Skip to content

Commit

Permalink
wip
Browse files Browse the repository at this point in the history
  • Loading branch information
@msanft
msanft committed Jul 31, 2024
1 parent e7e5748 commit fcaf780
Show file tree
Hide file tree
Showing 35 changed files with 201 additions and 222 deletions.
7 changes: 3 additions & 4 deletions cli/cmd/generate.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -25,8 +25,7 @@ import (
"github.com/edgelesssys/contrast/internal/embedbin"
"github.com/edgelesssys/contrast/internal/kuberesource"
"github.com/edgelesssys/contrast/internal/manifest"
"github.com/edgelesssys/contrast/node-installer/platforms"
"github.com/edgelesssys/contrast/node-installer/runtimehandler"
"github.com/edgelesssys/contrast/platforms"
applyappsv1 "k8s.io/client-go/applyconfigurations/apps/v1"
applycorev1 "k8s.io/client-go/applyconfigurations/core/v1"

Expand Down Expand Up @@ -122,7 +121,7 @@ func runGenerate(cmd *cobra.Command, args []string) error {
}
}

runtimeHandler, err := runtimehandler.Name(flags.referenceValuesPlatform)
runtimeHandler, err := platforms.RuntimeHandler(flags.referenceValuesPlatform)
if err != nil {
return fmt.Errorf("get runtime handler: %w", err)
}
Expand Down Expand Up @@ -394,7 +393,7 @@ func addWorkloadOwnerKeyToManifest(manifst *manifest.Manifest, keyPath string) e
}

hash := sha256.Sum256(publicKey)
hashString := manifest.NewHexString(hash[:])
hashString := platforms.NewHexString(hash[:])
for _, existingHash := range manifst.WorkloadOwnerKeyDigests {
if existingHash == hashString {
return nil
Expand Down
7 changes: 4 additions & 3 deletions cli/cmd/policies.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ import (

"github.com/edgelesssys/contrast/internal/kubeapi"
"github.com/edgelesssys/contrast/internal/manifest"
"github.com/edgelesssys/contrast/platforms"
)

func policiesFromKubeResources(yamlPaths []string) ([]deployment, error) {
Expand Down Expand Up @@ -76,8 +77,8 @@ func policiesFromKubeResources(yamlPaths []string) ([]deployment, error) {
return deployments, nil
}

func manifestPolicyMapFromPolicies(policies []deployment) (map[manifest.HexString][]string, error) {
policyHashes := make(map[manifest.HexString][]string)
func manifestPolicyMapFromPolicies(policies []deployment) (map[platforms.HexString][]string, error) {
policyHashes := make(map[platforms.HexString][]string)
for _, depl := range policies {
if existingNames, ok := policyHashes[depl.policy.Hash()]; ok {
if slices.Equal(existingNames, depl.DNSNames()) {
Expand All @@ -91,7 +92,7 @@ func manifestPolicyMapFromPolicies(policies []deployment) (map[manifest.HexStrin
return policyHashes, nil
}

func checkPoliciesMatchManifest(policies []deployment, policyHashes map[manifest.HexString][]string) error {
func checkPoliciesMatchManifest(policies []deployment, policyHashes map[platforms.HexString][]string) error {
if len(policies) != len(policyHashes) {
return fmt.Errorf("policy count mismatch: %d policies in deployment, but %d in manifest",
len(policies), len(policyHashes))
Expand Down
3 changes: 2 additions & 1 deletion cli/cmd/verify.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ import (
"github.com/edgelesssys/contrast/internal/logger"
"github.com/edgelesssys/contrast/internal/manifest"
"github.com/edgelesssys/contrast/internal/userapi"
"github.com/edgelesssys/contrast/platforms"
"github.com/spf13/cobra"
)

Expand Down Expand Up @@ -114,7 +115,7 @@ func runVerify(cmd *cobra.Command, _ []string) error {
}
for _, p := range resp.Policies {
sha256sum := sha256.Sum256(p)
pHash := manifest.NewHexString(sha256sum[:])
pHash := platforms.NewHexString(sha256sum[:])
filelist[fmt.Sprintf("policy.%s.rego", pHash)] = p
}
if err := writeFilelist(filepath.Join(flags.workspaceDir, verifyDir), filelist); err != nil {
Expand Down
4 changes: 2 additions & 2 deletions cli/main.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ import (

