* feat: Add Confidential Containers attestation agent as an alternative attestation backend with new proto definitions and build system integration.
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* fix: Update protoc-gen-go and protoc-gen-go-grpc versions in CI workflow
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* feat: Add mock implementation for AttestationAgentServiceClient and corresponding tests
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* fix: Add missing periods to test function comments in provider_test.go
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
---------
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Add vtpm attestation support to agent service and server
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Update mockery version to v2.53.2 and refactor VM factory to include logger
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Send event notification when computation is stopped in agentService
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Remove redundant assignment of Stderr in qemuVM Start method
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* Rename SVM references to CVM in tracing, logging, metrics, and service layers
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
---------
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* manager, cli and agent vtpm support
* rebase and changed atls for vtpm
* deleted unused code
* changed chekproto.yaml script so it find the manager proto file correctly
* fixe manager proto version
* fix agent tests
* fix server agent test
* fix attestation test
* fix attestation test gofumpt
* created dummy RWC for TPM
* fix comment
* add default PCR values
* rebase main
* fix rust ci and missing header
* changed embedded attestation to VMPL 2
* fix unused impot
* fix pkg test
* address attestation type
* fix agent attestation test
* add prc15 check
* fix comments
* fix cli tests
* add doc
* add mock for LeveledQuoteProvider when SEV-SNP device is not found
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* fix manager reading attestation policy
* refactor PCR value checks and update attestation policy values
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
* fix tests for sev and grpc
---------
Signed-off-by: Sammy Oina <sammyoina@gmail.com>
Co-authored-by: Sammy Oina <sammyoina@gmail.com>
* add handler
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Refactor gRPC and Protobuf integration for manager service
- Shifted Protobuf message definitions to a separate package `pkg/manager`.
- Updated references throughout the codebase to import and use the new package for gRPC service definitions.
- Enhanced AgentLog message with additional fields `level` and `timestamp`.
- Removed direct dependencies on old Protobuf-generated types in favor of the new package.
- Deleted obsolete Protobuf-generated files as they are now superseded by the new `pkg/manager`.
- Streamlined event publishing and gRPC handling in the manager service to use the updated Protobuf messages.
This refactoring improves modularity by centralizing Protobuf message definitions and decouples internal representation from the gRPC interface, aligning with best practices for microservice architecture. Additionally, the enriched logging structure paves the way for more detailed and fine-grained log analysis.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Refactor vsock event/log handling and config
Streamlined event and log services in the manager by moving vsock listening functions out of `managerService` initialization and into dedicated `RetrieveAgentEventsLogs` methods. This change decouples the manager service creation from the actual start of log listening, adding clarity and flexibility in service management. Also moved logging middleware invocation outside of network handling loops to avoid unnecessary overhead.
Additionally, the agent's vsock port configuration is now dynamically passed to the `New` function in the `events` package instead of relying on a hardcoded constant, allowing for greater configurability and testability.
Finally, updated message structures for event and log sending to conform with the `ClientStreamMessage` definitions. These modifications should improve parsing and handling consistency and prepare our system for future enhancements related to inter-process communication.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* fix linting errors
Signed-off-by: SammyOina <sammyoina@gmail.com>
* correct path to generated files
Signed-off-by: SammyOina <sammyoina@gmail.com>
* fix comments
Signed-off-by: SammyOina <sammyoina@gmail.com>
* remove uneccessary comments
Signed-off-by: SammyOina <sammyoina@gmail.com>
---------
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Refactor GRPC manager service and client
The manager service and client have been restructured for stream communication, facilitating real-time agent events, logs, and run responses. The `Run` RPC is replaced by the `Process` stream RPC, enabling bidirectional streaming between clients and the manager service. This allows continuous interchange of different message types including `WhoAmIRequest`, `AgentLog`, `AgentEvent`, and `RunResponse`.
Several message types have been adjusted and new fields introduced, like `AgentPort` in `RunResponse` and various agent-config attributes including CA files and instance IDs, to support TLS client authentication and distinguish between agent instances.
We've also incorporated `google.protobuf.Timestamp` in `AgentEvent` for precise event logging. The client code reflects these modifications with updated method calls and stream handling logic for ongoing communication. Moreover, the updates necessitate corresponding changes throughout service, grpc, and sdk layers to interoperate with the new streaming approach.
