Skip to content

Commit be1436b

Browse files
Jakob-NauckeJakob-Naucke
authored
Merge pull request #172 from yairpod/update_fedora_43
Update Container images to fedora 43
2 parents e103e68 + 5687211 commit be1436b

14 files changed

Lines changed: 80 additions & 90 deletions

File tree

‎.github/workflows/lint.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ concurrency:
2222
env:
2323
CARGO_TERM_COLOR: always
2424
# Pinned toolchain for linting
25-
ACTIONS_LINTS_TOOLCHAIN: 1.85.0
25+
ACTIONS_LINTS_TOOLCHAIN: 1.88.0
2626

2727
jobs:
2828
linting:

‎Cargo.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ resolver = "3"
99

1010
[workspace.package]
1111
edition = "2024"
12-
rust-version = "1.85"
12+
rust-version = "1.88"
1313

1414
[workspace.dependencies]
1515
anyhow = "1.0.100"

‎Containerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55

66
ARG build_type
77
# Dependency build stage
8-
FROM ghcr.io/trusted-execution-clusters/buildroot AS builder
8+
FROM ghcr.io/trusted-execution-clusters/buildroot:fedora AS builder
99
ARG build_type
1010
WORKDIR /build
1111

@@ -31,6 +31,6 @@ COPY operator/src operator/src
3131
RUN cargo build -p operator $(if [ "$build_type" = release ]; then echo --release; fi)
3232

3333
# Distribution stage
34-
FROM quay.io/fedora/fedora:42
34+
FROM quay.io/fedora/fedora:43
3535
ARG build_type
3636
COPY --from=builder "/build/target/$build_type/operator" /usr/bin

‎attestation-key-register/Containerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
# SPDX-License-Identifier: CC0-1.0
44

55
ARG build_type
6-
FROM ghcr.io/trusted-execution-clusters/buildroot AS builder
6+
FROM ghcr.io/trusted-execution-clusters/buildroot:fedora AS builder
77
ARG build_type
88
WORKDIR /build
99

@@ -26,7 +26,7 @@ RUN sed -i 's/members =.*/members = ["lib", "attestation-key-register"]/' Cargo.
2626
COPY attestation-key-register/src attestation-key-register/src
2727
RUN cargo build -p attestation-key-register $(if [ "$build_type" = release ]; then echo --release; fi)
2828

29-
FROM quay.io/fedora/fedora:42
29+
FROM quay.io/fedora/fedora:43
3030
ARG build_type
3131
COPY --from=builder "/build/target/$build_type/attestation-key-register" /usr/bin
3232
EXPOSE 8001

‎attestation-key-register/src/main.rs‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ async fn handle_registration(
4242
client: Client,
4343
addr: Option<SocketAddr>,
4444
) -> Result<impl warp::Reply, Infallible> {
45-
info!("Received registration request: {:?}", registration);
45+
info!("Received registration request: {registration:?}");
4646

4747
let api: Api<AttestationKey> = Api::default_namespaced(client);
4848

@@ -52,8 +52,7 @@ async fn handle_registration(
5252
if key.spec.public_key == registration.public_key {
5353
let existing_name = key.metadata.name.unwrap_or_default();
5454
error!(
55-
"Duplicate public key detected: already exists in AttestationKey '{}'",
56-
existing_name
55+
"Duplicate public key detected: already exists in AttestationKey '{existing_name}'"
5756
);
5857
return Ok(reply::with_status(
5958
reply::json(&serde_json::json!({
@@ -66,11 +65,11 @@ async fn handle_registration(
6665
}
6766
}
6867
Err(e) => {
69-
error!("Failed to list AttestationKeys: {}", e);
68+
error!("Failed to list AttestationKeys: {e}");
7069
return Ok(reply::with_status(
7170
reply::json(&serde_json::json!({
7271
"status": "error",
73-
"message": format!("Failed to check for existing keys: {}", e),
72+
"message": format!("Failed to check for existing keys: {e}"),
7473
})),
7574
StatusCode::INTERNAL_SERVER_ERROR,
7675
));
@@ -108,11 +107,11 @@ async fn handle_registration(
108107
))
109108
}
110109
Err(e) => {
111-
error!("Failed to create AttestationKey: {}", e);
110+
error!("Failed to create AttestationKey: {e}");
112111
Ok(reply::with_status(
113112
reply::json(&serde_json::json!({
114113
"status": "error",
115-
"message": format!("Failed to create AttestationKey: {}", e),
114+
"message": format!("Failed to create AttestationKey: {e}"),
116115
})),
117116
StatusCode::INTERNAL_SERVER_ERROR,
118117
))
@@ -147,7 +146,7 @@ async fn main() -> anyhow::Result<()> {
147146
.and_then(handle_registration);
148147

