ "data": "{ \\"label\\": \\"LABEL\\" }"}' | sudo -E WSS_SERVER="http://localhost:8082/challenge" ./challenger "discovery.password"
|
|
||||||
func (c *Client) Start() error {
|
|
||||||
factory := pluggable.NewPluginFactory()
|
|
||||||
|
|
||||||
// Input: bus.EventInstallPayload
|
|
||||||
// Expected output: map[string]string{}
|
|
||||||
factory.Add(bus.EventDiscoveryPassword, func(e *pluggable.Event) pluggable.EventResponse {
|
|
||||||
|
|
||||||
b := &block.Partition{}
|
|
||||||
err := json.Unmarshal([]byte(e.Data), b)
|
|
||||||
if err != nil {
|
|
||||||
return pluggable.EventResponse{
|
|
||||||
Error: fmt.Sprintf("failed reading partitions: %s", err.Error()),
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
pass, err := c.waitPass(b, 30)
|
|
||||||
if err != nil {
|
|
||||||
return pluggable.EventResponse{
|
|
||||||
Error: fmt.Sprintf("failed getting pass: %s", err.Error()),
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
return pluggable.EventResponse{
|
|
||||||
Data: pass,
|
|
||||||
}
|
|
||||||
})
|
|
||||||
|
|
||||||
return factory.Run(pluggable.EventType(os.Args[1]), os.Stdin, os.Stdout)
|
|
||||||
}
|
|
||||||
|
|
||||||
func (c *Client) generatePass(postEndpoint string, p *block.Partition) error {
|
|
||||||
|
|
||||||
rand := utils.RandomString(32)
|
|
||||||
pass, err := tpm.EncryptBlob([]byte(rand))
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
bpass := base64.RawURLEncoding.EncodeToString(pass)
|
|
||||||
|
|
||||||
opts := []tpm.Option{
|
|
||||||
tpm.WithCAs([]byte(c.Config.Kcrypt.Challenger.Certificate)),
|
|
||||||
tpm.AppendCustomCAToSystemCA,
|
|
||||||
tpm.WithAdditionalHeader("label", p.Label),
|
|
||||||
tpm.WithAdditionalHeader("name", p.Name),
|
|
||||||
tpm.WithAdditionalHeader("uuid", p.UUID),
|
|
||||||
}
|
|
||||||
conn, err := tpm.Connection(postEndpoint, opts...)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
return conn.WriteJSON(payload.Data{Passphrase: bpass, GeneratedBy: constants.TPMSecret})
|
|
||||||
}
|
|
||||||
|
|
||||||
func (c *Client) waitPass(p *block.Partition, attempts int) (pass string, err error) {
|
|
||||||
// IF we don't have any server configured, just do local
|
|
||||||
if c.Config.Kcrypt.Challenger.Server == "" {
|
|
||||||
return localPass(c.Config)
|
|
||||||
}
|
|
||||||
|
|
||||||
challengeEndpoint := fmt.Sprintf("%s/getPass", c.Config.Kcrypt.Challenger.Server)
|
|
||||||
postEndpoint := fmt.Sprintf("%s/postPass", c.Config.Kcrypt.Challenger.Server)
|
|
||||||
|
|
||||||
for tries := 0; tries < attempts; tries++ {
|
|
||||||
var generated bool
|
|
||||||
pass, generated, err = getPass(challengeEndpoint, c.Config.Kcrypt.Challenger.Certificate, p)
|
|
||||||
if err == errPartNotFound {
|
|
||||||
// IF server doesn't have a pass for us, then we generate one and we set it
|
|
||||||
err = c.generatePass(postEndpoint, p)
|
|
||||||
if err != nil {
|
|
||||||
return
|
|
||||||
}
|
|
||||||
// Attempt to fetch again - validate that the server has it now
|
|
||||||
tries = 0
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
|
|
||||||
if generated { // passphrase is encrypted
|
|
||||||
return c.decryptPassphrase(pass)
|
|
||||||
}
|
|
||||||
|
|
||||||
if err == errBadCertificate { // No need to retry, won't succeed.
|
|
||||||
return
|
|
||||||
}
|
|
||||||
|
|
||||||
if err == nil { // passphrase available, no errors
|
|
||||||
return
|
|
||||||
}
|
|
||||||
|
|
||||||
fmt.Printf("Failed with error: %s . Will retry.\n", err.Error())
|
|
||||||
time.Sleep(1 * time.Second) // network errors? retry
|
|
||||||
}
|
|
||||||
|
|
||||||
return
|
|
||||||
}
|
|
||||||
|
|
||||||
// decryptPassphrase decodes (base64) and decrypts the passphrase returned
|
|
||||||
// by the challenger server.
|
|
||||||
func (c *Client) decryptPassphrase(pass string) (string, error) {
|
|
||||||
blob, err := base64.RawURLEncoding.DecodeString(pass)
|
|
||||||
if err != nil {
|
|
||||||
return "", err
|
|
||||||
}
|
|
||||||
|
|
||||||
// Decrypt and return it to unseal the LUKS volume
|
|
||||||
opts := []tpm.TPMOption{}
|
|
||||||
if c.Config.Kcrypt.Challenger.CIndex != "" {
|
|
||||||
opts = append(opts, tpm.WithIndex(c.Config.Kcrypt.Challenger.CIndex))
|
|
||||||
}
|
|
||||||
if c.Config.Kcrypt.Challenger.TPMDevice != "" {
|
|
||||||
opts = append(opts, tpm.WithDevice(c.Config.Kcrypt.Challenger.TPMDevice))
|
|
||||||
}
|
|
||||||
passBytes, err := tpm.DecryptBlob(blob, opts...)
|
|
||||||
|
|
||||||
return string(passBytes), err
|
|
||||||
}
|
|
||||||
@@ -1,39 +0,0 @@
|
|||||||
package client
|
|
||||||
|
|
||||||
import (
|
|
||||||
"github.com/kairos-io/kairos/pkg/config"
|
|
||||||
kconfig "github.com/kairos-io/kcrypt/pkg/config"
|
|
||||||
)
|
|
||||||
|
|
||||||
type Client struct {
|
|
||||||
Config Config
|
|
||||||
}
|
|
||||||
|
|
||||||
type Config struct {
|
|
||||||
Kcrypt struct {
|
|
||||||
Challenger struct {
|
|
||||||
Server string `yaml:"challenger_server,omitempty"`
|
|
||||||
// Non-volatile index memory: where we store the encrypted passphrase (offline mode)
|
|
||||||
NVIndex string `yaml:"nv_index,omitempty"`
|
|
||||||
// Certificate index: this is where the rsa pair that decrypts the passphrase lives
|
|
||||||
CIndex string `yaml:"c_index,omitempty"`
|
|
||||||
TPMDevice string `yaml:"tpm_device,omitempty"`
|
|
||||||
Certificate string `yaml:"certificate,omitempty"`
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func unmarshalConfig() (Config, error) {
|
|
||||||
var result Config
|
|
||||||
|
|
||||||
c, err := config.Scan(config.Directories(kconfig.ConfigScanDirs...), config.NoLogs)
|
|
||||||
if err != nil {
|
|
||||||
return result, err
|
|
||||||
}
|
|
||||||
|
|
||||||
if err = c.Unmarshal(&result); err != nil {
|
|
||||||
return result, err
|
|
||||||
}
|
|
||||||
|
|
||||||
return result, nil
|
|
||||||
}
|
|
||||||
@@ -1,98 +0,0 @@
|
|||||||
package client
|
|
||||||
|
|
||||||
import (
|
|
||||||
"encoding/json"
|
|
||||||
"fmt"
|
|
||||||
"strings"
|
|
||||||
|
|
||||||
"github.com/kairos-io/kairos-challenger/pkg/constants"
|
|
||||||
"github.com/kairos-io/kairos-challenger/pkg/payload"
|
|
||||||
|
|
||||||
"github.com/jaypipes/ghw/pkg/block"
|
|
||||||
"github.com/kairos-io/tpm-helpers"
|
|
||||||
"github.com/mudler/yip/pkg/utils"
|
|
||||||
"github.com/pkg/errors"
|
|
||||||
)
|
|
||||||
|
|
||||||
const DefaultNVIndex = "0x1500000"
|
|
||||||
|
|
||||||
func getPass(server, certificate string, partition *block.Partition) (string, bool, error) {
|
|
||||||
msg, err := tpm.Get(server,
|
|
||||||
tpm.WithCAs([]byte(certificate)),
|
|
||||||
tpm.AppendCustomCAToSystemCA,
|
|
||||||
tpm.WithAdditionalHeader("label", partition.Label),
|
|
||||||
tpm.WithAdditionalHeader("name", partition.Name),
|
|
||||||
tpm.WithAdditionalHeader("uuid", partition.UUID))
|
|
||||||
if err != nil {
|
|
||||||
return "", false, err
|
|
||||||
}
|
|
||||||
result := payload.Data{}
|
|
||||||
err = json.Unmarshal(msg, &result)
|
|
||||||
if err != nil {
|
|
||||||
return "", false, errors.Wrap(err, string(msg))
|
|
||||||
}
|
|
||||||
|
|
||||||
if result.HasPassphrase() {
|
|
||||||
return fmt.Sprint(result.Passphrase), result.HasBeenGenerated() && result.GeneratedBy == constants.TPMSecret, nil
|
|
||||||
} else if result.HasError() {
|
|
||||||
if strings.Contains(result.Error, "No secret found for") {
|
|
||||||
return "", false, errPartNotFound
|
|
||||||
}
|
|
||||||
if strings.Contains(result.Error, "x509: certificate signed by unknown authority") {
|
|
||||||
return "", false, errBadCertificate
|
|
||||||
}
|
|
||||||
return "", false, fmt.Errorf(result.Error)
|
|
||||||
}
|
|
||||||
|
|
||||||
return "", false, errPartNotFound
|
|
||||||
}
|
|
||||||
|
|
||||||
func genAndStore(k Config) (string, error) {
|
|
||||||
opts := []tpm.TPMOption{}
|
|
||||||
if k.Kcrypt.Challenger.TPMDevice != "" {
|
|
||||||
opts = append(opts, tpm.WithDevice(k.Kcrypt.Challenger.TPMDevice))
|
|
||||||
}
|
|
||||||
if k.Kcrypt.Challenger.CIndex != "" {
|
|
||||||
opts = append(opts, tpm.WithIndex(k.Kcrypt.Challenger.CIndex))
|
|
||||||
}
|
|
||||||
|
|
||||||
// Generate a new one, and return it to luks
|
|
||||||
rand := utils.RandomString(32)
|
|
||||||
blob, err := tpm.EncryptBlob([]byte(rand))
|
|
||||||
if err != nil {
|
|
||||||
return "", err
|
|
||||||
}
|
|
||||||
nvindex := DefaultNVIndex
|
|
||||||
if k.Kcrypt.Challenger.NVIndex != "" {
|
|
||||||
nvindex = k.Kcrypt.Challenger.NVIndex
|
|
||||||
}
|
|
||||||
opts = append(opts, tpm.WithIndex(nvindex))
|
|
||||||
return rand, tpm.StoreBlob(blob, opts...)
|
|
||||||
}
|
|
||||||
|
|
||||||
func localPass(k Config) (string, error) {
|
|
||||||
index := DefaultNVIndex
|
|
||||||
if k.Kcrypt.Challenger.NVIndex != "" {
|
|
||||||
index = k.Kcrypt.Challenger.NVIndex
|
|
||||||
}
|
|
||||||
opts := []tpm.TPMOption{tpm.WithIndex(index)}
|
|
||||||
if k.Kcrypt.Challenger.TPMDevice != "" {
|
|
||||||
opts = append(opts, tpm.WithDevice(k.Kcrypt.Challenger.TPMDevice))
|
|
||||||
}
|
|
||||||
encodedPass, err := tpm.ReadBlob(opts...)
|
|
||||||
if err != nil {
|
|
||||||
// Generate if we fail to read from the assigned blob
|
|
||||||
return genAndStore(k)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Decode and give it back
|
|
||||||
opts = []tpm.TPMOption{}
|
|
||||||
if k.Kcrypt.Challenger.CIndex != "" {
|
|
||||||
opts = append(opts, tpm.WithIndex(k.Kcrypt.Challenger.CIndex))
|
|
||||||
}
|
|
||||||
if k.Kcrypt.Challenger.TPMDevice != "" {
|
|
||||||
opts = append(opts, tpm.WithDevice(k.Kcrypt.Challenger.TPMDevice))
|
|
||||||
}
|
|
||||||
pass, err := tpm.DecryptBlob(encodedPass, opts...)
