Skip to content

Commit

Permalink
docs: update Tab tags
Browse files Browse the repository at this point in the history
  • Loading branch information
@thomasten
thomasten committed Aug 23, 2024
1 parent e90b0e5 commit e2ee775
Show file tree
Hide file tree
Showing 197 changed files with 3,640 additions and 3,581 deletions.
40 changes: 20 additions & 20 deletions docs/docs/architecture/attestation.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -121,8 +121,8 @@ Constellation allows to specify in the config which measurements should be enfor
Enforcing non-reproducible measurements controlled by the cloud provider means that changes in these values require manual updates to the cluster's config.
By default, Constellation only enforces measurements that are stable values produced by the infrastructure or by Constellation directly.

<tabs groupId="csp">
<tabItem value="aws" label="AWS">
<Tabs groupId="csp">
<TabItem value="aws" label="AWS">

Constellation uses the [vTPM](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitrotpm.html) (NitroTPM) feature of the [AWS Nitro System](http://aws.amazon.com/ec2/nitro/) on AWS for runtime measurements.

Expand Down Expand Up @@ -153,8 +153,8 @@ The latter means that the value can be generated offline and compared to the one
| 15 | ClusterID | Constellation Bootstrapper | Yes |
| 16&ndash;23 | Unused | - | - |

</tabItem>
<tabItem value="azure" label="Azure">
</TabItem>
<TabItem value="azure" label="Azure">

Constellation uses the [vTPM](https://docs.microsoft.com/en-us/azure/virtual-machines/trusted-launch#vtpm) feature of Azure CVMs for runtime measurements.
This vTPM adheres to the [TPM 2.0](https://trustedcomputinggroup.org/resource/tpm-library-specification/) specification.
Expand Down Expand Up @@ -184,8 +184,8 @@ The latter means that the value can be generated offline and compared to the one
| 15 | ClusterID | Constellation Bootstrapper | Yes |
| 16&ndash;23 | Unused | - | - |

</tabItem>
<tabItem value="gcp" label="GCP">
</TabItem>
<TabItem value="gcp" label="GCP">

Constellation uses the [vTPM](https://cloud.google.com/compute/confidential-vm/docs/about-cvm) feature of CVMs on GCP for runtime measurements.
Note that this vTPM doesn't run inside the hardware-protected CVM context, but is emulated by the hypervisor.
Expand Down Expand Up @@ -217,8 +217,8 @@ The latter means that the value can be generated offline and compared to the one
| 15 | ClusterID | Constellation Bootstrapper | Yes |
| 16&ndash;23 | Unused | - | - |

</tabItem>
<tabItem value="stackit" label="STACKIT">
</TabItem>
<TabItem value="stackit" label="STACKIT">

Constellation uses a hypervisor-based vTPM for runtime measurements.

Expand Down Expand Up @@ -249,16 +249,16 @@ The latter means that the value can be generated offline and compared to the one
| 15 | ClusterID | Constellation Bootstrapper | Yes |
| 16&ndash;23 | Unused | - | - |

</tabItem>
</tabs>
</TabItem>
</Tabs>

### CVM verification

To verify the integrity of the received attestation statement, a chain of trust from the CVM technology to the interface providing the statement has to be established.
For verification of the CVM technology, Constellation may expose additional options in its config file.

<tabs groupId="csp">
<tabItem value="aws" label="AWS">
<Tabs groupId="csp">
<TabItem value="aws" label="AWS">

On AWS, AMD SEV-SNP is used to provide runtime encryption to the VMs.
An SEV-SNP attestation report is used to establish trust in the VM.
Expand All @@ -279,8 +279,8 @@ You may customize certain parameters for verification of the attestation stateme
This is the intermediate certificate for verifying the SEV-SNP report's signature.
If it's not specified, the CLI fetches it from the AMD key distribution server.

</tabItem>
<tabItem value="azure" label="Azure SEV-SNP">
</TabItem>
<TabItem value="azure" label="Azure SEV-SNP">

On Azure, AMD SEV-SNP is used to provide runtime encryption to the VMs.
An SEV-SNP attestation report is used to establish trust in the vTPM running inside the VM.
Expand All @@ -302,8 +302,8 @@ You may customize certain parameters for verification of the attestation stateme
More explicitly, it controls the verification of the `IDKeyDigest` value in the SEV-SNP attestation report.
You can provide a list of accepted key digests and specify a policy on how this list is compared against the reported `IDKeyDigest`.

</tabItem>
<tabItem value="gcp" label="GCP">
</TabItem>
<TabItem value="gcp" label="GCP">

On GCP, AMD SEV-SNP is used to provide runtime encryption to the VMs.
An SEV-SNP attestation report is used to establish trust in the VM.
Expand All @@ -324,15 +324,15 @@ You may customize certain parameters for verification of the attestation stateme
This is the intermediate certificate for verifying the SEV-SNP report's signature.
If it's not specified, the CLI fetches it from the AMD key distribution server.

</tabItem>
<tabItem value="stackit" label="STACKIT">
</TabItem>
<TabItem value="stackit" label="STACKIT">

On STACKIT, AMD SEV-ES is used to provide runtime encryption to the VMs.
The hypervisor-based vTPM is used to establish trust in the VM via [runtime measurements](#runtime-measurements).
There is no additional configuration available for STACKIT.