149148
let addr = SocketAddr::from(([0, 0, 0, 0], args.port));
150-
info!("Listening on {}", addr);
149+
info!("Listening on {addr}");
151150

152151
warp::serve(register).run(addr).await;
153152

‎compute-pcrs/Containerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
# SPDX-License-Identifier: CC0-1.0
55

66
ARG build_type
7-
FROM ghcr.io/trusted-execution-clusters/buildroot AS builder
7+
FROM ghcr.io/trusted-execution-clusters/buildroot:fedora AS builder
88
ARG build_type
99
WORKDIR /build
1010

@@ -28,7 +28,7 @@ RUN sed -i 's/members =.*/members = ["compute-pcrs", "lib"]/' Cargo.toml && \
2828
COPY compute-pcrs/src compute-pcrs/src
2929
RUN cargo build -p compute-pcrs $(if [ "$build_type" = release ]; then echo --release; fi)
3030

31-
FROM quay.io/fedora/fedora:42
31+
FROM quay.io/fedora/fedora:43
3232
ARG build_type
3333
COPY --from=builder "/build/target/$build_type/compute-pcrs" /usr/bin
3434
COPY --from=builder /build/reference-values /reference-values

‎operator/src/attestation_key_register.rs‎

Lines changed: 12 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -133,13 +133,13 @@ async fn ak_reconcile(
133133
client: Arc<Client>,
134134
) -> Result<Action, ControllerError> {
135135
let ak_name = ak.metadata.name.clone().unwrap_or_default();
136-
info!("Attestation Key reconciliation for: {}", ak_name);
136+
info!("Attestation Key reconciliation for: {ak_name}");
137137

138138
let client = Arc::unwrap_or_clone(client);
139139
let machines: Api<Machine> = Api::default_namespaced(client.clone());
140140
let lp = ListParams::default();
141141
let machine_list: ObjectList<Machine> = machines.list(&lp).await.map_err(|e| {
142-
eprintln!("Error fetching machine list: {}", e);
142+
eprintln!("Error fetching machine list: {e}");
143143
ControllerError::Anyhow(e.into())
144144
})?;
145145
for machine in &machine_list.items {
@@ -180,15 +180,15 @@ async fn machine_reconcile(
180180
let aks: Api<AttestationKey> = Api::default_namespaced(client.clone());
181181
let lp = ListParams::default();
182182
let ak_list: ObjectList<AttestationKey> = aks.list(&lp).await.map_err(|e| {
183-
eprintln!("Error fetching attestation key list: {}", e);
183+
eprintln!("Error fetching attestation key list: {e}");
184184
ControllerError::Anyhow(e.into())
185185
})?;
186186
for ak in ak_list.items {
187-
if let Some(ak_address) = &ak.spec.address {
188-
if *ak_address == machine_address {
189-
approve_ak(&ak, &machine, client.clone()).await?;
190-
return Ok(Action::await_change());
191-
}
187+
if let Some(ak_address) = &ak.spec.address
188+
&& *ak_address == machine_address
189+
{
190+
approve_ak(&ak, &machine, client.clone()).await?;
191+
return Ok(Action::await_change());
192192
}
193193
}
194194
Ok(Action::await_change())
@@ -313,10 +313,7 @@ async fn secret_reconcile(
313313
return Ok(Action::await_change());
314314
}
315315

316-
info!(
317-
"Secret reconciliation for AttestationKey secret: {}",
318-
secret_name
319-
);
316+
info!("Secret reconciliation for AttestationKey secret: {secret_name}");
320317