|
|
||||||
return string(pass), err
|
|
||||||
}
|
|
||||||
@@ -1,24 +1,25 @@
|
|||||||
package main
|
package main
|
||||||
|
|
||||||
import (
|
import (
|
||||||
|
"encoding/json"
|
||||||
"fmt"
|
"fmt"
|
||||||
"os"
|
"os"
|
||||||
|
|
||||||
"github.com/kairos-io/kairos-challenger/cmd/discovery/client"
|
"github.com/jaypipes/ghw/pkg/block"
|
||||||
|
"github.com/kairos-io/go-tpm"
|
||||||
|
"github.com/kairos-io/kairos/pkg/machine"
|
||||||
"github.com/kairos-io/kcrypt/pkg/bus"
|
"github.com/kairos-io/kcrypt/pkg/bus"
|
||||||
"github.com/kairos-io/tpm-helpers"
|
"gopkg.in/yaml.v3"
|
||||||
|
|
||||||
|
"github.com/mudler/go-pluggable"
|
||||||
)
|
)
|
||||||
|
|
||||||
func main() {
|
func main() {
|
||||||
if len(os.Args) >= 2 && bus.IsEventDefined(os.Args[1]) {
|
if len(os.Args) >= 2 && bus.IsEventDefined(os.Args[1]) {
|
||||||
c, err := client.NewClient()
|
checkErr(start())
|
||||||
checkErr(err)
|
|
||||||
checkErr(c.Start())
|
|
||||||
return
|
|
||||||
}
|
}
|
||||||
|
|
||||||
pubhash, err := tpm.GetPubHash()
|
pubhash, _ := tpm.GetPubHash()
|
||||||
checkErr(err)
|
|
||||||
fmt.Print(pubhash)
|
fmt.Print(pubhash)
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -27,4 +28,62 @@ func checkErr(err error) {
|
|||||||
fmt.Println(err)
|
fmt.Println(err)
|
||||||
os.Exit(1)
|
os.Exit(1)
|
||||||
}
|
}
|
||||||
|
os.Exit(0)
|
||||||
|
}
|
||||||
|
|
||||||
|
// ❯ echo '{ "data": "{ \\"label\\": \\"LABEL\\" }"}' | sudo -E WSS_SERVER="http://localhost:8082/challenge" ./challenger "discovery.password"
|
||||||
|
func start() error {
|
||||||
|
factory := pluggable.NewPluginFactory()
|
||||||
|
|
||||||
|
connectionDetails := &struct {
|
||||||
|
Server string
|
||||||
|
}{}
|
||||||
|
|
||||||
|
var server string
|
||||||
|
d, err := machine.DotToYAML("/proc/cmdline")
|
||||||
|
if err == nil { // best-effort
|
||||||
|
yaml.Unmarshal(d, connectionDetails) //nolint:errcheck
|
||||||
|
}
|
||||||
|
server = connectionDetails.Server
|
||||||
|
if os.Getenv("WSS_SERVER") != "" {
|
||||||
|
server = os.Getenv("WSS_SERVER")
|
||||||
|
}
|
||||||
|
|
||||||
|
// Input: bus.EventInstallPayload
|
||||||
|
// Expected output: map[string]string{}
|
||||||
|
factory.Add(bus.EventDiscoveryPassword, func(e *pluggable.Event) pluggable.EventResponse {
|
||||||
|
b := &block.Partition{}
|
||||||
|
err := json.Unmarshal([]byte(e.Data), b)
|
||||||
|
if err != nil {
|
||||||
|
return pluggable.EventResponse{
|
||||||
|
Error: fmt.Sprintf("failed reading partitions: %s", err.Error()),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
msg, err := tpm.Get(server, tpm.WithAdditionalHeader("label", b.Label))
|
||||||
|
if err != nil {
|
||||||
|
return pluggable.EventResponse{
|
||||||
|
Error: fmt.Sprintf("failed contacting from wss server: %s", err.Error()),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
result := map[string]interface{}{}
|
||||||
|
err = json.Unmarshal(msg, &result)
|
||||||
|
if err != nil {
|
||||||
|
return pluggable.EventResponse{
|
||||||
|
Error: fmt.Sprintf("failed reading from wss server: %s", err.Error()),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
p, ok := result["passphrase"]
|
||||||
|
if !ok {
|
||||||
|
return pluggable.EventResponse{
|
||||||
|
Error: "not found",
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return pluggable.EventResponse{
|
||||||
|
Data: fmt.Sprint(p),
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
return factory.Run(pluggable.EventType(os.Args[1]), os.Stdin, os.Stdout)
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -37,27 +37,15 @@ spec:
|
|||||||
properties:
|
properties:
|
||||||
TPMHash:
|
TPMHash:
|
||||||
type: string
|
type: string
|
||||||
partitions:
|
label:
|
||||||
items:
|
type: string
|
||||||
description: 'PartitionSpec defines a Partition. A partition can
|
passphraseRef:
|
||||||
be identified using any of the fields: Label, DeviceName, UUID.
|
properties:
|
||||||
The Secret defines the secret which decrypts the partition.'
|
name:
|
||||||
properties:
|
type: string
|
||||||
deviceName:
|
path:
|
||||||
type: string
|
type: string
|
||||||
label:
|
type: object
|
||||||
type: string
|
|
||||||
secret:
|
|
||||||
properties:
|
|
||||||
name:
|
|
||||||
type: string
|
|
||||||
path:
|
|
||||||
type: string
|
|
||||||
type: object
|
|
||||||
uuid:
|
|
||||||
type: string
|
|
||||||
type: object
|
|
||||||
type: array
|
|
||||||
quarantined:
|
quarantined:
|
||||||
type: boolean
|
type: boolean
|
||||||
type: object
|
type: object
|
||||||
|
|||||||
@@ -82,4 +82,4 @@ spec:
|
|||||||
- name: wss
|
- name: wss
|
||||||
port: 8082
|
port: 8082
|
||||||
protocol: TCP
|
protocol: TCP
|
||||||
targetPort: wss
|
targetPort: wss
|
||||||
@@ -1,3 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
docker run --privileged -v /var/run/docker.sock:/var/run/docker.sock --rm -t -v $(pwd):/workspace -v earthly-tmp:/tmp/earthly:rw earthly/earthly:v0.6.21 --allow-privileged $@
|
|
||||||
@@ -15,8 +15,8 @@ metadata:
|
|||||||
namespace: default
|
namespace: default
|
||||||
spec:
|
spec:
|
||||||
TPMHash: "something"
|
TPMHash: "something"
|
||||||
partitionSecrets:
|
label: "label"
|
||||||
LABEL:
|
passphraseRef:
|
||||||
name: mysecret
|
name: mysecret
|
||||||
path: pass
|
path: pass
|
||||||
quarantined: false
|
quarantined: false
|
||||||
|
|||||||
111
go.mod
111
go.mod
@@ -1,32 +1,23 @@
|
|||||||
module github.com/kairos-io/kairos-challenger
|
module github.com/kairos-io/kairos-challenger
|
||||||
|
|
||||||
go 1.20
|
go 1.18
|
||||||
|
|
||||||
require (
|
require (
|
||||||
github.com/google/uuid v1.3.0
|
|
||||||
github.com/gorilla/websocket v1.5.0
|
github.com/gorilla/websocket v1.5.0
|
||||||
github.com/jaypipes/ghw v0.9.0
|
github.com/jaypipes/ghw v0.9.0
|
||||||
github.com/kairos-io/kairos v1.24.3-56.0.20230208235509-4d28f3b87f60
|
github.com/kairos-io/go-tpm v0.0.0-20221007215323-700d855876c5
|
||||||
github.com/kairos-io/kcrypt v0.5.0
|
github.com/kairos-io/kairos v1.1.2
|
||||||
github.com/kairos-io/tpm-helpers v0.0.0-20230119140150-3fa97128ef6b
|
github.com/kairos-io/kcrypt v0.0.0-20221006145351-cabc24dc37a7
|
||||||
github.com/mudler/go-pluggable v0.0.0-20230126220627-7710299a0ae5
|
github.com/mudler/go-pluggable v0.0.0-20220716112424-189d463e3ff3
|
||||||
github.com/mudler/go-processmanager v0.0.0-20220724164624-c45b5c61312d
|
|
||||||
github.com/mudler/yip v1.0.0
|
|
||||||
github.com/onsi/ginkgo v1.16.5
|
github.com/onsi/ginkgo v1.16.5
|
||||||
github.com/onsi/ginkgo/v2 v2.8.1
|
github.com/onsi/gomega v1.20.0
|
||||||
github.com/onsi/gomega v1.26.0
|
|
||||||
github.com/pkg/errors v0.9.1
|
|
||||||
github.com/spectrocloud/peg v0.0.0-20230214140930-4d6672f825b2
|
|
||||||
gopkg.in/yaml.v3 v3.0.1
|
gopkg.in/yaml.v3 v3.0.1
|
||||||
k8s.io/api v0.24.2
|
|
||||||
k8s.io/apimachinery v0.24.2
|
k8s.io/apimachinery v0.24.2
|
||||||
k8s.io/client-go v0.24.2
|
k8s.io/client-go v0.24.2
|
||||||
sigs.k8s.io/controller-runtime v0.12.2
|
sigs.k8s.io/controller-runtime v0.12.2
|
||||||
)
|
)
|
||||||
|
|
||||||
require (
|
require (
|
||||||
atomicgo.dev/cursor v0.1.1 // indirect
|
|
||||||
atomicgo.dev/keyboard v0.2.9 // indirect
|
|
||||||
cloud.google.com/go v0.93.3 // indirect
|
cloud.google.com/go v0.93.3 // indirect
|
||||||
github.com/Azure/go-autorest v14.2.0+incompatible // indirect
|
github.com/Azure/go-autorest v14.2.0+incompatible // indirect
|
||||||
github.com/Azure/go-autorest/autorest v0.11.18 // indirect
|
github.com/Azure/go-autorest/autorest v0.11.18 // indirect
|
||||||
@@ -34,30 +25,22 @@ require (
|
|||||||
github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
|
github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
|
||||||
github.com/Azure/go-autorest/logger v0.2.1 // indirect
|
github.com/Azure/go-autorest/logger v0.2.1 // indirect
|
||||||
github.com/Azure/go-autorest/tracing v0.6.0 // indirect
|
github.com/Azure/go-autorest/tracing v0.6.0 // indirect
|
||||||
github.com/Masterminds/goutils v1.1.1 // indirect
|
|
||||||
github.com/Masterminds/semver/v3 v3.1.1 // indirect
|
|
||||||
github.com/Masterminds/sprig/v3 v3.2.2 // indirect
|
|
||||||
github.com/PuerkitoBio/purell v1.1.1 // indirect
|
github.com/PuerkitoBio/purell v1.1.1 // indirect
|
||||||
github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect
|
github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect
|
||||||
github.com/StackExchange/wmi v1.2.1 // indirect
|
github.com/StackExchange/wmi v1.2.1 // indirect
|
||||||
github.com/avast/retry-go v3.0.0+incompatible // indirect
|
github.com/atomicgo/cursor v0.0.1 // indirect
|
||||||
github.com/aybabtme/rgbterm v0.0.0-20170906152045-cc83f3b3ce59 // indirect
|
github.com/aybabtme/rgbterm v0.0.0-20170906152045-cc83f3b3ce59 // indirect
|
||||||
github.com/beorn7/perks v1.0.1 // indirect
|
github.com/beorn7/perks v1.0.1 // indirect
|
||||||
github.com/bramvdbogaerde/go-scp v1.2.1 // indirect
|
|
||||||
github.com/cavaliergopher/grab/v3 v3.0.1 // indirect
|
|
||||||
github.com/cespare/xxhash/v2 v2.1.2 // indirect
|
github.com/cespare/xxhash/v2 v2.1.2 // indirect
|
||||||
github.com/chuckpreslar/emission v0.0.0-20170206194824-a7ddd980baf9 // indirect
|
github.com/chuckpreslar/emission v0.0.0-20170206194824-a7ddd980baf9 // indirect
|
||||||
github.com/codingsince1985/checksum v1.2.6 // indirect
|
|
||||||
github.com/containerd/console v1.0.3 // indirect
|
|
||||||
github.com/davecgh/go-spew v1.1.1 // indirect
|
github.com/davecgh/go-spew v1.1.1 // indirect
|
||||||
github.com/denisbrodbeck/machineid v1.0.1 // indirect
|
github.com/denisbrodbeck/machineid v1.0.1 // indirect
|
||||||
github.com/emicklei/go-restful v2.9.5+incompatible // indirect
|
github.com/emicklei/go-restful v2.9.5+incompatible // indirect
|
||||||
github.com/evanphx/json-patch v4.12.0+incompatible // indirect
|
github.com/evanphx/json-patch v4.12.0+incompatible // indirect
|
||||||
github.com/folbricht/tpmk v0.1.2-0.20230104073416-f20b20c289d7 // indirect
|
github.com/form3tech-oss/jwt-go v3.2.3+incompatible // indirect
|
||||||
