Attestation & Identity & Global Unlock & Enrolment
This changes the node startup sequence significantly. Now the following three startup procedures replace the old setup/join mechanic:
* If no enrolment config is present, automatically bootstrap a new cluster and become master for it.
* If an enrolment config with an enrolment token is present, register with the NodeManagementService.
* If an enrolment config without an enrolment token is present, attempt a normal cluster unlock.
It also completely revamps the GRPC management services:
* NodeManagementService is a master-only service that deals with other nodes and has a cluster-wide identity
* NodeService is only available in unlocked state and keyed with the node identity
* ClusterManagement is now a master-only service that's been spun out of the main NMS since they have very different authentication models and also deals with EnrolmentConfigs
The TPM support library has also been extended by:
* Lots of integrity attestation and verification functions
* Built-in AK management
* Some advanced policy-based authentication stuff
Also contains various enhancements to the network service to make everything work in a proper multi-node environment.
Lots of old code has been thrown out.
Test Plan: Passed a full manual test of all three startup modes (bootstrap, enrolment and normal unlock) including automated EnrolmentConfig generation and consumption in a dual-node configuration on swtpm / OVMF.
Bug: T499
X-Origin-Diff: phab/D291
GitOrigin-RevId: d53755c828218b1df83a1d7ad252c7b3231abca8
diff --git a/core/internal/common/setup.go b/core/internal/common/setup.go
index 1124d27..e745e54 100644
--- a/core/internal/common/setup.go
+++ b/core/internal/common/setup.go
@@ -16,27 +16,23 @@
package common
-import "git.monogon.dev/source/nexantic.git/core/generated/api"
-
-// TODO(leo): merge api and node packages and get rid of this extra layer of indirection?
-
type (
- SetupService interface {
- CurrentState() SmalltownState
- GetJoinClusterToken() string
- SetupNewCluster() error
- EnterJoinClusterMode() error
- JoinCluster(initialCluster string, certs *api.ConsensusCertificates) error
- }
-
SmalltownState string
)
const (
- // Node is unprovisioned and waits for Setup to be called.
- StateSetupMode SmalltownState = "setup"
- // Setup() has been called, node waits for a JoinCluster or BootstrapCluster call.
- StateClusterJoinMode SmalltownState = "join"
+ // These are here to prevent depdendency loops
+ NodeServicePort = 7835
+ ConsensusPort = 7834
+ MasterServicePort = 7833
+ ExternalServicePort = 7836
+)
+
+const (
+ // Node is provisioning a new cluster with itself as a master
+ StateNewClusterMode SmalltownState = "setup"
+ // Node is enrolling itself and waiting to be adopted
+ StateEnrollMode SmalltownState = "join"
// Node is fully provisioned.
- StateConfigured SmalltownState = "configured"
+ StateJoined SmalltownState = "enrolled"
)