"github.com/edgelesssys/contrast/cli/cmd"
"github.com/edgelesssys/contrast/internal/constants"
"github.com/edgelesssys/contrast/internal/manifest"
"github.com/edgelesssys/contrast/platforms"
"github.com/spf13/cobra"
)

Expand Down Expand Up @@ -43,7 +43,7 @@ func buildVersionString() string {
fmt.Fprintf(versionsWriter, "\t%s\n", image)
}
}
if refValues, err := json.MarshalIndent(manifest.EmbeddedReferenceValues(), "\t", " "); err == nil {
if refValues, err := json.MarshalIndent(platforms.EmbeddedReferenceValues(), "\t", " "); err == nil {
fmt.Fprintf(versionsWriter, "embedded reference values:\t%s\n", refValues)
}
fmt.Fprintf(versionsWriter, "genpolicy version:\t%s\n", constants.GenpolicyVersion)
Expand Down
5 changes: 3 additions & 2 deletions coordinator/internal/authority/authority.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ import (
"github.com/edgelesssys/contrast/internal/ca"
"github.com/edgelesssys/contrast/internal/manifest"
"github.com/edgelesssys/contrast/internal/userapi"
"github.com/edgelesssys/contrast/platforms"
"github.com/google/go-sev-guest/proto/sevsnp"
"github.com/google/go-sev-guest/validate"
"github.com/prometheus/client_golang/prometheus"
Expand Down Expand Up @@ -89,7 +90,7 @@ func (m *Authority) SNPValidateOpts(report *sevsnp.Report) (*validate.Options, e
}
mnfst := state.manifest

hostData := manifest.NewHexString(report.HostData)
hostData := platforms.NewHexString(report.HostData)
if _, ok := mnfst.Policies[hostData]; !ok {
return nil, fmt.Errorf("hostdata %s not found in manifest", hostData)
}
Expand All @@ -106,7 +107,7 @@ func (m *Authority) ValidateCallback(_ context.Context, report *sevsnp.Report,
return ErrNoManifest
}

hostData := manifest.NewHexString(report.HostData)
hostData := platforms.NewHexString(report.HostData)
dnsNames, ok := state.manifest.Policies[hostData]
if !ok {
return fmt.Errorf("report data %s not found in manifest", hostData)
Expand Down
10 changes: 5 additions & 5 deletions coordinator/internal/authority/authority_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ import (
"github.com/edgelesssys/contrast/coordinator/history"
"github.com/edgelesssys/contrast/internal/manifest"
"github.com/edgelesssys/contrast/internal/userapi"
"github.com/edgelesssys/contrast/node-installer/platforms"
"github.com/edgelesssys/contrast/platforms"
"github.com/google/go-sev-guest/proto/sevsnp"
"github.com/prometheus/client_golang/prometheus"
"github.com/prometheus/client_golang/prometheus/testutil"
Expand All @@ -31,7 +31,7 @@ contrast_coordinator_manifest_generation %d
`
)

var keyDigest = manifest.HexString("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef")
var keyDigest = platforms.HexString("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef")

func TestSNPValidateOpts(t *testing.T) {
require := require.New(t)
Expand Down Expand Up @@ -78,12 +78,12 @@ func newManifest(t *testing.T) (*manifest.Manifest, []byte, [][]byte) {
t.Helper()
policy := []byte("=== SOME REGO HERE ===")
policyHash := sha256.Sum256(policy)
policyHashHex := manifest.NewHexString(policyHash[:])
policyHashHex := platforms.NewHexString(policyHash[:])

mnfst, err := manifest.Default(platforms.AKSCloudHypervisorSNP)
require.NoError(t, err)
mnfst.Policies = map[manifest.HexString][]string{policyHashHex: {"test"}}
mnfst.WorkloadOwnerKeyDigests = []manifest.HexString{keyDigest}
mnfst.Policies = map[platforms.HexString][]string{policyHashHex: {"test"}}
mnfst.WorkloadOwnerKeyDigests = []platforms.HexString{keyDigest}
mnfstBytes, err := json.Marshal(mnfst)
require.NoError(t, err)
return mnfst, mnfstBytes, [][]byte{policy}
Expand Down
3 changes: 2 additions & 1 deletion coordinator/internal/authority/userapi.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ import (
"github.com/edgelesssys/contrast/internal/crypto"
"github.com/edgelesssys/contrast/internal/manifest"
"github.com/edgelesssys/contrast/internal/userapi"
"github.com/edgelesssys/contrast/platforms"
"google.golang.org/grpc/codes"
"google.golang.org/grpc/credentials"
"google.golang.org/grpc/peer"
Expand Down Expand Up @@ -167,7 +168,7 @@ func (a *Authority) GetManifests(_ context.Context, _ *userapi.GetManifestsReque
}