321318
let secrets: Api<Secret> = Api::default_namespaced(Arc::unwrap_or_clone(client.clone()));
322319
finalizer(&secrets, ATTESTATION_KEY_SECRET_FINALIZER, secret, |ev| async move {
@@ -328,15 +325,14 @@ async fn secret_reconcile(
328325
.await
329326
.map(|_| Action::await_change())
330327
.map_err(|e| {
331-
eprintln!("Error updating attestation key volumes on secret apply: {}", e);
328+
eprintln!("Error updating attestation key volumes on secret apply: {e}");
332329
finalizer::Error::<ControllerError>::ApplyFailed(e.into())
333330
})
334331
}
335332
Event::Cleanup(secret) => {
336333
let secret_name = secret.metadata.name.clone().unwrap_or_default();
337334
info!(
338-
"AttestationKey secret {} is being deleted, updating trustee deployment volumes",
339-
secret_name
335+
"AttestationKey secret {secret_name} is being deleted, updating trustee deployment volumes"
340336
);
341337
let client = Arc::unwrap_or_clone(client);
342338
// Update trustee deployment - secrets with deletion_timestamp will be filtered out
@@ -345,8 +341,7 @@ async fn secret_reconcile(
345341
.map(|_| Action::await_change())
346342
.map_err(|e| {
347343
eprintln!(
348-
"Error updating attestation key volumes during secret deletion: {}",
349-
e
344+
"Error updating attestation key volumes during secret deletion: {e}"
350345
);
351346
finalizer::Error::<ControllerError>::CleanupFailed(e.into())
352347
})

‎operator/src/reference_values.rs‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -297,13 +297,13 @@ pub async fn handle_new_image(
297297
let config_maps: Api<ConfigMap> = Api::default_namespaced(ctx.client.clone());
298298
let mut image_pcrs_map = config_maps.get(PCR_CONFIG_MAP).await?;
299299
let mut image_pcrs = get_image_pcrs(image_pcrs_map.clone())?;
300-
if let Some(pcr) = image_pcrs.0.get(resource_name) {
301-
if pcr.reference == boot_image {
302-
info!("Image {boot_image} was to be allowed, but already was allowed");
303-
return trustee::update_reference_values(ctx)
304-
.await
305-
.map(|_| COMMITTED_REASON);
306-
}
300+
if let Some(pcr) = image_pcrs.0.get(resource_name)
301+
&& pcr.reference == boot_image
302+
{
303+
info!("Image {boot_image} was to be allowed, but already was allowed");
304+
return trustee::update_reference_values(ctx)
305+
.await
306+
.map(|_| COMMITTED_REASON);
307307
}
308308
let image_ref: oci_client::Reference = boot_image.parse()?;
309309
if image_ref.digest().is_none() {

‎operator/src/trustee.rs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -256,7 +256,7 @@ pub async fn update_attestation_keys(client: Client) -> Result<()> {
256256
name: secret_name.to_string(),
257257
items: Some(vec![KeyToPath {
258258
key: "public_key".to_string(),
259-
path: format!("{}.pub", secret_name),
259+
path: format!("{secret_name}.pub"),
260260
..Default::default()
261261
}]),
262262
..Default::default()

‎register-server/Containerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
# SPDX-License-Identifier: CC0-1.0
44

55
ARG build_type
6-
FROM ghcr.io/trusted-execution-clusters/buildroot AS builder
6+
FROM ghcr.io/trusted-execution-clusters/buildroot:fedora AS builder
77
ARG build_type
88
WORKDIR /build
99

@@ -27,7 +27,7 @@ RUN sed -i 's/members =.*/members = ["lib", "register-server"]/' Cargo.toml && \
2727
COPY register-server/src register-server/src
2828
RUN cargo build -p register-server $(if [ "$build_type" = release ]; then echo --release; fi)
2929

30-
FROM quay.io/fedora/fedora:42
30+
FROM quay.io/fedora/fedora:43
3131
ARG build_type
3232
COPY --from=builder "/build/target/$build_type/register-server" /usr/bin
3333
EXPOSE 3030

0 commit comments

Comments
 (0)