github.com/form3tech-oss/jwt-go v3.2.5+incompatible // indirect
|
|
||||||
github.com/fsnotify/fsnotify v1.5.4 // indirect
|
github.com/fsnotify/fsnotify v1.5.4 // indirect
|
||||||
github.com/ghodss/yaml v1.0.0 // indirect
|
github.com/ghodss/yaml v1.0.0 // indirect
|
||||||
github.com/go-logr/logr v1.2.3 // indirect
|
github.com/go-logr/logr v1.2.0 // indirect
|
||||||
github.com/go-logr/zapr v1.2.0 // indirect
|
github.com/go-logr/zapr v1.2.0 // indirect
|
||||||
github.com/go-ole/go-ole v1.2.6 // indirect
|
github.com/go-ole/go-ole v1.2.6 // indirect
|
||||||
github.com/go-openapi/jsonpointer v0.19.5 // indirect
|
github.com/go-openapi/jsonpointer v0.19.5 // indirect
|
||||||
@@ -66,76 +49,68 @@ require (
|
|||||||
github.com/gogo/protobuf v1.3.2 // indirect
|
github.com/gogo/protobuf v1.3.2 // indirect
|
||||||
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
|
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
|
||||||
github.com/golang/protobuf v1.5.2 // indirect
|
github.com/golang/protobuf v1.5.2 // indirect
|
||||||
github.com/google/certificate-transparency-go v1.1.4 // indirect
|
github.com/google/certificate-transparency-go v1.1.2 // indirect
|
||||||
github.com/google/gnostic v0.5.7-v3refs // indirect
|
github.com/google/gnostic v0.5.7-v3refs // indirect
|
||||||
github.com/google/go-attestation v0.4.4-0.20220404204839-8820d49b18d9 // indirect
|
github.com/google/go-attestation v0.4.3 // indirect
|
||||||
github.com/google/go-cmp v0.5.9 // indirect
|
github.com/google/go-cmp v0.5.8 // indirect
|
||||||
github.com/google/go-tpm v0.3.3 // indirect
|
github.com/google/go-tpm v0.3.3 // indirect
|
||||||
github.com/google/go-tpm-tools v0.3.10 // indirect
|
github.com/google/go-tpm-tools v0.3.2 // indirect
|
||||||
github.com/google/go-tspi v0.3.0 // indirect
|
github.com/google/go-tspi v0.2.1-0.20190423175329-115dea689aad // indirect
|
||||||
github.com/google/gofuzz v1.1.0 // indirect
|
github.com/google/gofuzz v1.1.0 // indirect
|
||||||
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
|
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
|
||||||
github.com/gookit/color v1.5.2 // indirect
|
github.com/google/uuid v1.1.2 // indirect
|
||||||
|
github.com/gookit/color v1.5.0 // indirect
|
||||||
github.com/hashicorp/errwrap v1.1.0 // indirect
|
github.com/hashicorp/errwrap v1.1.0 // indirect
|
||||||
github.com/hashicorp/go-multierror v1.1.1 // indirect
|
github.com/hashicorp/go-multierror v1.1.1 // indirect
|
||||||
github.com/huandu/xstrings v1.3.2 // indirect
|
github.com/imdario/mergo v0.3.12 // indirect
|
||||||
github.com/imdario/mergo v0.3.13 // indirect
|
github.com/itchyny/gojq v0.12.8 // indirect
|
||||||
github.com/ipfs/go-log v1.0.5 // indirect
|
github.com/itchyny/timefmt-go v0.1.3 // indirect
|
||||||
github.com/ipfs/go-log/v2 v2.5.1 // indirect
|
github.com/joho/godotenv v1.4.0 // indirect
|
||||||
github.com/itchyny/gojq v0.12.11 // indirect
|
|
||||||
github.com/itchyny/timefmt-go v0.1.5 // indirect
|
|
||||||
github.com/joho/godotenv v1.5.1 // indirect
|
|
||||||
github.com/josharian/intern v1.0.0 // indirect
|
github.com/josharian/intern v1.0.0 // indirect
|
||||||
github.com/json-iterator/go v1.1.12 // indirect
|
github.com/json-iterator/go v1.1.12 // indirect
|
||||||
github.com/lithammer/fuzzysearch v1.1.5 // indirect
|
|
||||||
github.com/mailru/easyjson v0.7.6 // indirect
|
github.com/mailru/easyjson v0.7.6 // indirect
|
||||||
github.com/mattn/go-isatty v0.0.17 // indirect
|
github.com/mattn/go-isatty v0.0.14 // indirect
|
||||||
github.com/mattn/go-runewidth v0.0.14 // indirect
|
github.com/mattn/go-runewidth v0.0.13 // indirect
|
||||||
github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
|
github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
|
||||||
github.com/mitchellh/copystructure v1.2.0 // indirect
|
|
||||||
github.com/mitchellh/reflectwalk v1.0.2 // indirect
|
|
||||||
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
||||||
github.com/modern-go/reflect2 v1.0.2 // indirect
|
github.com/modern-go/reflect2 v1.0.2 // indirect
|
||||||
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
||||||
github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646 // indirect
|
github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646 // indirect
|
||||||
github.com/nxadm/tail v1.4.8 // indirect
|
github.com/nxadm/tail v1.4.8 // indirect
|
||||||
github.com/opentracing/opentracing-go v1.2.0 // indirect
|
github.com/pkg/errors v0.9.1 // indirect
|
||||||
github.com/phayes/freeport v0.0.0-20220201140144-74d24b5ae9f5 // indirect
|
github.com/prometheus/client_golang v1.12.1 // indirect
|
||||||
github.com/prometheus/client_golang v1.13.0 // indirect
|
|
||||||
github.com/prometheus/client_model v0.2.0 // indirect
|
github.com/prometheus/client_model v0.2.0 // indirect
|
||||||
github.com/prometheus/common v0.37.0 // indirect
|
github.com/prometheus/common v0.32.1 // indirect
|
||||||
github.com/prometheus/procfs v0.8.0 // indirect
|
github.com/prometheus/procfs v0.7.3 // indirect
|
||||||
github.com/pterm/pterm v0.12.54 // indirect
|
github.com/pterm/pterm v0.12.41 // indirect
|
||||||
github.com/qeesung/image2ascii v1.0.1 // indirect
|
github.com/qeesung/image2ascii v1.0.1 // indirect
|
||||||
github.com/rivo/uniseg v0.4.3 // indirect
|
github.com/rivo/uniseg v0.2.0 // indirect
|
||||||
github.com/shopspring/decimal v1.3.1 // indirect
|
github.com/sirupsen/logrus v1.8.1 // indirect
|
||||||
github.com/spf13/cast v1.5.0 // indirect
|
|
||||||
github.com/spf13/pflag v1.0.5 // indirect
|
github.com/spf13/pflag v1.0.5 // indirect
|
||||||
github.com/stretchr/testify v1.8.1 // indirect
|
|
||||||
github.com/twpayne/go-vfs v1.7.2 // indirect
|
|
||||||
github.com/wayneashleyberry/terminal-dimensions v1.1.0 // indirect
|
github.com/wayneashleyberry/terminal-dimensions v1.1.0 // indirect
|
||||||
github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
|
github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778 // indirect
|
||||||
go.uber.org/atomic v1.10.0 // indirect
|
go.uber.org/atomic v1.9.0 // indirect
|
||||||
go.uber.org/multierr v1.9.0 // indirect
|
go.uber.org/multierr v1.8.0 // indirect
|
||||||
go.uber.org/zap v1.24.0 // indirect
|
go.uber.org/zap v1.21.0 // indirect
|
||||||
golang.org/x/crypto v0.6.0 // indirect
|
golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa // indirect
|
||||||
golang.org/x/net v0.6.0 // indirect
|
golang.org/x/net v0.0.0-20220630215102-69896b714898 // indirect
|
||||||
golang.org/x/oauth2 v0.4.0 // indirect
|
golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b // indirect
|
||||||
golang.org/x/sys v0.5.0 // indirect
|
golang.org/x/sys v0.0.0-20220803195053-6e608f9ce704 // indirect
|
||||||
golang.org/x/term v0.5.0 // indirect
|
golang.org/x/term v0.0.0-20220526004731-065cf7ba2467 // indirect
|
||||||
golang.org/x/text v0.7.0 // indirect
|
golang.org/x/text v0.3.7 // indirect
|
||||||
golang.org/x/time v0.0.0-20220411224347-583f2d630306 // indirect
|
golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect
|
||||||
gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect
|
gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect
|
||||||
google.golang.org/appengine v1.6.7 // indirect
|
google.golang.org/appengine v1.6.7 // indirect
|
||||||
google.golang.org/protobuf v1.28.1 // indirect
|
google.golang.org/protobuf v1.28.0 // indirect
|
||||||
gopkg.in/inf.v0 v0.9.1 // indirect
|
gopkg.in/inf.v0 v0.9.1 // indirect
|
||||||
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
|
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
|
||||||
gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0 // indirect
|
gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0 // indirect
|
||||||
gopkg.in/yaml.v2 v2.4.0 // indirect
|
gopkg.in/yaml.v2 v2.4.0 // indirect
|
||||||
howett.net/plist v1.0.0 // indirect
|
howett.net/plist v1.0.0 // indirect
|
||||||
|
k8s.io/api v0.24.2 // indirect
|
||||||
k8s.io/apiextensions-apiserver v0.24.2 // indirect
|
k8s.io/apiextensions-apiserver v0.24.2 // indirect
|
||||||
k8s.io/component-base v0.24.2 // indirect
|
k8s.io/component-base v0.24.2 // indirect
|
||||||
k8s.io/klog/v2 v2.80.1 // indirect
|
k8s.io/klog/v2 v2.60.1 // indirect
|
||||||
k8s.io/kube-openapi v0.0.0-20220328201542-3ee0da9b0b42 // indirect
|
k8s.io/kube-openapi v0.0.0-20220328201542-3ee0da9b0b42 // indirect
|
||||||
k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9 // indirect
|
k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9 // indirect
|
||||||
sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2 // indirect
|
sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2 // indirect
|
||||||
|
|||||||
@@ -4,68 +4,26 @@ import (
|
|||||||
"context"
|
"context"
|
||||||
"encoding/json"
|
"encoding/json"
|
||||||
"fmt"
|
"fmt"
|
||||||
"io"
|
|
||||||
"io/ioutil"
|
"io/ioutil"
|
||||||
"net/http"
|
"net/http"
|
||||||
"strings"
|
|
||||||
"time"
|
"time"
|
||||||
|
|
||||||
keyserverv1alpha1 "github.com/kairos-io/kairos-challenger/api/v1alpha1"
|
keyserverv1alpha1 "github.com/kairos-io/kairos-challenger/api/v1alpha1"
|
||||||
"github.com/kairos-io/kairos-challenger/pkg/constants"
|
|
||||||
"github.com/kairos-io/kairos-challenger/pkg/payload"
|
|
||||||
"sigs.k8s.io/controller-runtime/pkg/client"
|
"sigs.k8s.io/controller-runtime/pkg/client"
|
||||||
|
|
||||||
|
tpm "github.com/kairos-io/go-tpm"
|
||||||
"github.com/kairos-io/kairos-challenger/controllers"
|
"github.com/kairos-io/kairos-challenger/controllers"
|
||||||
tpm "github.com/kairos-io/tpm-helpers"
|
|
||||||
corev1 "k8s.io/api/core/v1"
|
|
||||||
apierrors "k8s.io/apimachinery/pkg/api/errors"
|
|
||||||
v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||||
"k8s.io/client-go/kubernetes"
|
"k8s.io/client-go/kubernetes"
|
||||||
|
|
||||||
"github.com/gorilla/websocket"
|
"github.com/gorilla/websocket"
|
||||||
)
|
)
|
||||||
|
|
||||||
// PassphraseRequestData is a struct that holds all the information needed in
|
|
||||||
// order to lookup a passphrase for a specific tpm hash.