var manifests [][]byte
policies := make(map[manifest.HexString][]byte)
policies := make(map[platforms.HexString][]byte)
err := a.walkTransitions(state.latest.TransitionHash, func(_ [history.HashSize]byte, t *history.Transition) error {
manifestBytes, err := a.hist.GetManifest(t.ManifestHash)
if err != nil {
Expand Down
44 changes: 22 additions & 22 deletions coordinator/internal/authority/userapi_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ import (
"github.com/edgelesssys/contrast/coordinator/history"
"github.com/edgelesssys/contrast/internal/manifest"
"github.com/edgelesssys/contrast/internal/userapi"
"github.com/edgelesssys/contrast/node-installer/platforms"
"github.com/edgelesssys/contrast/platforms"
"github.com/prometheus/client_golang/prometheus"
"github.com/spf13/afero"
"github.com/stretchr/testify/assert"
Expand Down Expand Up @@ -76,9 +76,9 @@ func TestManifestSet(t *testing.T) {
"request without policies": {
req: &userapi.SetManifestRequest{
Manifest: newManifestBytes(func(m *manifest.Manifest) {
m.Policies = map[manifest.HexString][]string{
manifest.HexString("a"): {"a1", "a2"},
manifest.HexString("b"): {"b1", "b2"},
m.Policies = map[platforms.HexString][]string{
platforms.HexString("a"): {"a1", "a2"},
platforms.HexString("b"): {"b1", "b2"},
}
}),
},
Expand All @@ -87,9 +87,9 @@ func TestManifestSet(t *testing.T) {
"policy not in manifest": {
req: &userapi.SetManifestRequest{
Manifest: newManifestBytes(func(m *manifest.Manifest) {
m.Policies = map[manifest.HexString][]string{
manifest.HexString("ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb"): {"a1", "a2"},
manifest.HexString("3e23e8160039594a33894f6564e1b1348bbd7a0088d42c4acb73eeaed59c009d"): {"b1", "b2"},
m.Policies = map[platforms.HexString][]string{
platforms.HexString("ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb"): {"a1", "a2"},
platforms.HexString("3e23e8160039594a33894f6564e1b1348bbd7a0088d42c4acb73eeaed59c009d"): {"b1", "b2"},
}
}),
Policies: [][]byte{
Expand All @@ -103,9 +103,9 @@ func TestManifestSet(t *testing.T) {
"valid manifest": {
req: &userapi.SetManifestRequest{
Manifest: newManifestBytes(func(m *manifest.Manifest) {
m.Policies = map[manifest.HexString][]string{
manifest.HexString("ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb"): {"a1", "a2"},
manifest.HexString("3e23e8160039594a33894f6564e1b1348bbd7a0088d42c4acb73eeaed59c009d"): {"b1", "b2"},
m.Policies = map[platforms.HexString][]string{
platforms.HexString("ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb"): {"a1", "a2"},
platforms.HexString("3e23e8160039594a33894f6564e1b1348bbd7a0088d42c4acb73eeaed59c009d"): {"b1", "b2"},
}
}),
Policies: [][]byte{
Expand Down Expand Up @@ -167,9 +167,9 @@ func TestManifestSet(t *testing.T) {

req := &userapi.SetManifestRequest{
Manifest: newManifestBytes(func(m *manifest.Manifest) {
m.Policies = map[manifest.HexString][]string{
manifest.HexString("ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb"): {"a1", "a2"},
manifest.HexString("3e23e8160039594a33894f6564e1b1348bbd7a0088d42c4acb73eeaed59c009d"): {"b1", "b2"},
m.Policies = map[platforms.HexString][]string{
platforms.HexString("ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb"): {"a1", "a2"},
platforms.HexString("3e23e8160039594a33894f6564e1b1348bbd7a0088d42c4acb73eeaed59c009d"): {"b1", "b2"},
}
}),
Policies: [][]byte{
Expand Down Expand Up @@ -226,9 +226,9 @@ func TestGetManifests(t *testing.T) {

