Migrations
This document describes breaking changes and migrations between Constellation releases.
Use constellation config migrate
to automatically update an old config file to a new format.
Migrating from Azure's service principal authentication to managed identity authentication
- The
provider.azure.appClientID
andprovider.azure.appClientSecret
fields are no longer supported and should be removed. - To keep using an existing UAMI, add the
Owner
permission with the scope of yourresourceGroup
. - Otherwise, simply create new Constellation IAM credentials and use the created UAMI.
- To migrate the authentication for an existing cluster on Azure to an UAMI with the necessary permissions:
- Remove the
aadClientId
andaadClientSecret
from the azureconfig secret. - Set
useManagedIdentityExtension
totrue
and use theuserAssignedIdentity
from the Constellation config for the value ofuserAssignedIdentityID
. - Restart the CSI driver, cloud controller manager, cluster autoscaler, and Constellation operator pods.
- Remove the
Migrating from CLI versions before 2.10
- AWS cluster upgrades require additional IAM permissions for the newly introduced
aws-load-balancer-controller
. Please upgrade your IAM roles usingiam upgrade apply
. This will show necessary changes and apply them, if desired. - The global
nodeGroups
field was added. - The fields
instanceType
,stateDiskSizeGB
, andstateDiskType
for each cloud provider are now part of the configuration of individual node groups. - The
constellation create
command no longer uses the flags--control-plane-count
and--worker-count
. Instead, the initial node count is configured per node group in thenodeGroups
field.
Migrating from CLI versions before 2.9
- The
provider.azure.appClientID
andprovider.azure.clientSecretValue
fields were removed to enforce migration to managed identity authentication
Migrating from CLI versions before 2.8
- The
measurements
field for each cloud service provider was replaced with a globalattestation
field. - The
confidentialVM
,idKeyDigest
, andenforceIdKeyDigest
fields for the Azure cloud service provider were removed in favor of using the globalattestation
field. - The optional global field
attestationVariant
was replaced by the now requiredattestation
field.
Migrating from CLI versions before 2.3
-
The
sshUsers
field was deprecated in v2.2 and has been removed from the configuration in v2.3. As an alternative for SSH, check the workflow section Connect to nodes. -
The
image
field for each cloud service provider has been replaced with a globalimage
field. Use the following mapping to migrate your configuration:Show all
-
The
enforcedMeasurements
field has been removed and merged with themeasurements
field.-
To migrate your config containing a new image (
v2.3
or greater), remove the oldmeasurements
andenforcedMeasurements
entries from your config and runconstellation fetch-measurements
-
To migrate your config containing an image older than
v2.3
, remove theenforcedMeasurements
entry and replace the entries inmeasurements
as shown in the example below:measurements:
- 0: DzXCFGCNk8em5ornNZtKi+Wg6Z7qkQfs5CfE3qTkOc8=
+ 0:
+ expected: DzXCFGCNk8em5ornNZtKi+Wg6Z7qkQfs5CfE3qTkOc8=
+ warnOnly: true
- 8: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
+ 8:
+ expected: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
+ warnOnly: false
-enforcedMeasurements:
- - 8
-