|
|
||||||
type PassphraseRequestData struct {
|
|
||||||
TPMHash string
|
|
||||||
Label string
|
|
||||||
DeviceName string
|
|
||||||
UUID string
|
|
||||||
}
|
|
||||||
|
|
||||||
type SealedVolumeData struct {
|
|
||||||
Quarantined bool
|
|
||||||
SecretName string
|
|
||||||
SecretPath string
|
|
||||||
|
|
||||||
PartitionLabel string
|
|
||||||
VolumeName string
|
|
||||||
}
|
|
||||||
|
|
||||||
var upgrader = websocket.Upgrader{
|
var upgrader = websocket.Upgrader{
|
||||||
ReadBufferSize: 1024,
|
ReadBufferSize: 1024,
|
||||||
WriteBufferSize: 1024,
|
WriteBufferSize: 1024,
|
||||||
}
|
}
|
||||||
|
|
||||||
func cleanKubeName(s string) (d string) {
|
|
||||||
d = strings.ReplaceAll(s, "_", "-")
|
|
||||||
d = strings.ToLower(d)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
|
|
||||||
func (s SealedVolumeData) DefaultSecret() (string, string) {
|
|
||||||
secretName := fmt.Sprintf("%s-%s", s.VolumeName, s.PartitionLabel)
|
|
||||||
secretPath := "passphrase"
|
|
||||||
if s.SecretName != "" {
|
|
||||||
secretName = s.SecretName
|
|
||||||
}
|
|
||||||
if s.SecretPath != "" {
|
|
||||||
secretPath = s.SecretPath
|
|
||||||
}
|
|
||||||
return cleanKubeName(secretName), cleanKubeName(secretPath)
|
|
||||||
}
|
|
||||||
|
|
||||||
func writeRead(conn *websocket.Conn, input []byte) ([]byte, error) {
|
func writeRead(conn *websocket.Conn, input []byte) ([]byte, error) {
|
||||||
writer, err := conn.NextWriter(websocket.BinaryMessage)
|
writer, err := conn.NextWriter(websocket.BinaryMessage)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
@@ -88,15 +46,6 @@ func writeRead(conn *websocket.Conn, input []byte) ([]byte, error) {
|
|||||||
return ioutil.ReadAll(reader)
|
return ioutil.ReadAll(reader)
|
||||||
}
|
}
|
||||||
|
|
||||||
func getPubHash(token string) (string, error) {
|
|
||||||
ek, _, err := tpm.GetAttestationData(token)
|
|
||||||
if err != nil {
|
|
||||||
return "", err
|
|
||||||
}
|
|
||||||
|
|
||||||
return tpm.DecodePubHash(ek)
|
|
||||||
}
|
|
||||||
|
|
||||||
func Start(ctx context.Context, kclient *kubernetes.Clientset, reconciler *controllers.SealedVolumeReconciler, namespace, address string) {
|
func Start(ctx context.Context, kclient *kubernetes.Clientset, reconciler *controllers.SealedVolumeReconciler, namespace, address string) {
|
||||||
fmt.Println("Challenger started at", address)
|
fmt.Println("Challenger started at", address)
|
||||||
s := http.Server{
|
s := http.Server{
|
||||||
@@ -107,106 +56,11 @@ func Start(ctx context.Context, kclient *kubernetes.Clientset, reconciler *contr
|
|||||||
|
|
||||||
m := http.NewServeMux()
|
m := http.NewServeMux()
|
||||||
|
|
||||||
errorMessage := func(writer io.WriteCloser, errMsg string) {
|
m.HandleFunc("/challenge", func(w http.ResponseWriter, r *http.Request) {
|
||||||
err := json.NewEncoder(writer).Encode(payload.Data{Error: errMsg})
|
|
||||||
if err != nil {
|
|
||||||
fmt.Println("error encoding the response to json", err.Error())
|
|
||||||
}
|
|
||||||
fmt.Println(errMsg)
|
|
||||||
}
|
|
||||||
|
|
||||||
m.HandleFunc("/postPass", func(w http.ResponseWriter, r *http.Request) {
|
|
||||||
conn, _ := upgrader.Upgrade(w, r, nil) // error ignored for sake of simplicity
|
|
||||||
for {
|
|
||||||
|
|
||||||
fmt.Println("Receiving passphrase")
|
|
||||||
if err := tpm.AuthRequest(r, conn); err != nil {
|
|
||||||
fmt.Println("error", err.Error())
|
|
||||||
return
|
|
||||||
}
|
|
||||||
defer conn.Close()
|
|
||||||
fmt.Println("[Receiving passphrase] auth succeeded")
|
|
||||||
|
|
||||||
token := r.Header.Get("Authorization")
|
|
||||||
|
|
||||||
hashEncoded, err := getPubHash(token)
|
|
||||||
if err != nil {
|
|
||||||
fmt.Println("error decoding pubhash", err.Error())
|
|
||||||
return
|
|
||||||
}
|
|
||||||
fmt.Println("[Receiving passphrase] pubhash", hashEncoded)
|
|
||||||
|
|
||||||
label := r.Header.Get("label")
|
|
||||||
name := r.Header.Get("name")
|
|
||||||
uuid := r.Header.Get("uuid")
|
|
||||||
v := &payload.Data{}
|
|
||||||
|
|
||||||
volumeList := &keyserverv1alpha1.SealedVolumeList{}
|
|
||||||
if err := reconciler.List(ctx, volumeList, &client.ListOptions{Namespace: namespace}); err != nil {
|
|
||||||
fmt.Println("Failed listing volumes")
|
|
||||||
fmt.Println(err)
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
|
|
||||||
sealedVolumeData := findVolumeFor(PassphraseRequestData{
|
|
||||||
TPMHash: hashEncoded,
|
|
||||||
Label: label,
|
|
||||||
DeviceName: name,
|
|
||||||
UUID: uuid,
|
|
||||||
}, volumeList)
|
|
||||||
|
|
||||||
if sealedVolumeData == nil {
|
|
||||||
fmt.Println("No TPM Hash found for", hashEncoded)
|
|
||||||
conn.Close()
|
|
||||||
return
|
|
||||||
}
|
|
||||||
|
|
||||||
if err := conn.ReadJSON(v); err != nil {
|
|
||||||
fmt.Println("error", err.Error())
|
|
||||||
return
|
|
||||||
}
|
|
||||||
|
|
||||||
if v.HasPassphrase() && !v.HasError() {
|
|
||||||
secretName, secretPath := sealedVolumeData.DefaultSecret()
|
|
||||||
_, err := kclient.CoreV1().Secrets(namespace).Get(ctx, secretName, v1.GetOptions{})
|
|
||||||
if err != nil {
|
|
||||||
if !apierrors.IsNotFound(err) {
|
|
||||||
fmt.Printf("Failed getting secret: %s\n", err.Error())
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
|
|
||||||
secret := corev1.Secret{
|
|
||||||
TypeMeta: v1.TypeMeta{
|
|
||||||
Kind: "Secret",
|
|
||||||
APIVersion: "apps/v1",
|
|
||||||
},
|
|
||||||
ObjectMeta: v1.ObjectMeta{
|
|
||||||
Name: secretName,
|
|
||||||
Namespace: namespace,
|
|
||||||
},
|
|
||||||
StringData: map[string]string{
|
|
||||||
secretPath: v.Passphrase,
|
|
||||||
constants.GeneratedByKey: v.GeneratedBy,
|
|
||||||
},
|
|
||||||
Type: "Opaque",
|
|
||||||
}
|
|
||||||
_, err := kclient.CoreV1().Secrets(namespace).Create(ctx, &secret, v1.CreateOptions{})
|
|
||||||
if err != nil {
|
|
||||||
fmt.Println("failed during secret creation:", err.Error())
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
fmt.Println("Posted for already existing secret - ignoring")
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
fmt.Println("Invalid answer from client: doesn't contain any passphrase")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
})
|
|
||||||
|
|
||||||
m.HandleFunc("/getPass", func(w http.ResponseWriter, r *http.Request) {
|
|
||||||
conn, _ := upgrader.Upgrade(w, r, nil) // error ignored for sake of simplicity
|
conn, _ := upgrader.Upgrade(w, r, nil) // error ignored for sake of simplicity
|
||||||
|
|
||||||
for {
|
for {
|
||||||
|
|
||||||
fmt.Println("Received connection")
|
fmt.Println("Received connection")
|
||||||
volumeList := &keyserverv1alpha1.SealedVolumeList{}
|
volumeList := &keyserverv1alpha1.SealedVolumeList{}
|
||||||
if err := reconciler.List(ctx, volumeList, &client.ListOptions{Namespace: namespace}); err != nil {
|
if err := reconciler.List(ctx, volumeList, &client.ListOptions{Namespace: namespace}); err != nil {
|
||||||
@@ -217,72 +71,62 @@ func Start(ctx context.Context, kclient *kubernetes.Clientset, reconciler *contr
|
|||||||
|
|
||||||
token := r.Header.Get("Authorization")
|
token := r.Header.Get("Authorization")
|
||||||
label := r.Header.Get("label")
|
label := r.Header.Get("label")
|
||||||
name := r.Header.Get("name")
|
ek, at, err := tpm.GetAttestationData(token)
|
||||||
uuid := r.Header.Get("uuid")
|
if err != nil {
|
||||||
|
fmt.Println("Failed getting tpm token")
|
||||||
|
|
||||||
if err := tpm.AuthRequest(r, conn); err != nil {
|
fmt.Println("error", err.Error())
|
||||||
fmt.Println("error validating challenge", err.Error())
|
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
|
|
||||||
hashEncoded, err := getPubHash(token)
|
hashEncoded, err := tpm.DecodePubHash(ek)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
fmt.Println("error decoding pubhash", err.Error())
|
fmt.Println("error decoding pubhash", err.Error())
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
|
|
||||||
sealedVolumeData := findVolumeFor(PassphraseRequestData{
|
found := false
|
||||||
TPMHash: hashEncoded,
|
var volume keyserverv1alpha1.SealedVolume
|
||||||
Label: label,
|
for _, v := range volumeList.Items {
|
||||||
DeviceName: name,
|
if hashEncoded == v.Spec.TPMHash && v.Spec.Label == label {
|
||||||
UUID: uuid,
|
found = true
|
||||||
}, volumeList)
|
volume = v
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
if sealedVolumeData == nil {
|
if !found {
|
||||||
writer, _ := conn.NextWriter(websocket.BinaryMessage)
|
fmt.Println("No TPM Hash found for", hashEncoded)
|
||||||
errorMessage(writer, fmt.Sprintf("Invalid hash: %s", hashEncoded))
|
|
||||||
conn.Close()
|
conn.Close()
|
||||||
|
// conn.Close()
|
||||||
|
// return
|
||||||
|
continue //will iterate until a TPM is available
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
secret, challenge, err := tpm.GenerateChallenge(ek, at)
|
||||||
|
if err != nil {
|
||||||
|
fmt.Println("error", err.Error())
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
resp, _ := writeRead(conn, challenge)
|
||||||
|
|
||||||
|
if err := tpm.ValidateChallenge(secret, resp); err != nil {
|
||||||
|
fmt.Println("error validating challenge", err.Error(), string(resp))
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
|
|
||||||
writer, _ := conn.NextWriter(websocket.BinaryMessage)
|
writer, _ := conn.NextWriter(websocket.BinaryMessage)
|
||||||
if !sealedVolumeData.Quarantined {
|
|
||||||
secretName, secretPath := sealedVolumeData.DefaultSecret()
|
|
||||||
|
|
||||||
// 1. The admin sets a specific cleartext password from Kube manager
|
if !volume.Spec.Quarantined {
|
||||||
// SealedVolume -> with a secret .