m, err := manifest.Default(platforms.AKSCloudHypervisorSNP)
require.NoError(err)
m.Policies = map[manifest.HexString][]string{
manifest.HexString("ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb"): {"a1", "a2"},
manifest.HexString("3e23e8160039594a33894f6564e1b1348bbd7a0088d42c4acb73eeaed59c009d"): {"b1", "b2"},
m.Policies = map[platforms.HexString][]string{
platforms.HexString("ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb"): {"a1", "a2"},
platforms.HexString("3e23e8160039594a33894f6564e1b1348bbd7a0088d42c4acb73eeaed59c009d"): {"b1", "b2"},
}
manifestBytes, err := json.Marshal(m)
require.NoError(err)
Expand Down Expand Up @@ -320,7 +320,7 @@ func TestRecoveryFlow(t *testing.T) {
seedShareOwnerKeyBytes := manifest.MarshalSeedShareOwnerKey(&seedShareOwnerKey.PublicKey)

mnfst, _, policies := newManifest(t)
mnfst.SeedshareOwnerPubKeys = []manifest.HexString{seedShareOwnerKeyBytes}
mnfst.SeedshareOwnerPubKeys = []platforms.HexString{seedShareOwnerKeyBytes}
manifestBytes, err := json.Marshal(mnfst)
require.NoError(err)

Expand Down Expand Up @@ -399,9 +399,9 @@ func TestUserAPIConcurrent(t *testing.T) {

setReq := &userapi.SetManifestRequest{
Manifest: newManifestBytes(func(m *manifest.Manifest) {
m.Policies = map[manifest.HexString][]string{
manifest.HexString("ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb"): {"a1", "a2"},
manifest.HexString("3e23e8160039594a33894f6564e1b1348bbd7a0088d42c4acb73eeaed59c009d"): {"b1", "b2"},
m.Policies = map[platforms.HexString][]string{
platforms.HexString("ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb"): {"a1", "a2"},
platforms.HexString("3e23e8160039594a33894f6564e1b1348bbd7a0088d42c4acb73eeaed59c009d"): {"b1", "b2"},
}
}),
Policies: [][]byte{
Expand Down Expand Up @@ -477,8 +477,8 @@ func manifestWithWorkloadOwnerKey(key *ecdsa.PrivateKey) (*manifest.Manifest, er
return nil, err
}
ownerKeyHash := sha256.Sum256(pubKey)
ownerKeyHex := manifest.NewHexString(ownerKeyHash[:])
m.WorkloadOwnerKeyDigests = []manifest.HexString{ownerKeyHex}
ownerKeyHex := platforms.NewHexString(ownerKeyHash[:])
m.WorkloadOwnerKeyDigests = []platforms.HexString{ownerKeyHex}
return m, nil
}

Expand Down
5 changes: 2 additions & 3 deletions e2e/genpolicy/genpolicy_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -19,8 +19,7 @@ import (
"github.com/edgelesssys/contrast/e2e/internal/contrasttest"
"github.com/edgelesssys/contrast/e2e/internal/kubeclient"
"github.com/edgelesssys/contrast/internal/kuberesource"
"github.com/edgelesssys/contrast/node-installer/platforms"
"github.com/edgelesssys/contrast/node-installer/runtimehandler"
"github.com/edgelesssys/contrast/platforms"
"github.com/stretchr/testify/require"
)

Expand All @@ -36,7 +35,7 @@ func TestGenpolicy(t *testing.T) {

testCases := kuberesource.GenpolicyRegressionTests()

runtimeHandler, err := runtimehandler.Name(platform)
runtimeHandler, err := platforms.RuntimeHandler(platform)
require.NoError(t, err)

for name, deploy := range testCases {
Expand Down
5 changes: 2 additions & 3 deletions e2e/getdents/getdents_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -19,8 +19,7 @@ import (
"github.com/edgelesssys/contrast/e2e/internal/contrasttest"
"github.com/edgelesssys/contrast/e2e/internal/kubeclient"
"github.com/edgelesssys/contrast/internal/kuberesource"
"github.com/edgelesssys/contrast/node-installer/platforms"
"github.com/edgelesssys/contrast/node-installer/runtimehandler"
"github.com/edgelesssys/contrast/platforms"
"github.com/stretchr/testify/require"
)