The transition to streaming paves the way for a more interactive, flexible communication system that can accommodate future expansion and real-time monitoring features.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* fix lint
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Update GitHub Actions to Latest Versions
Upgraded GitHub Actions 'checkout' to version 4 and 'setup-go' to version 5 across various workflow files to leverage the latest features and improvements for better performance and reliability. This also ensures compatibility with Go version 1.21.x which is specified in the workflows.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Refactor event handling and logging
Reworked event and log processing to use channels instead of direct HTTP calls. Removed obsolete events package and consolidated event structures, leading to cleaner and more maintainable code. Updated agent events to use channels, enhanced error handling in log forwarding, and simplified manager `New` function signature to accept an event channel directly.
- Removed `events` and `agentevents` packages to reduce complexity.
- Replaced direct event server communication with internal channel usage.
- Introduced `AgentEvent` struct in events.go for standardized event objects.
- Adapted `managerService` to dispatch events and logs through channels.
- Streamlined manager construction by removing the now-unnecessary event service and host IP parameters.
This change results in a more robust and easier to extend event and log management system within the agent-manager interaction.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* fix ci
Signed-off-by: SammyOina <sammyoina@gmail.com>
* remove unused code
Signed-off-by: SammyOina <sammyoina@gmail.com>
* add comments
Signed-off-by: SammyOina <sammyoina@gmail.com>
---------
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Add gRPC TLS config and update protoc versions
Enhanced manager service with TLS configuration options and timeout settings for gRPC communication with agent services. Updated corresponding protobuf definitions to include new fields for CA certificates, TLS status, and timeouts. The added TLS support ensures secure inter-service communication while flexible timeout configurations improve the robustness of network interactions.
The following adjustments and additions were made:
- Included new gRPC configuration fields (ca_certs, client_tls, timeout) for agent communication in protobuf definitions.
- Injected agent gRPC configuration into service endpoints, ensuring secure TLS setup and compliance with provided settings.
- Revised main service function signatures to accept the gRPC configuration object.
- Incremented port forwarding counters post-computation to avoid port conflicts.
- Conducted compatibility update of protobuf version comments to reflect minor version bump (v4.25.0 to v4.25.1).
This change impacts service deployment that requires proper configuration of TLS credentials and mindful determination of timeouts for efficient network use.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* update proto
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Set default timeout for agent configuration
Introduced a default timeout of 60 seconds in both gRPC and HTTP endpoints for agent configuration when none is specified. This change ensures that operations do not hang indefinitely and provides a reasonable default for client interactions. Additionally, the instantiation of a new agent client is now outside the retry loop to avoid repeated setup on transient failures.
Refactors service logic to optimize client connection handling by moving the agent client setup to occur before attempting retries, which should reduce overhead and improve clarity in error situations.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Subject: Move agent client creation into retry loop
Body:
Refactored the service manager's Run method to initialize the agent gRPC client inside the exponential backoff retry loop. This change addresses intermittent connection issues by reattempting client creation on temporary network failures, ensuring a robust setup before calling the Run method on the client.
Signed-off-by: SammyOina <sammyoina@gmail.com>
---------
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Fix bug in agent service and state
The commit fixes a bug in the agent service and state files.
Previously, the condition to check the state in the agent service
was incorrect. It was checking the state directly instead of
using the GetState() method. This has been fixed by using the
GetState() method to check the state.
Additionally, a new GetState() method has been added to the
StateMachine struct in the state file. This method retrieves
the current state by acquiring a lock and returning the state
value.
The changes have been tested and verified to resolve the bug
and improve the accuracy of state checking in the agent service.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Fix bug in agent state machine
The bug in the agent state machine caused an error when attempting an invalid transition. This commit fixes the bug by properly locking and unlocking the state machine before and after transitioning to the next state. Additionally, the logger now correctly logs the current and next state during a valid transition.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Fix race condition in state machine
The commit fixes a race condition in the state machine implementation in the `Start` method. The race condition occurs when multiple goroutines try to access and modify the state concurrently. To fix this, a mutex lock and unlock are added around the critical sections of code to ensure exclusive access to the state variable. This prevents race conditions and ensures the state transitions are executed correctly.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Fix race condition in StateMachine.Start()
The StateMachine.Start() method was experiencing a race condition
when multiple events were being processed concurrently. This was
caused by not properly locking and unlocking the state machine
before and after updating the state. This commit fixes the issue
by adding proper locking and unlocking around the state update
operation. Additionally, the logging statement has been updated
to include the previous and next states for better debugging.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* add magistrala dep
Signed-off-by: SammyOina <sammyoina@gmail.com>
* remove mainflux
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Add Docker environment variables for Nats, RabbitMQ, Message Broker, and Jaeger.