|
secret, err := kclient.CoreV1().Secrets(namespace).Get(ctx, volume.Spec.Passphrase.Name, v1.GetOptions{})
|
||||||
// 2. The admin just adds a SealedVolume associated with a TPM Hash ( you don't provide any passphrase )
|
|
||||||
// 3. There is no challenger server at all (offline mode)
|
|
||||||
//
|
|
||||||
secret, err := kclient.CoreV1().Secrets(namespace).Get(ctx, secretName, v1.GetOptions{})
|
|
||||||
if err == nil {
|
if err == nil {
|
||||||
passphrase := secret.Data[secretPath]
|
passphrase := secret.Data[volume.Spec.Passphrase.Path]
|
||||||
generatedBy := secret.Data[constants.GeneratedByKey]
|
json.NewEncoder(writer).Encode(map[string]string{"passphrase": string(passphrase)})
|
||||||
|
|
||||||
p := payload.Data{Passphrase: string(passphrase), GeneratedBy: string(generatedBy)}
|
|
||||||
err = json.NewEncoder(writer).Encode(p)
|
|
||||||
if err != nil {
|
|
||||||
fmt.Println("error encoding the passphrase to json", err.Error(), string(passphrase))
|
|
||||||
}
|
|
||||||
if err = writer.Close(); err != nil {
|
|
||||||
fmt.Println("error closing the writer", err.Error())
|
|
||||||
return
|
|
||||||
}
|
|
||||||
if err = conn.Close(); err != nil {
|
|
||||||
fmt.Println("error closing the connection", err.Error())
|
|
||||||
return
|
|
||||||
}
|
|
||||||
|
|
||||||
return
|
|
||||||
} else {
|
|
||||||
errorMessage(writer, fmt.Sprintf("No secret found for %s and %s", hashEncoded, sealedVolumeData.PartitionLabel))
|
|
||||||
}
|
}
|
||||||
} else {
|
} else {
|
||||||
errorMessage(writer, fmt.Sprintf("quarantined: %s", sealedVolumeData.PartitionLabel))
|
conn.Close()
|
||||||
if err = conn.Close(); err != nil {
|
|
||||||
fmt.Println("error closing the connection", err.Error())
|
|
||||||
return
|
|
||||||
}
|
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@@ -293,7 +137,7 @@ func Start(ctx context.Context, kclient *kubernetes.Clientset, reconciler *contr
|
|||||||
|
|
||||||
go func() {
|
go func() {
|
||||||
err := s.ListenAndServe()
|
err := s.ListenAndServe()
|
||||||
if err != nil && err != http.ErrServerClosed {
|
if err != nil {
|
||||||
panic(err)
|
panic(err)
|
||||||
}
|
}
|
||||||
}()
|
}()
|
||||||
@@ -303,34 +147,3 @@ func Start(ctx context.Context, kclient *kubernetes.Clientset, reconciler *contr
|
|||||||
s.Shutdown(ctx)
|
s.Shutdown(ctx)
|
||||||
}()
|
}()
|
||||||
}
|
}
|
||||||
|
|
||||||
func findVolumeFor(requestData PassphraseRequestData, volumeList *keyserverv1alpha1.SealedVolumeList) *SealedVolumeData {
|
|
||||||
for _, v := range volumeList.Items {
|
|
||||||
if requestData.TPMHash == v.Spec.TPMHash {
|
|
||||||
for _, p := range v.Spec.Partitions {
|
|
||||||
deviceNameMatches := requestData.DeviceName != "" && p.DeviceName == requestData.DeviceName
|
|
||||||
uuidMatches := requestData.UUID != "" && p.UUID == requestData.UUID
|
|
||||||
labelMatches := requestData.Label != "" && p.Label == requestData.Label
|
|
||||||
secretName := ""
|
|
||||||
if p.Secret != nil && p.Secret.Name != "" {
|
|
||||||
secretName = p.Secret.Name
|
|
||||||
}
|
|
||||||
secretPath := ""
|
|
||||||
if p.Secret != nil && p.Secret.Path != "" {
|
|
||||||
secretPath = p.Secret.Path
|
|
||||||
}
|
|
||||||
if labelMatches || uuidMatches || deviceNameMatches {
|
|
||||||
return &SealedVolumeData{
|
|
||||||
Quarantined: v.Spec.Quarantined,
|
|
||||||
SecretName: secretName,
|
|
||||||
SecretPath: secretPath,
|
|
||||||
VolumeName: v.Name,
|
|
||||||
PartitionLabel: p.Label,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|||||||
@@ -1,153 +0,0 @@
|
|||||||
// [✓] Setup a cluster
|
|
||||||
// [✓] install crds on it
|
|
||||||
// - run the server locally
|
|
||||||
// - make requests to the server to see if we can get passphrases back
|
|
||||||
package challenger
|
|
||||||
|
|
||||||
import (
|
|
||||||
keyserverv1alpha1 "github.com/kairos-io/kairos-challenger/api/v1alpha1"
|
|
||||||
. "github.com/onsi/ginkgo/v2"
|
|
||||||
. "github.com/onsi/gomega"
|
|
||||||
)
|
|
||||||
|
|
||||||
var _ = Describe("challenger", func() {
|
|
||||||
Describe("findSecretFor", func() {
|
|
||||||
var requestData PassphraseRequestData
|
|
||||||
var volumeList *keyserverv1alpha1.SealedVolumeList
|
|
||||||
|
|
||||||
BeforeEach(func() {
|
|
||||||
requestData = PassphraseRequestData{
|
|
||||||
TPMHash: "1234",
|
|
||||||
DeviceName: "/dev/sda1",
|
|
||||||
UUID: "sda1_uuid",
|
|
||||||
Label: "COS_PERSISTENT",
|
|
||||||
}
|
|
||||||
})
|
|
||||||
|
|
||||||
When("a sealedvolume matching the label exists", func() {
|
|
||||||
BeforeEach(func() {
|
|
||||||
volumeList = volumeListWithPartitionSpec(
|
|
||||||
keyserverv1alpha1.PartitionSpec{
|
|
||||||
Label: requestData.Label,
|
|
||||||
DeviceName: "not_matching",
|
|
||||||
UUID: "not_matching",
|
|
||||||
Secret: &keyserverv1alpha1.SecretSpec{
|
|
||||||
Name: "the_secret",
|
|
||||||
Path: "the_path",
|
|
||||||
}})
|
|
||||||
})
|
|
||||||
|
|
||||||
It("returns the sealed volume data", func() {
|
|
||||||
volumeData := findVolumeFor(requestData, volumeList)
|
|
||||||
Expect(volumeData).ToNot(BeNil())
|
|
||||||
Expect(volumeData.Quarantined).To(BeFalse())
|
|
||||||
Expect(volumeData.SecretName).To(Equal("the_secret"))
|
|
||||||
Expect(volumeData.SecretPath).To(Equal("the_path"))
|
|
||||||
})
|
|
||||||
})
|
|
||||||
|
|
||||||
When("a sealedvolume with empty field exists", func() {
|
|
||||||
BeforeEach(func() {
|
|
||||||
volumeList = volumeListWithPartitionSpec(
|
|
||||||
keyserverv1alpha1.PartitionSpec{
|
|
||||||
Label: "",
|
|
||||||
DeviceName: "not_matching",
|
|
||||||
UUID: "not_matching",
|
|
||||||
Secret: &keyserverv1alpha1.SecretSpec{
|
|
||||||
Name: "the_secret",
|
|
||||||
Path: "the_path",
|
|
||||||
}})
|
|
||||||
|
|
||||||
requestData = PassphraseRequestData{
|
|
||||||
TPMHash: "1234",
|
|
||||||
Label: "",
|
|
||||||
DeviceName: "/dev/sda1",
|
|
||||||
UUID: "sda1_uuid",
|
|
||||||
}
|
|
||||||
})
|
|
||||||
|
|
||||||
It("doesn't match a request with an empty field", func() {
|
|
||||||
volumeData := findVolumeFor(requestData, volumeList)
|
|
||||||
Expect(volumeData).To(BeNil())
|
|
||||||
})
|
|
||||||
})
|
|
||||||
|
|
||||||
When("a sealedvolume matching the device name exists", func() {
|
|
||||||
BeforeEach(func() {
|
|
||||||
volumeList = volumeListWithPartitionSpec(
|
|
||||||
keyserverv1alpha1.PartitionSpec{
|
|
||||||
Label: "not_matching",
|
|
||||||
DeviceName: requestData.DeviceName,
|
|
||||||
UUID: "not_matching",
|
|
||||||
Secret: &keyserverv1alpha1.SecretSpec{
|
|
||||||
Name: "the_secret",
|
|
||||||
Path: "the_path",
|
|
||||||
}})
|
|
||||||
})
|
|
||||||
|
|
||||||
It("returns the sealed volume data", func() {
|
|
||||||
volumeData := findVolumeFor(requestData, volumeList)
|
|
||||||
Expect(volumeData).ToNot(BeNil())
|
|
||||||
Expect(volumeData.Quarantined).To(BeFalse())
|
|
||||||
Expect(volumeData.SecretName).To(Equal("the_secret"))
|
|
||||||
Expect(volumeData.SecretPath).To(Equal("the_path"))
|
|
||||||
})
|
|
||||||
})
|
|
||||||
|
|
||||||
When("a sealedvolume matching the UUID exists", func() {
|
|
||||||
BeforeEach(func() {
|
|
||||||
volumeList = volumeListWithPartitionSpec(
|
|
||||||
keyserverv1alpha1.PartitionSpec{
|
|
||||||
Label: "not_matching",
|
|
||||||
DeviceName: "not_matching",
|
|
||||||
UUID: requestData.UUID,
|
|
||||||
Secret: &keyserverv1alpha1.SecretSpec{
|
|
||||||
Name: "the_secret",
|
|
||||||
Path: "the_path",
|
|
||||||
}})
|
|
||||||
})
|
|
||||||
|
|
||||||
It("returns the sealed volume data", func() {
|
|
||||||
volumeData := findVolumeFor(requestData, volumeList)
|
|
||||||
Expect(volumeData).ToNot(BeNil())
|
|
||||||
Expect(volumeData.Quarantined).To(BeFalse())
|
|
||||||
Expect(volumeData.SecretName).To(Equal("the_secret"))
|
|
||||||
Expect(volumeData.SecretPath).To(Equal("the_path"))
|
|
||||||
})
|
|
||||||
})
|
|
||||||
|
|
||||||
When("a matching sealedvolume doesn't exist", func() {
|
|
||||||
BeforeEach(func() {
|
|
||||||
volumeList = volumeListWithPartitionSpec(
|
|
||||||
keyserverv1alpha1.PartitionSpec{
|
|
||||||
Label: "not_matching",
|
|
||||||
DeviceName: "not_matching",
|
|
||||||
UUID: "not_matching",
|
|
||||||
Secret: &keyserverv1alpha1.SecretSpec{
|
|
||||||
Name: "the_secret",
|
|
||||||
Path: "the_path",
|
|
||||||
}})
|
|
||||||
})
|
|
||||||
|
|
||||||
It("returns nil sealedVolumeData", func() {
|
|
||||||
volumeData := findVolumeFor(requestData, volumeList)
|
|
||||||
Expect(volumeData).To(BeNil())
|
|
||||||
})
|
|
||||||
})
|
|
||||||
})
|
|
||||||
})
|
|
||||||
|
|
||||||
func volumeListWithPartitionSpec(partitionSpec keyserverv1alpha1.PartitionSpec) *keyserverv1alpha1.SealedVolumeList {
|
|
||||||
return &keyserverv1alpha1.SealedVolumeList{
|
|
||||||
Items: []keyserverv1alpha1.SealedVolume{
|
|
||||||
{Spec: keyserverv1alpha1.SealedVolumeSpec{
|
|
||||||
TPMHash: "1234",
|
|
||||||
Partitions: []keyserverv1alpha1.PartitionSpec{
|
|
||||||
partitionSpec,
|
|
||||||
},
|
|
||||||
Quarantined: false,
|
|
||||||
},
|
|
||||||
},
|
|
||||||
},
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,13 +0,0 @@
|
|||||||
package challenger_test
|
|
||||||
|
|
||||||
import (
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
. "github.com/onsi/ginkgo/v2"
|
|
||||||
. "github.com/onsi/gomega"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestEpinio(t *testing.T) {
|
|
||||||
RegisterFailHandler(Fail)
|
|
||||||
RunSpecs(t, "Kcrypt challenger suite")
|
|
||||||
}
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
package constants
|
|
||||||
|
|
||||||
const TPMSecret = "tpm"
|
|
||||||
const GeneratedByKey = "generated_by"
|
|
||||||
@@ -1,19 +0,0 @@
|
|||||||
package payload
|
|
||||||
|
|
||||||
type Data struct {
|
|
||||||
Passphrase string `json:"passphrase"`
|
|
||||||
Error string `json:"error"`
|
|
||||||
GeneratedBy string `json:"generated_by"`
|
|
||||||
}
|
|
||||||
|
|
||||||
func (d Data) HasError() bool {
|
|
||||||
return d.Error != ""
|
|
||||||
}
|
|
||||||
|
|
||||||
func (d Data) HasPassphrase() bool {
|
|
||||||
return d.Passphrase != ""
|
|
||||||
}
|
|
||||||
|
|
||||||
func (d Data) HasBeenGenerated() bool {
|
|
||||||
return d.GeneratedBy != ""