Expand All @@ -39,7 +38,7 @@ func TestGetDEnts(t *testing.T) {
// TODO(msanft): Make this configurable
platform := platforms.AKSCloudHypervisorSNP

runtimeHandler, err := runtimehandler.Name(platform)
runtimeHandler, err := platforms.RuntimeHandler(platform)
require.NoError(t, err)

resources := kuberesource.GetDEnts()
Expand Down
2 changes: 1 addition & 1 deletion e2e/internal/contrasttest/contrasttest.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ import (
"github.com/edgelesssys/contrast/e2e/internal/kubeclient"
"github.com/edgelesssys/contrast/internal/kubeapi"
"github.com/edgelesssys/contrast/internal/kuberesource"
"github.com/edgelesssys/contrast/node-installer/platforms"
"github.com/edgelesssys/contrast/platforms"
ksync "github.com/katexochen/sync/api/client"
"github.com/spf13/cobra"
"github.com/stretchr/testify/require"
Expand Down
5 changes: 2 additions & 3 deletions e2e/openssl/openssl_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,8 +21,7 @@ import (
"github.com/edgelesssys/contrast/e2e/internal/kubeclient"
"github.com/edgelesssys/contrast/internal/kuberesource"
"github.com/edgelesssys/contrast/internal/manifest"
"github.com/edgelesssys/contrast/node-installer/platforms"
"github.com/edgelesssys/contrast/node-installer/runtimehandler"
"github.com/edgelesssys/contrast/platforms"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
Expand All @@ -48,7 +47,7 @@ func TestOpenSSL(t *testing.T) {
// TODO(msanft): Make this configurable
platform := platforms.AKSCloudHypervisorSNP

runtimeHandler, err := runtimehandler.Name(platform)
runtimeHandler, err := platforms.RuntimeHandler(platform)
require.NoError(t, err)

resources := kuberesource.OpenSSL()
Expand Down
5 changes: 2 additions & 3 deletions e2e/policy/policy_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,8 +21,7 @@ import (
"github.com/edgelesssys/contrast/internal/kubeapi"
"github.com/edgelesssys/contrast/internal/kuberesource"
"github.com/edgelesssys/contrast/internal/manifest"
"github.com/edgelesssys/contrast/node-installer/platforms"
"github.com/edgelesssys/contrast/node-installer/runtimehandler"
"github.com/edgelesssys/contrast/platforms"
"github.com/prometheus/common/expfmt"
"github.com/stretchr/testify/require"
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
Expand All @@ -45,7 +44,7 @@ func TestPolicy(t *testing.T) {
// TODO(msanft): Make this configurable
platform := platforms.AKSCloudHypervisorSNP

runtimeHandler, err := runtimehandler.Name(platform)
runtimeHandler, err := platforms.RuntimeHandler(platform)
require.NoError(t, err)

resources := kuberesource.OpenSSL()
Expand Down
5 changes: 2 additions & 3 deletions e2e/servicemesh/servicemesh_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -20,8 +20,7 @@ import (
"github.com/edgelesssys/contrast/e2e/internal/contrasttest"
"github.com/edgelesssys/contrast/e2e/internal/kubeclient"
"github.com/edgelesssys/contrast/internal/kuberesource"
"github.com/edgelesssys/contrast/node-installer/platforms"
"github.com/edgelesssys/contrast/node-installer/runtimehandler"
"github.com/edgelesssys/contrast/platforms"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
Expand All @@ -38,7 +37,7 @@ func TestIngressEgress(t *testing.T) {
// TODO(msanft): Make this configurable
platform := platforms.AKSCloudHypervisorSNP

runtimeHandler, err := runtimehandler.Name(platform)
runtimeHandler, err := platforms.RuntimeHandler(platform)
require.NoError(t, err)

resources := kuberesource.Emojivoto(kuberesource.ServiceMeshIngressEgress)
Expand Down
Loading

0 comments on commit fcaf780

Please sign in to comment.