edgelesssys / contrast

Deploy and manage confidential containers on Kubernetes
https://docs.edgeless.systems/contrast
GNU Affero General Public License v3.0
161 stars 6 forks source link

coordinator: rotate certs in authority #521

Closed burgerdev closed 3 weeks ago

burgerdev commented 4 weeks ago

This PR adds a SeedEngine instance to the Authority and moves certificate rotation out of the CA object, which is now an instance dedicated to a single manifest generation. For now the SeedEngine is initialized with ad-hoc random bytes and the mesh key is created at random, which should yield the same observable behaviour as before this change. After switching to history we can use LatestTransition to seed the mesh key, and later on we can recover from an input seed.