</tabItem>
</tabs>
</TabItem>
</Tabs>

## Cluster attestation

Expand Down
24 changes: 12 additions & 12 deletions docs/docs/getting-started/first-steps-local.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -45,8 +45,8 @@ sudo iptables -P FORWARD ACCEPT

## Create a cluster

<tabs groupId="csp">
<tabItem value="mini" label="MiniConstellation">
<Tabs groupId="csp">
<TabItem value="mini" label="MiniConstellation">

<!-- vale off -->
With the `constellation mini` command, you can deploy and test Constellation locally. This mode is called MiniConstellation. Conceptually, MiniConstellation is similar to [MicroK8s](https://microk8s.io/), [K3s](https://k3s.io/), and [minikube](https://minikube.sigs.k8s.io/docs/).
Expand Down Expand Up @@ -74,8 +74,8 @@ constellation mini up
This will configure your current directory as the [workspace](../architecture/orchestration.md#workspaces) for this cluster.
All `constellation` commands concerning this cluster need to be issued from this directory.

</tabItem>
<tabItem value="qemu" label="QEMU">
</TabItem>
<TabItem value="qemu" label="QEMU">

With the QEMU provider, you can create a local Constellation cluster as if it were in the cloud. The provider uses [QEMU](https://www.qemu.org/) to create multiple VMs for the cluster nodes, which interact with each other.

Expand Down Expand Up @@ -145,8 +145,8 @@ attaching persistent storage, or autoscaling aren't available.
export KUBECONFIG="$PWD/constellation-admin.conf"
```

</tabItem>
</tabs>
</TabItem>
</Tabs>

## Connect to the cluster

Expand Down Expand Up @@ -199,8 +199,8 @@ worker-0 Ready <none> 32s v1.24.6

## Terminate your cluster

<tabs groupId="csp">
<tabItem value="mini" label="MiniConstellation">
<Tabs groupId="csp">
<TabItem value="mini" label="MiniConstellation">

Once you are done, you can clean up the created resources using the following command:

Expand All @@ -211,8 +211,8 @@ constellation mini down
This will destroy your cluster and clean up your workspace.
The VM image and cluster configuration file (`constellation-conf.yaml`) will be kept and may be reused to create new clusters.

</tabItem>
<tabItem value="qemu" label="QEMU">
</TabItem>
<TabItem value="qemu" label="QEMU">

Once you are done, you can clean up the created resources using the following command:

Expand Down Expand Up @@ -240,8 +240,8 @@ Your Constellation cluster was terminated successfully.
This will destroy your cluster and clean up your workspace.
The VM image and cluster configuration file (`constellation-conf.yaml`) will be kept and may be reused to create new clusters.

</tabItem>
</tabs>
</TabItem>
</Tabs>

## Troubleshooting

Expand Down
40 changes: 20 additions & 20 deletions docs/docs/getting-started/first-steps.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,41 +15,41 @@ If you encounter any problem with the following steps, make sure to use the [lat

1. Create the [configuration file](../workflows/config.md) and state file for your cloud provider. If you are following the steps of this guide, there is no need to edit the file.

<tabs groupId="csp">
<tabItem value="aws" label="AWS">
<Tabs groupId="csp">
<TabItem value="aws" label="AWS">

```bash
constellation config generate aws
```

</tabItem>
<tabItem value="azure" label="Azure">
</TabItem>
<TabItem value="azure" label="Azure">

```bash
constellation config generate azure
```

</tabItem>
<tabItem value="gcp" label="GCP">
</TabItem>
<TabItem value="gcp" label="GCP">

```bash
constellation config generate gcp
```

</tabItem>
<tabItem value="stackit" label="STACKIT">
</TabItem>
<TabItem value="stackit" label="STACKIT">

```bash
constellation config generate stackit
```

</tabItem>
</tabs>
</TabItem>
</Tabs>

2. Create your [IAM configuration](../workflows/config.md#creating-an-iam-configuration).

<tabs groupId="csp">
<tabItem value="aws" label="AWS">
<Tabs groupId="csp">
<TabItem value="aws" label="AWS">

```bash
constellation iam create aws --zone=us-east-2a --prefix=constellTest --update-config
Expand All @@ -76,8 +76,8 @@ If you encounter any problem with the following steps, make sure to use the [lat
You can find a list of all [regions in AWS's documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html#concepts-available-regions).

</tabItem>
<tabItem value="azure" label="Azure">
</TabItem>
<TabItem value="azure" label="Azure">

```bash
constellation iam create azure --region=westus --resourceGroup=constellTest --servicePrincipal=spTest --update-config
Expand All @@ -98,8 +98,8 @@ If you encounter any problem with the following steps, make sure to use the [lat

You can find a list of all [regions in Azure's documentation](https://azure.microsoft.com/en-us/global-infrastructure/services/?products=virtual-machines&regions=all).
</tabItem>
<tabItem value="gcp" label="GCP">
</TabItem>
<TabItem value="gcp" label="GCP">
```bash
constellation iam create gcp --projectID=yourproject-12345 --zone=europe-west2-a --serviceAccountID=constell-test --update-config
Expand All @@ -109,16 +109,16 @@ If you encounter any problem with the following steps, make sure to use the [lat
Note that only regions offering CVMs of the `C2D` or `N2D` series are supported. You can find a [list of all regions in Google's documentation](https://cloud.google.com/compute/docs/regions-zones#available), which you can filter by machine type `C2D` or `N2D`.

</tabItem>
<tabItem value="stackit" label="STACKIT">
</TabItem>
<TabItem value="stackit" label="STACKIT">

To use Constellation on STACKIT, the cluster will use the User Access Token (UAT) that's generated [during the install step](./install.md).
After creating the accounts, fill in the STACKIT details in `constellation-conf.yaml` under `provider.openstack`:
* `stackitProjectID`: STACKIT project id (can be found after login on the [STACKIT portal](https://portal.stackit.cloud))
</tabItem>
</tabs>
</TabItem>
</Tabs>
:::tip
To learn about all options you have for managing IAM resources and Constellation configuration, see the [Configuration workflow](../workflows/config.md).
Expand Down
Loading

0 comments on commit e2ee775

Please sign in to comment.