|
|
||||||
}
|
|
||||||
@@ -1,62 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
set -e
|
|
||||||
|
|
||||||
# This scripts prepares a cluster where we install the kcrypt CRDs.
|
|
||||||
# This is where sealed volumes are created.
|
|
||||||
|
|
||||||
GINKGO_NODES="${GINKGO_NODES:-1}"
|
|
||||||
K3S_IMAGE="rancher/k3s:v1.26.1-k3s1"
|
|
||||||
|
|
||||||
SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
|
|
||||||
CLUSTER_NAME=$(echo $RANDOM | md5sum | head -c 10; echo;)
|
|
||||||
export KUBECONFIG=$(mktemp)
|
|
||||||
|
|
||||||
# https://unix.stackexchange.com/a/423052
|
|
||||||
getFreePort() {
|
|
||||||
echo $(comm -23 <(seq "30000" "30200" | sort) <(ss -Htan | awk '{print $4}' | cut -d':' -f2 | sort -u) | shuf | head -n "1")
|
|
||||||
}
|
|
||||||
|
|
||||||
cleanup() {
|
|
||||||
echo "Cleaning up $CLUSTER_NAME"
|
|
||||||
k3d cluster delete "$CLUSTER_NAME" || true
|
|
||||||
rm -rf "$KUBECONFIG"
|
|
||||||
}
|
|
||||||
trap cleanup EXIT
|
|
||||||
|
|
||||||
# Create a cluster and bind ports 80 and 443 on the host
|
|
||||||
# This will allow us to access challenger server on 10.0.2.2 which is the IP
|
|
||||||
# on which qemu "sees" the host.
|
|
||||||
# We change the CIDR because k3s creates iptables rules that block DNS traffic to this CIDR
|
|
||||||
# (something like that). If you run k3d inside a k3s cluster (inside a Pod), DNS won't work
|
|
||||||
# inside the k3d server container unless you use a different CIDR.
|
|
||||||
# Here we are avoiding CIDR "10.43.x.x"
|
|
||||||
k3d cluster create "$CLUSTER_NAME" --k3s-arg "--cluster-cidr=10.49.0.1/16@server:0" --k3s-arg "--service-cidr=10.48.0.1/16@server:0" -p '80:80@server:0' -p '443:443@server:0' --image "$K3S_IMAGE"
|
|
||||||
k3d kubeconfig get "$CLUSTER_NAME" > "$KUBECONFIG"
|
|
||||||
|
|
||||||
# Build the docker image
|
|
||||||
IMG=controller:latest make docker-build
|
|
||||||
|
|
||||||
# Import the image to the cluster
|
|
||||||
k3d image import -c "$CLUSTER_NAME" controller:latest
|
|
||||||
|
|
||||||
# Install cert manager
|
|
||||||
kubectl apply -f https://github.com/jetstack/cert-manager/releases/latest/download/cert-manager.yaml
|
|
||||||
kubectl wait --for=condition=Available deployment --timeout=2m -n cert-manager --all
|
|
||||||
|
|
||||||
# Replace the CLUSTER_IP in the kustomize resource
|
|
||||||
# Only needed for debugging so that we can access the server from the host
|
|
||||||
# (the 10.0.2.2 IP address is only useful from within qemu)
|
|
||||||
export CLUSTER_IP=$(docker inspect "k3d-${CLUSTER_NAME}-server-0" | jq -r '.[0].NetworkSettings.Networks[].IPAddress')
|
|
||||||
envsubst \
|
|
||||||
< "$SCRIPT_DIR/../tests/assets/challenger-server-ingress.template.yaml" \
|
|
||||||
> "$SCRIPT_DIR/../tests/assets/challenger-server-ingress.yaml"
|
|
||||||
|
|
||||||
# Install the challenger server kustomization
|
|
||||||
kubectl apply -k "$SCRIPT_DIR/../tests/assets/"
|
|
||||||
|
|
||||||
# 10.0.2.2 is where the vm sees the host
|
|
||||||
# https://stackoverflow.com/a/6752280
|
|
||||||
export KMS_ADDRESS="10.0.2.2.challenger.sslip.io"
|
|
||||||
|
|
||||||
PATH=$PATH:$GOPATH/bin ginkgo -v --nodes $GINKGO_NODES --label-filter $LABEL --fail-fast -r ./tests/
|
|
||||||
@@ -1,37 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
name: controller-manager
|
|
||||||
namespace: system
|
|
||||||
spec:
|
|
||||||
template:
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
- name: manager
|
|
||||||
# Don't try to pull the image we built locally
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
args:
|
|
||||||
- "--health-probe-bind-address"
|
|
||||||
- ":8081"
|
|
||||||
- "--metrics-bind-address"
|
|
||||||
- "127.0.0.1:8080"
|
|
||||||
- "--namespace"
|
|
||||||
- "default"
|
|
||||||
- "--leader-elect"
|
|
||||||
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: kcrypt-escrow-server
|
|
||||||
namespace: system
|
|
||||||
spec:
|
|
||||||
type: ClusterIP
|
|
||||||
selector:
|
|
||||||
control-plane: controller-manager
|
|
||||||
ports:
|
|
||||||
- name: wss
|
|
||||||
port: 8082
|
|
||||||
protocol: TCP
|
|
||||||
targetPort: 8082
|
|
||||||
@@ -1,35 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: networking.k8s.io/v1
|
|
||||||
kind: Ingress
|
|
||||||
metadata:
|
|
||||||
name: challenger-server
|
|
||||||
annotations:
|
|
||||||
cert-manager.io/cluster-issuer: "selfsigned"
|
|
||||||
kubernetes.io/ingress.class: "traefik"
|
|
||||||
spec:
|
|
||||||
tls:
|
|
||||||
- hosts:
|
|
||||||
- 10.0.2.2.challenger.sslip.io
|
|
||||||
- ${CLUSTER_IP}.challenger.sslip.io
|
|
||||||
secretName: kms-tls
|
|
||||||
rules:
|
|
||||||
- host: 10.0.2.2.challenger.sslip.io
|
|
||||||
http:
|
|
||||||
paths:
|
|
||||||
- pathType: Prefix
|
|
||||||
path: "/"
|
|
||||||
backend:
|
|
||||||
service:
|
|
||||||
name: kcrypt-controller-kcrypt-escrow-server
|
|
||||||
port:
|
|
||||||
number: 8082
|
|
||||||
- host: ${CLUSTER_IP}.challenger.sslip.io
|
|
||||||
http:
|
|
||||||
paths:
|
|
||||||
- pathType: Prefix
|
|
||||||
path: "/"
|
|
||||||
backend:
|
|
||||||
service:
|
|
||||||
name: kcrypt-controller-kcrypt-escrow-server
|
|
||||||
port:
|
|
||||||
number: 8082
|
|
||||||
@@ -1,8 +0,0 @@
|
|||||||
---
|
|
||||||
# Self-signed issuer
|
|
||||||
apiVersion: cert-manager.io/v1
|
|
||||||
kind: ClusterIssuer
|
|
||||||
metadata:
|
|
||||||
name: selfsigned
|
|
||||||
spec:
|
|
||||||
selfSigned: {}
|
|
||||||
@@ -1,13 +0,0 @@
|
|||||||
# Adds namespace to all resources.
|
|
||||||
namespace: default
|
|
||||||
|
|
||||||
bases:
|
|
||||||
- ../../config/default
|
|
||||||
|
|
||||||
resources:
|
|
||||||
- challenger-server-ingress.yaml
|
|
||||||
- cluster-issuer.yaml
|
|
||||||
|
|
||||||
patchesStrategicMerge:
|
|
||||||
# Fix labels and selectors to make challenger server accessible
|
|
||||||
- challenger-patch.yaml
|
|
||||||
@@ -1,390 +0,0 @@
|
|||||||
package e2e_test
|
|
||||||
|
|
||||||
import (
|
|
||||||
"fmt"
|
|
||||||
"os"
|
|
||||||
"os/exec"
|
|
||||||
"path"
|
|
||||||
"strconv"
|
|
||||||
"strings"
|
|
||||||
"syscall"
|
|
||||||
|
|
||||||
. "github.com/onsi/ginkgo/v2"
|
|
||||||
. "github.com/onsi/gomega"
|
|
||||||
. "github.com/spectrocloud/peg/matcher"
|
|
||||||
"gopkg.in/yaml.v3"
|
|
||||||
|
|
||||||
client "github.com/kairos-io/kairos-challenger/cmd/discovery/client"
|
|
||||||
)
|
|
||||||
|
|
||||||
var installationOutput string
|
|
||||||
var vm VM
|
|
||||||
|
|
||||||
var _ = Describe("kcrypt encryption", func() {
|
|
||||||
var config string
|
|
||||||
|
|
||||||
BeforeEach(func() {
|
|
||||||
RegisterFailHandler(printInstallationOutput)
|
|
||||||
_, vm = startVM()
|
|
||||||
fmt.Printf("\nvm.StateDir = %+v\n", vm.StateDir)
|
|
||||||
|
|
||||||
vm.EventuallyConnects(1200)
|
|
||||||
})
|
|
||||||
|
|
||||||
JustBeforeEach(func() {
|
|
||||||
configFile, err := os.CreateTemp("", "")
|
|
||||||
Expect(err).ToNot(HaveOccurred())
|
|
||||||
defer os.Remove(configFile.Name())
|
|
||||||
|
|
||||||
err = os.WriteFile(configFile.Name(), []byte(config), 0744)
|
|
||||||
Expect(err).ToNot(HaveOccurred())
|
|
||||||
|
|
||||||
err = vm.Scp(configFile.Name(), "config.yaml", "0744")
|
|
||||||
Expect(err).ToNot(HaveOccurred())
|
|
||||||
|
|
||||||
installationOutput, err = vm.Sudo("/bin/bash -c 'set -o pipefail && kairos-agent manual-install --device auto config.yaml 2>&1 | tee manual-install.txt'")
|
|
||||||
Expect(err).ToNot(HaveOccurred(), installationOutput)
|
|
||||||
})
|
|
||||||
|
|
||||||
AfterEach(func() {
|
|
||||||
err := vm.Destroy(func(vm VM) {
|
|
||||||
// Stop TPM emulator
|
|
||||||
tpmPID, err := os.ReadFile(path.Join(vm.StateDir, "tpm", "pid"))
|
|
||||||
Expect(err).ToNot(HaveOccurred())
|
|
||||||
|
|
||||||
if len(tpmPID) != 0 {
|
|
||||||
pid, err := strconv.Atoi(string(tpmPID))
|
|
||||||
Expect(err).ToNot(HaveOccurred())
|
|
||||||
|
|
||||||
syscall.Kill(pid, syscall.SIGKILL)
|
|
||||||
}
|
|
||||||
})
|
|
||||||
Expect(err).ToNot(HaveOccurred())
|
|
||||||
})
|
|
||||||
|
|
||||||
// https://kairos.io/docs/advanced/partition_encryption/#offline-mode
|
|
||||||
When("doing local encryption", Label("local-encryption"), func() {
|
|
||||||
BeforeEach(func() {
|
|
||||||
config = `#cloud-config
|
|
||||||
|
|
||||||
install:
|
|
||||||
encrypted_partitions:
|
|
||||||
- COS_PERSISTENT
|
|
||||||
reboot: false # we will reboot manually
|
|
||||||
|
|
||||||
hostname: metal-{{ trunc 4 .MachineID }}
|
|
||||||
users:
|
|
||||||
- name: kairos
|
|
||||||
passwd: kairos
|
|
||||||
`
|
|
||||||
})
|
|
||||||
|
|
||||||
It("boots and has an encrypted partition", func() {
|
|
||||||
vm.Reboot()
|
|
||||||
vm.EventuallyConnects(1200)
|
|
||||||
out, err := vm.Sudo("blkid")
|
|
||||||
Expect(err).ToNot(HaveOccurred(), out)