The commit message should be:
"Add Docker environment variables for Nats, RabbitMQ, Message Broker, and Jaeger"
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Fix Makefile to properly set DOCKER_PROJECT and COCOS_MESSAGE_BROKER_TYPE
The Makefile has been updated to fix an issue with setting the DOCKER_PROJECT and COCOS_MESSAGE_BROKER_TYPE variables. The USER_REPO variable is now used to generate the DOCKER_PROJECT name following the Docker Compose guidelines. Additionally, the COCOS_MESSAGE_BROKER_TYPE variable is now properly set to "nats" if it is empty. This ensures that the correct values are used when compiling and installing the service.
Summary:
Fix Makefile to properly set DOCKER_PROJECT and COCOS_MESSAGE_BROKER_TYPE
Details:
- Update USER_REPO variable to generate DOCKER_PROJECT name
- Set COCOS_MESSAGE_BROKER_TYPE to "nats" if empty
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Fix notification topic in agent service and update NATS ports in Docker environment variables
The agent service's notification topic was incorrectly set to "channels.manager" instead of "agent". This commit fixes the issue by updating the notification topic.
Additionally, the NATS ports in the Docker environment variables were incorrect. The COCOS_NATS_PORT and COCOS_NATS_HTTP_PORT have been updated to the correct values.
These changes ensure that the agent service uses the correct notification topic and the NATS ports are properly configured.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Add Dockerfiles for production and development environments
This commit adds two new Dockerfiles, one for the production environment and one for the development environment. The production Dockerfile sets up the necessary dependencies and builds the application, while the development Dockerfile simply copies the built application. Both Dockerfiles include the necessary SSL certificates for the application to work properly.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Refactor Makefile and add new targets for building Docker images
The Makefile has been refactored to include new targets for building Docker images. The `make_docker` and `make_docker_dev` functions have been defined to handle the Docker build process. The `dockers` and `dockers_dev` targets have been added to build the Docker images for all services and development environments respectively.
This commit introduces changes to the Makefile to improve the build process and provide support for Docker images.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Fix makefile to generate Docker images for services
- Added DOCKERS and DOCKERS_DEV variables to generate Docker images for services
- Updated the dockers target to include DOCKERS
- Updated the dockers_dev target to include DOCKERS_DEV
- Updated the $(DOCKERS) and $(DOCKERS_DEV) targets to call the respective make_docker and make_docker_dev functions
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Refactor Makefile and Dockerfile
The Makefile has been refactored to remove unnecessary sed commands and improve code readability. The changes include:
- Removed sed commands related to changing the broker in docker-compose.yml for nats and rabbitmq profiles.
- Removed the eer target from the Makefile.
The Dockerfile has been modified to include the WORKDIR directive.
These changes improve the maintainability and readability of the codebase.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Fix NATS URL in .env file and add Manager configuration in docker-compose.yml
The NATS URL in the .env file was updated to use the correct hostname for the broker. Additionally, the Manager configuration was added to the docker-compose.yml file.
This commit fixes the NATS URL in the .env file and adds the necessary Manager configuration to the docker-compose.yml file.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Fix incorrect host and port values in Makefile and .env
The commit updates the host and port values in the Makefile and .env files to fix incorrect values. The host and port values are updated to "cocos-manager" and "7003" respectively. This ensures that the correct host and port are used for the Manager HTTP and gRPC services.
This commit resolves the issue with the incorrect host and port values and ensures that the Manager services are configured correctly.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Fix Dockerfile and docker-compose.yml configurations
The Dockerfile and docker-compose.yml configurations have been fixed to address the following issues:
- Removed unnecessary COPY commands in the Dockerfile.
- Removed the "privileged" flag in the docker-compose.yml file.
These changes ensure that the Docker image is built correctly and the container is launched with the appropriate configurations.
Signed-off-by: SammyOina <sammyoina@gmail.com>
* remove manual assignment
Signed-off-by: SammyOina <sammyoina@gmail.com>
* update protoc CI
Signed-off-by: SammyOina <sammyoina@gmail.com>
* add paths
Signed-off-by: SammyOina <sammyoina@gmail.com>
* remove profiles
Signed-off-by: SammyOina <sammyoina@gmail.com>
* restore default config
Signed-off-by: SammyOina <sammyoina@gmail.com>
* Fix Docker project name in Makefile
Signed-off-by: SammyOina <sammyoina@gmail.com>
---------
Signed-off-by: SammyOina <sammyoina@gmail.com>
Sammy Kerata Oina
Danko Miladinovic
Darko Draskovic
rodneyosodo