Skip to main content
Version: 2.16

Installation and setup

Constellation runs entirely in your cloud environment and can be controlled via a dedicated command-line interface (CLI) or a Terraform provider.

Prerequisites

Make sure the following requirements are met:

  • Your machine is running Linux or macOS
  • You have admin rights on your machine
  • kubectl is installed
  • Your CSP is Microsoft Azure, Google Cloud Platform (GCP), Amazon Web Services (AWS), or STACKIT

Install the Constellation CLI

tip

If you prefer to use Terraform, you can alternatively use the Terraform provider to manage the cluster's lifecycle.

The CLI executable is available at GitHub. Install it with the following commands:

  1. Download the CLI:
curl -LO https://github.com/edgelesssys/constellation/releases/latest/download/constellation-linux-amd64
  1. Verify the signature (optional)

  2. Install the CLI to your PATH:

sudo install constellation-linux-amd64 /usr/local/bin/constellation
tip

The CLI supports autocompletion for various shells. To set it up, run constellation completion and follow the given steps.

Set up cloud credentials

Constellation makes authenticated calls to the CSP API. Therefore, you need to set up Constellation with the credentials for your CSP.

tip

If you don't have a cloud subscription, you can also set up a local Constellation cluster using virtualization for testing.

Required permissions

The following resource providers need to be registered in your subscription:

  • Microsoft.Attestation [2]
  • Microsoft.Compute
  • Microsoft.Insights
  • Microsoft.ManagedIdentity
  • Microsoft.Network

By default, Constellation tries to register these automatically if they haven't been registered before.

To create the IAM configuration for Constellation, you need the following permissions:

  • */register/action [1]
  • Microsoft.Authorization/roleAssignments/*
  • Microsoft.Authorization/roleDefinitions/*
  • Microsoft.ManagedIdentity/userAssignedIdentities/*
  • Microsoft.Resources/subscriptions/resourcegroups/*

The built-in Owner role is a superset of these permissions.

To create a Constellation cluster, you need the following permissions:

  • Microsoft.Attestation/attestationProviders/* [2]
  • Microsoft.Compute/virtualMachineScaleSets/*
  • Microsoft.Insights/components/*
  • Microsoft.ManagedIdentity/userAssignedIdentities/*
  • Microsoft.Network/loadBalancers/*
  • Microsoft.Network/loadBalancers/backendAddressPools/*
  • Microsoft.Network/networkSecurityGroups/*
  • Microsoft.Network/publicIPAddresses/*
  • Microsoft.Network/virtualNetworks/*
  • Microsoft.Network/virtualNetworks/subnets/*
  • Microsoft.Network/natGateways/*

The built-in Contributor role is a superset of these permissions.

Follow Microsoft's guide on understanding and assigning roles.

1: You can omit */register/Action if the resource providers mentioned above are already registered and the ARM_SKIP_PROVIDER_REGISTRATION environment variable is set to true when creating the IAM configuration.

2: You can omit Microsoft.Attestation/attestationProviders/* and the registration of Microsoft.Attestation if EnforceIDKeyDigest isn't set to MAAFallback in the config file.

Authentication

You need to authenticate with your CSP. The following lists the required steps for testing and production environments.

note

The steps for a testing environment are simpler. However, they may expose secrets to the CSP. If in doubt, follow the production steps.

Testing

Simply open the Azure Cloud Shell.

Production

Use the latest version of the Azure CLI on a trusted machine:

az login

Other options are described in Azure's authentication guide.

Next steps

You are now ready to deploy your first confidential Kubernetes cluster and application.