|
|
||||||
Expect(out).To(MatchRegexp("TYPE=\"crypto_LUKS\" PARTLABEL=\"persistent\""), out)
|
|
||||||
})
|
|
||||||
})
|
|
||||||
|
|
||||||
//https://kairos.io/docs/advanced/partition_encryption/#online-mode
|
|
||||||
When("using a remote key management server (automated passphrase generation)", Label("remote-auto"), func() {
|
|
||||||
var tpmHash string
|
|
||||||
var err error
|
|
||||||
|
|
||||||
BeforeEach(func() {
|
|
||||||
tpmHash, err = vm.Sudo("/system/discovery/kcrypt-discovery-challenger")
|
|
||||||
Expect(err).ToNot(HaveOccurred(), tpmHash)
|
|
||||||
|
|
||||||
kubectlApplyYaml(fmt.Sprintf(`---
|
|
||||||
apiVersion: keyserver.kairos.io/v1alpha1
|
|
||||||
kind: SealedVolume
|
|
||||||
metadata:
|
|
||||||
name: "%[1]s"
|
|
||||||
namespace: default
|
|
||||||
spec:
|
|
||||||
TPMHash: "%[1]s"
|
|
||||||
partitions:
|
|
||||||
- label: COS_PERSISTENT
|
|
||||||
quarantined: false
|
|
||||||
`, strings.TrimSpace(tpmHash)))
|
|
||||||
|
|
||||||
config = fmt.Sprintf(`#cloud-config
|
|
||||||
|
|
||||||
hostname: metal-{{ trunc 4 .MachineID }}
|
|
||||||
users:
|
|
||||||
- name: kairos
|
|
||||||
passwd: kairos
|
|
||||||
|
|
||||||
install:
|
|
||||||
encrypted_partitions:
|
|
||||||
- COS_PERSISTENT
|
|
||||||
grub_options:
|
|
||||||
extra_cmdline: "rd.neednet=1"
|
|
||||||
reboot: false # we will reboot manually
|
|
||||||
|
|
||||||
kcrypt:
|
|
||||||
challenger:
|
|
||||||
challenger_server: "http://%s"
|
|
||||||
nv_index: ""
|
|
||||||
c_index: ""
|
|
||||||
tpm_device: ""
|
|
||||||
`, os.Getenv("KMS_ADDRESS"))
|
|
||||||
})
|
|
||||||
|
|
||||||
AfterEach(func() {
|
|
||||||
cmd := exec.Command("kubectl", "delete", "sealedvolume", tpmHash)
|
|
||||||
out, err := cmd.CombinedOutput()
|
|
||||||
Expect(err).ToNot(HaveOccurred(), out)
|
|
||||||
})
|
|
||||||
|
|
||||||
It("creates a passphrase and a key/pair to decrypt it", func() {
|
|
||||||
// Expect a LUKS partition
|
|
||||||
vm.Reboot(750)
|
|
||||||
vm.EventuallyConnects(1200)
|
|
||||||
out, err := vm.Sudo("blkid")
|
|
||||||
Expect(err).ToNot(HaveOccurred(), out)
|
|
||||||
Expect(out).To(MatchRegexp("TYPE=\"crypto_LUKS\" PARTLABEL=\"persistent\""), out)
|
|
||||||
|
|
||||||
// Expect a secret to be created
|
|
||||||
cmd := exec.Command("kubectl", "get", "secrets",
|
|
||||||
fmt.Sprintf("%s-cos-persistent", tpmHash),
|
|
||||||
"-o=go-template='{{.data.generated_by|base64decode}}'",
|
|
||||||
)
|
|
||||||
|
|
||||||
secretOut, err := cmd.CombinedOutput()
|
|
||||||
Expect(err).ToNot(HaveOccurred(), string(secretOut))
|
|
||||||
Expect(string(secretOut)).To(MatchRegexp("tpm"))
|
|
||||||
})
|
|
||||||
})
|
|
||||||
|
|
||||||
// https://kairos.io/docs/advanced/partition_encryption/#scenario-static-keys
|
|
||||||
When("using a remote key management server (static keys)", Label("remote-static"), func() {
|
|
||||||
var tpmHash string
|
|
||||||
var err error
|
|
||||||
|
|
||||||
BeforeEach(func() {
|
|
||||||
tpmHash, err = vm.Sudo("/system/discovery/kcrypt-discovery-challenger")
|
|
||||||
Expect(err).ToNot(HaveOccurred(), tpmHash)
|
|
||||||
|
|
||||||
kubectlApplyYaml(fmt.Sprintf(`---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
name: %[1]s
|
|
||||||
namespace: default
|
|
||||||
type: Opaque
|
|
||||||
stringData:
|
|
||||||
pass: "awesome-plaintext-passphrase"
|
|
||||||
`, tpmHash))
|
|
||||||
|
|
||||||
kubectlApplyYaml(fmt.Sprintf(`---
|
|
||||||
apiVersion: keyserver.kairos.io/v1alpha1
|
|
||||||
kind: SealedVolume
|
|
||||||
metadata:
|
|
||||||
name: %[1]s
|
|
||||||
namespace: default
|
|
||||||
spec:
|
|
||||||
TPMHash: "%[1]s"
|
|
||||||
partitions:
|
|
||||||
- label: COS_PERSISTENT
|
|
||||||
secret:
|
|
||||||
name: %[1]s
|
|
||||||
path: pass
|
|
||||||
quarantined: false
|
|
||||||
`, tpmHash))
|
|
||||||
|
|
||||||
config = fmt.Sprintf(`#cloud-config
|
|
||||||
|
|
||||||
hostname: metal-{{ trunc 4 .MachineID }}
|
|
||||||
users:
|
|
||||||
- name: kairos
|
|
||||||
passwd: kairos
|
|
||||||
|
|
||||||
install:
|
|
||||||
encrypted_partitions:
|
|
||||||
- COS_PERSISTENT
|
|
||||||
grub_options:
|
|
||||||
extra_cmdline: "rd.neednet=1"
|
|
||||||
reboot: false # we will reboot manually
|
|
||||||
|
|
||||||
kcrypt:
|
|
||||||
challenger:
|
|
||||||
challenger_server: "http://%s"
|
|
||||||
nv_index: ""
|
|
||||||
c_index: ""
|
|
||||||
tpm_device: ""
|
|
||||||
|
|
||||||
`, os.Getenv("KMS_ADDRESS"))
|
|
||||||
})
|
|
||||||
|
|
||||||
AfterEach(func() {
|
|
||||||
cmd := exec.Command("kubectl", "delete", "sealedvolume", tpmHash)
|
|
||||||
out, err := cmd.CombinedOutput()
|
|
||||||
Expect(err).ToNot(HaveOccurred(), out)
|
|
||||||
|
|
||||||
cmd = exec.Command("kubectl", "delete", "secret", tpmHash)
|
|
||||||
out, err = cmd.CombinedOutput()
|
|
||||||
Expect(err).ToNot(HaveOccurred(), out)
|
|
||||||
})
|
|
||||||
|
|
||||||
It("creates uses the existing passphrase to decrypt it", func() {
|
|
||||||
// Expect a LUKS partition
|
|
||||||
vm.Reboot()
|
|
||||||
vm.EventuallyConnects(1200)
|
|
||||||
out, err := vm.Sudo("blkid")
|
|
||||||
Expect(err).ToNot(HaveOccurred(), out)
|
|
||||||
Expect(out).To(MatchRegexp("TYPE=\"crypto_LUKS\" PARTLABEL=\"persistent\""), out)
|
|
||||||
Expect(out).To(MatchRegexp("/dev/mapper.*LABEL=\"COS_PERSISTENT\""), out)
|
|
||||||
})
|
|
||||||
})
|
|
||||||
|
|
||||||
When("the key management server is listening on https", func() {
|
|
||||||
var tpmHash string
|
|
||||||
var err error
|
|
||||||
|
|
||||||
BeforeEach(func() {
|
|
||||||
tpmHash, err = vm.Sudo("/system/discovery/kcrypt-discovery-challenger")
|
|
||||||
Expect(err).ToNot(HaveOccurred(), tpmHash)
|
|
||||||
|
|
||||||
kubectlApplyYaml(fmt.Sprintf(`---
|
|
||||||
apiVersion: keyserver.kairos.io/v1alpha1
|
|
||||||
kind: SealedVolume
|
|
||||||
metadata:
|
|
||||||
name: "%[1]s"
|
|
||||||
namespace: default
|
|
||||||
spec:
|
|
||||||
TPMHash: "%[1]s"
|
|
||||||
partitions:
|
|
||||||
- label: COS_PERSISTENT
|
|
||||||
quarantined: false
|
|
||||||
`, strings.TrimSpace(tpmHash)))
|
|
||||||
})
|
|
||||||
|
|
||||||
When("the certificate is pinned on the configuration", Label("remote-https-pinned"), func() {
|
|
||||||
BeforeEach(func() {
|
|
||||||
cert := getChallengerServerCert()
|
|
||||||
kcryptConfig := createConfigWithCert(fmt.Sprintf("https://%s", os.Getenv("KMS_ADDRESS")), cert)
|
|
||||||
kcryptConfigBytes, err := yaml.Marshal(kcryptConfig)
|
|
||||||
Expect(err).ToNot(HaveOccurred())
|
|
||||||
config = fmt.Sprintf(`#cloud-config
|
|
||||||
|
|
||||||
hostname: metal-{{ trunc 4 .MachineID }}
|
|
||||||
users:
|
|
||||||
- name: kairos
|
|
||||||
passwd: kairos
|
|
||||||
|
|
||||||
install:
|
|
||||||
encrypted_partitions:
|
|
||||||
- COS_PERSISTENT
|
|
||||||
grub_options:
|
|
||||||
extra_cmdline: "rd.neednet=1"
|
|
||||||
reboot: false # we will reboot manually
|
|
||||||
|
|
||||||
%s
|
|
||||||
|
|
||||||
`, string(kcryptConfigBytes))
|
|
||||||
})
|
|
||||||
|
|
||||||
It("successfully talks to the server", func() {
|
|
||||||
vm.Reboot()
|
|
||||||
vm.EventuallyConnects(1200)
|
|
||||||
out, err := vm.Sudo("blkid")
|
|
||||||
Expect(err).ToNot(HaveOccurred(), out)
|
|
||||||
Expect(out).To(MatchRegexp("TYPE=\"crypto_LUKS\" PARTLABEL=\"persistent\""), out)
|
|
||||||
Expect(out).To(MatchRegexp("/dev/mapper.*LABEL=\"COS_PERSISTENT\""), out)
|
|
||||||
})
|
|
||||||
})
|
|
||||||
|
|
||||||
When("the no certificate is set in the configuration", Label("remote-https-bad-cert"), func() {
|
|
||||||
BeforeEach(func() {
|
|
||||||
config = fmt.Sprintf(`#cloud-config
|
|
||||||
|
|
||||||
hostname: metal-{{ trunc 4 .MachineID }}
|
|
||||||
users:
|
|
||||||
- name: kairos
|
|
||||||
passwd: kairos
|
|
||||||
|
|
||||||
install:
|
|
||||||
encrypted_partitions:
|
|
||||||
- COS_PERSISTENT
|
|
||||||
grub_options:
|
|
||||||
extra_cmdline: "rd.neednet=1"
|
|
||||||
reboot: false # we will reboot manually
|
|
||||||
|
|
||||||
kcrypt:
|
|
||||||
challenger:
|
|
||||||
challenger_server: "https://%s"
|
|
||||||
nv_index: ""
|
|
||||||
c_index: ""
|
|
||||||
tpm_device: ""
|
|
||||||
`, os.Getenv("KMS_ADDRESS"))
|
|
||||||
})
|
|
||||||
|
|
||||||
It("fails to talk to the server", func() {
|
|
||||||
out, err := vm.Sudo("cat manual-install.txt")
|
|
||||||
Expect(err).ToNot(HaveOccurred(), out)
|
|
||||||
Expect(out).To(MatchRegexp("could not encrypt partition.*x509: certificate signed by unknown authority"))
|
|
||||||
})
|
|
||||||
})
|
|
||||||
})
|
|
||||||
})
|
|
||||||
|
|
||||||
func printInstallationOutput(message string, callerSkip ...int) {
|
|
||||||
fmt.Printf("This is the installation output in case it's useful:\n%s\n", installationOutput)
|
|
||||||
|
|
||||||
// Ensures the correct line numbers are reported
|
|
||||||
Fail(message, callerSkip[0]+1)
|
|
||||||
}
|
|
||||||
|
|
||||||
func kubectlApplyYaml(yamlData string) {
|
|
||||||
yamlFile, err := os.CreateTemp("", "")
|
|
||||||
Expect(err).ToNot(HaveOccurred())
|
|
||||||
defer os.Remove(yamlFile.Name())
|
|
||||||
|
|
||||||
err = os.WriteFile(yamlFile.Name(), []byte(yamlData), 0744)
|
|
||||||
Expect(err).ToNot(HaveOccurred())
|
|
||||||
|
|
||||||
cmd := exec.Command("kubectl", "apply", "-f", yamlFile.Name())
|
|
||||||
out, err := cmd.CombinedOutput()
|
|
||||||
Expect(err).ToNot(HaveOccurred(), out)
|
|
||||||
}
|
|
||||||
|
|
||||||
func getChallengerServerCert() string {
|
|
||||||
cmd := exec.Command(
|
|
||||||
"kubectl", "get", "secret", "-n", "default", "kms-tls",
|
|
||||||
"-o", `go-template={{ index .data "ca.crt" | base64decode }}`)
|
|
||||||
out, err := cmd.CombinedOutput()
|
|
||||||
Expect(err).ToNot(HaveOccurred(), string(out))
|
|
||||||
|
|
||||||
return string(out)
|
|
||||||
}
|
|
||||||
|
|
||||||
func createConfigWithCert(server, cert string) client.Config {
|
|
||||||
return client.Config{
|
|
||||||
Kcrypt: struct {
|
|
||||||
Challenger struct {
|
|
||||||
Server string "yaml:\"challenger_server,omitempty\""
|
|
||||||
NVIndex string "yaml:\"nv_index,omitempty\""
|
|
||||||
CIndex string "yaml:\"c_index,omitempty\""
|
|
||||||
TPMDevice string "yaml:\"tpm_device,omitempty\""
|
|
||||||
Certificate string "yaml:\"certificate,omitempty\""
|
|
||||||
}
|
|
||||||
}{
|
|
||||||
Challenger: struct {
|
|
||||||
Server string "yaml:\"challenger_server,omitempty\""
|
|
||||||
NVIndex string "yaml:\"nv_index,omitempty\""
|
|
||||||
CIndex string "yaml:\"c_index,omitempty\""
|
|
||||||
TPMDevice string "yaml:\"tpm_device,omitempty\""
|
|
||||||
Certificate string "yaml:\"certificate,omitempty\""
|
|
||||||
}{
|
|
||||||
Server: server,
|
|
||||||
NVIndex: "",
|
|
||||||
CIndex: "",
|
|
||||||
TPMDevice: "",
|
|
||||||
Certificate: cert,
|
|
||||||
},
|
|
||||||
},
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,191 +0,0 @@
|
|||||||
package e2e_test
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"fmt"
|
|
||||||
"net"
|
|
||||||
"os"
|
|
||||||
"os/exec"
|
|
||||||
"path"
|
|
||||||
"strconv"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
"github.com/google/uuid"
|
|
||||||
process "github.com/mudler/go-processmanager"
|
|
||||||
|
|
||||||
. "github.com/onsi/ginkgo/v2"
|
|
||||||
. "github.com/onsi/gomega"
|
|
||||||
. "github.com/spectrocloud/peg/matcher"
|
|
||||||
machine "github.com/spectrocloud/peg/pkg/machine"
|
|
||||||
"github.com/spectrocloud/peg/pkg/machine/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestE2e(t *testing.T) {
|
|
||||||
RegisterFailHandler(Fail)
|
|
||||||
RunSpecs(t, "kcrypt-challenger e2e test Suite")
|
|
||||||
}
|
|
||||||
|
|
||||||
func user() string {
|
|
||||||
user := os.Getenv("SSH_USER")
|
|
||||||
if user == "" {
|
|
||||||
user = "kairos"
|
|
||||||
}
|
|
||||||
return user
|
|
||||||
}
|
|
||||||
|
|
||||||
func pass() string {
|
|
||||||
pass := os.Getenv("SSH_PASS")
|
|
||||||
if pass == "" {
|
|
||||||
pass = "kairos"
|
|
||||||
}
|
|
||||||
|
|
||||||
return pass
|
|
||||||
}
|
|
||||||
|
|
||||||
func startVM() (context.Context, VM) {
|
|
||||||
if os.Getenv("ISO") == "" {
|
|
||||||
fmt.Println("ISO missing")
|
|
||||||
os.Exit(1)
|
|
||||||
}
|
|
||||||
|
|
||||||
vmName := uuid.New().String()
|
|
||||||
|
|
||||||
stateDir, err := os.MkdirTemp("", "")
|
|
||||||
Expect(err).ToNot(HaveOccurred())
|
|
||||||
|
|
||||||
emulateTPM(stateDir)
|
|
||||||
|
|
||||||
sshPort, err := getFreePort()
|
|
||||||
Expect(err).ToNot(HaveOccurred())
|
|
||||||
|
|
||||||
memory := os.Getenv("MEMORY")
|
|
||||||
if memory == "" {
|
|
||||||
memory = "2096"
|
|
||||||
}
|
|
||||||
cpus := os.Getenv("CPUS")
|
|
||||||
if cpus == "" {
|
|
||||||
cpus = "2"
|
|
||||||
}
|
|
||||||
|
|
||||||
opts := []types.MachineOption{
|
|
||||||
types.QEMUEngine,
|
|
||||||
types.WithISO(os.Getenv("ISO")),
|
|
||||||
types.WithMemory(memory),
|
|
||||||
types.WithCPU(cpus),
|
|
||||||
types.WithSSHPort(strconv.Itoa(sshPort)),
|
|
||||||
types.WithID(vmName),
|
|
||||||
types.WithSSHUser(user()),
|
|
||||||
types.WithSSHPass(pass()),
|
|
||||||
types.OnFailure(func(p *process.Process) {
|
|
||||||
defer GinkgoRecover()
|
|
||||||
|
|
||||||
var stdout, stderr, serial, status string
|
|
||||||
|
|
||||||
if stdoutBytes, err := os.ReadFile(p.StdoutPath()); err != nil {
|
|
||||||
stdout = fmt.Sprintf("Error reading stdout file: %s\n", err)
|
|
||||||
} else {
|
|
||||||
stdout = string(stdoutBytes)
|
|
||||||
}
|
|
||||||
|
|
||||||
if stderrBytes, err := os.ReadFile(p.StderrPath()); err != nil {
|
|
||||||
stderr = fmt.Sprintf("Error reading stderr file: %s\n", err)
|
|
||||||
} else {
|
|
||||||
stderr = string(stderrBytes)
|
|
||||||
}
|
|
||||||
|
|
||||||
if status, err = p.ExitCode(); err != nil {
|
|
||||||
status = fmt.Sprintf("Error reading exit code file: %s\n", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
if serialBytes, err := os.ReadFile(path.Join(p.StateDir(), "serial.log")); err != nil {
|
|
||||||
serial = fmt.Sprintf("Error reading serial log file: %s\n", err)
|
|
||||||
} else {
|
|
||||||
serial = string(serialBytes)
|
|
||||||
}
|
|
||||||
|
|
||||||
Fail(fmt.Sprintf("\nVM Aborted.\nstdout: %s\nstderr: %s\nserial: %s\nExit status: %s\n",
|
|
||||||
stdout, stderr, serial, status))
|
|
||||||
}),
|
|
||||||
types.WithStateDir(stateDir),
|
|
||||||
// Serial output to file: https://superuser.com/a/1412150
|
|
||||||
func(m *types.MachineConfig) error {
|
|
||||||
m.Args = append(m.Args,
|
|
||||||
"-chardev", fmt.Sprintf("socket,id=chrtpm,path=%s/swtpm-sock", path.Join(stateDir, "tpm")),
|
|
||||||
"-tpmdev", "emulator,id=tpm0,chardev=chrtpm", "-device", "tpm-tis,tpmdev=tpm0",
|
|
||||||
"-chardev", fmt.Sprintf("stdio,mux=on,id=char0,logfile=%s,signal=off", path.Join(stateDir, "serial.log")),
|
|
||||||
"-serial", "chardev:char0",
|
|
||||||
"-mon", "chardev=char0",
|
|
||||||
)
|
|
||||||
return nil
|
|
||||||
},
|
|
||||||
}
|
|
||||||
|
|
||||||
// Set this to true to debug.
|
|
||||||
// You can connect to it with "spicy" or other tool.
|
|
||||||
var spicePort int
|
|
||||||
if os.Getenv("MACHINE_SPICY") != "" {
|
|
||||||
spicePort, err = getFreePort()
|
|
||||||
Expect(err).ToNot(HaveOccurred())
|
|
||||||
fmt.Printf("Spice port = %d\n", spicePort)
|
|
||||||
opts = append(opts, types.WithDisplay(fmt.Sprintf("-spice port=%d,addr=127.0.0.1,disable-ticketing", spicePort)))
|
|
||||||
}
|
|
||||||
|
|
||||||
if os.Getenv("KVM") != "" {
|
|
||||||
opts = append(opts, func(m *types.MachineConfig) error {
|
|
||||||
m.Args = append(m.Args,
|
|
||||||
"-enable-kvm",
|
|
||||||
)
|
|
||||||
return nil
|
|
||||||
})
|
|
||||||
}
|
|
||||||
|
|
||||||
m, err := machine.New(opts...)
|
|
||||||
Expect(err).ToNot(HaveOccurred())
|
|
||||||
|
|
||||||
vm := NewVM(m, stateDir)
|
|
||||||
|
|
||||||
ctx, err := vm.Start(context.Background())
|
|
||||||
Expect(err).ToNot(HaveOccurred())
|
|
||||||
|
|
||||||
if os.Getenv("MACHINE_SPICY") != "" {
|
|
||||||
cmd := exec.Command("spicy",
|
|
||||||
"-h", "127.0.0.1",
|
|
||||||
"-p", strconv.Itoa(spicePort))
|
|
||||||
err = cmd.Start()
|
|
||||||
Expect(err).ToNot(HaveOccurred())
|
|
||||||
}
|
|
||||||
|
|
||||||
return ctx, vm
|
|
||||||
}
|
|
||||||
|
|
||||||
// return the PID of the swtpm (to be killed later) and the state directory
|
|
||||||
func emulateTPM(stateDir string) {
|
|
||||||
t := path.Join(stateDir, "tpm")
|
|
||||||
err := os.MkdirAll(t, os.ModePerm)
|
|
||||||
Expect(err).ToNot(HaveOccurred())
|
|
||||||
|
|
||||||
cmd := exec.Command("swtpm",
|
|
||||||
"socket",
|
|
||||||
"--tpmstate", fmt.Sprintf("dir=%s", t),
|
|
||||||
"--ctrl", fmt.Sprintf("type=unixio,path=%s/swtpm-sock", t),
|
|
||||||
"--tpm2", "--log", "level=20")
|
|
||||||
err = cmd.Start()
|
|
||||||
Expect(err).ToNot(HaveOccurred())
|
|
||||||
|
|
||||||
err = os.WriteFile(path.Join(t, "pid"), []byte(strconv.Itoa(cmd.Process.Pid)), 0744)
|
|
||||||
Expect(err).ToNot(HaveOccurred())
|
|
||||||
}
|
|
||||||
|
|
||||||
// https://gist.github.com/sevkin/96bdae9274465b2d09191384f86ef39d
|
|
||||||
// GetFreePort asks the kernel for a free open port that is ready to use.
|
|
||||||
func getFreePort() (port int, err error) {
|
|
||||||
var a *net.TCPAddr
|
|
||||||
if a, err = net.ResolveTCPAddr("tcp", "localhost:0"); err == nil {
|
|
||||||
var l *net.TCPListener
|
|
||||||
if l, err = net.ListenTCP("tcp", a); err == nil {
|
|
||||||
defer l.Close()
|
|
||||||
return l.Addr().(*net.TCPAddr).Port, nil
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return
|
|
||||||
}
|
|
||||||
Reference in New Issue
Block a user