cli: expose internalLoadBalancer in config

cli/internal/cloudcmd/tfvars.go

@@ -103,6 +103,7 @@ func awsTerraformVars(conf *config.Config, imageRef string) *terraform.AWSCluste
 		Debug:                  conf.IsDebugCluster(),
 		EnableSNP:              conf.GetAttestationConfig().GetVariant().Equal(variant.AWSSEVSNP{}),
 		CustomEndpoint:         conf.CustomEndpoint,
+		InternalLoadBalancer:   conf.InternalLoadBalancer,
 	}
 }
 
@@ -143,6 +144,7 @@ func azureTerraformVars(conf *config.Config, imageRef string) *terraform.AzureCl
 		UserAssignedIdentity: conf.Provider.Azure.UserAssignedIdentity,
 		ResourceGroup:        conf.Provider.Azure.ResourceGroup,
 		CustomEndpoint:       conf.CustomEndpoint,
+		InternalLoadBalancer: conf.InternalLoadBalancer,
 	}
 
 	vars = normalizeAzureURIs(vars)
@@ -172,14 +174,15 @@ func gcpTerraformVars(conf *config.Config, imageRef string) *terraform.GCPCluste
 		}
 	}
 	return &terraform.GCPClusterVariables{
-		Name:           conf.Name,
-		NodeGroups:     nodeGroups,
-		Project:        conf.Provider.GCP.Project,
-		Region:         conf.Provider.GCP.Region,
-		Zone:           conf.Provider.GCP.Zone,
-		ImageID:        imageRef,
-		Debug:          conf.IsDebugCluster(),
-		CustomEndpoint: conf.CustomEndpoint,
+		Name:                 conf.Name,
+		NodeGroups:           nodeGroups,
+		Project:              conf.Provider.GCP.Project,
+		Region:               conf.Provider.GCP.Region,
+		Zone:                 conf.Provider.GCP.Zone,
+		ImageID:              imageRef,
+		Debug:                conf.IsDebugCluster(),
+		CustomEndpoint:       conf.CustomEndpoint,
+		InternalLoadBalancer: conf.InternalLoadBalancer,
 	}
 }
 
@@ -218,6 +221,7 @@ func openStackTerraformVars(conf *config.Config, imageRef string) *terraform.Ope
 		Debug:                   conf.IsDebugCluster(),
 		NodeGroups:              nodeGroups,
 		CustomEndpoint:          conf.CustomEndpoint,
+		InternalLoadBalancer:    conf.InternalLoadBalancer,
 	}
 }
 

cli/internal/terraform/variables.go

@@ -66,6 +66,8 @@ type AWSClusterVariables struct {
 	NodeGroups map[string]AWSNodeGroup `hcl:"node_groups" cty:"node_groups"`
 	// CustomEndpoint is the (optional) custom dns hostname for the kubernetes api server.
 	CustomEndpoint string `hcl:"custom_endpoint" cty:"custom_endpoint"`
+	// InternalLoadBalancer is true if an internal load balancer should be created.
+	InternalLoadBalancer bool `hcl:"internal_load_balancer" cty:"internal_load_balancer"`
 }
 
 // GetCreateMAA gets the CreateMAA variable.
@@ -131,6 +133,8 @@ type GCPClusterVariables struct {
 	NodeGroups map[string]GCPNodeGroup `hcl:"node_groups" cty:"node_groups"`
 	// CustomEndpoint is the (optional) custom dns hostname for the kubernetes api server.
 	CustomEndpoint string `hcl:"custom_endpoint" cty:"custom_endpoint"`
+	// InternalLoadBalancer is true if an internal load balancer should be created.
+	InternalLoadBalancer bool `hcl:"internal_load_balancer" cty:"internal_load_balancer"`
 }
 
 // GetCreateMAA gets the CreateMAA variable.
@@ -203,6 +207,8 @@ type AzureClusterVariables struct {
 	NodeGroups map[string]AzureNodeGroup `hcl:"node_groups" cty:"node_groups"`
 	// CustomEndpoint is the (optional) custom dns hostname for the kubernetes api server.
 	CustomEndpoint string `hcl:"custom_endpoint" cty:"custom_endpoint"`
+	// InternalLoadBalancer is true if an internal load balancer should be created.
+	InternalLoadBalancer bool `hcl:"internal_load_balancer" cty:"internal_load_balancer"`
 }
 
 // GetCreateMAA gets the CreateMAA variable.
@@ -275,6 +281,8 @@ type OpenStackClusterVariables struct {
 	Debug bool `hcl:"debug" cty:"debug"`
 	// CustomEndpoint is the (optional) custom dns hostname for the kubernetes api server.
 	CustomEndpoint string `hcl:"custom_endpoint" cty:"custom_endpoint"`
+	// InternalLoadBalancer is true if an internal load balancer should be created.
+	InternalLoadBalancer bool `hcl:"internal_load_balancer" cty:"internal_load_balancer"`
 }
 
 // GetCreateMAA gets the CreateMAA variable.
@@ -346,6 +354,8 @@ type QEMUVariables struct {
 	KernelCmdline *string `hcl:"constellation_cmdline" cty:"constellation_cmdline"`
 	// CustomEndpoint is the (optional) custom dns hostname for the kubernetes api server.
 	CustomEndpoint string `hcl:"custom_endpoint" cty:"custom_endpoint"`
+	// InternalLoadBalancer is true if an internal load balancer should be created.
+	InternalLoadBalancer bool `hcl:"internal_load_balancer" cty:"internal_load_balancer"`
 }
 
 // GetCreateMAA gets the CreateMAA variable.

cli/internal/terraform/variables_test.go

@@ -73,7 +73,8 @@ node_groups = {
     zone          = "eu-central-1c"
   }
 }
-custom_endpoint = "example.com"
+custom_endpoint        = "example.com"
+internal_load_balancer = false
 `
 	got := vars.String()
 	assert.Equal(t, want, got)
@@ -147,7 +148,8 @@ node_groups = {
     zone          = "eu-central-1b"
   }
 }
-custom_endpoint = "example.com"
+custom_endpoint        = "example.com"
+internal_load_balancer = false
 `
 	got := vars.String()
 	assert.Equal(t, want, got)
@@ -212,7 +214,8 @@ node_groups = {
     zones         = null
   }
 }
-custom_endpoint = "example.com"
+custom_endpoint        = "example.com"
+internal_load_balancer = false
 `
 	got := vars.String()
 	assert.Equal(t, want, got)
@@ -279,6 +282,7 @@ openstack_username         = "my-username"
 openstack_password         = "my-password"
 debug                      = true
 custom_endpoint            = "example.com"
+internal_load_balancer     = false
 `
 	got := vars.String()
 	assert.Equal(t, want, got)
@@ -333,6 +337,7 @@ nvram                   = "/usr/share/OVMF/OVMF_VARS.fd"
 constellation_initrd    = "/var/lib/libvirt/images/cluster-name-initrd"
 constellation_cmdline   = "console=ttyS0,115200n8"
 custom_endpoint         = "example.com"
+internal_load_balancer  = false
 `
 	got := vars.String()
 	assert.Equal(t, want, got)

internal/config/config.go

@@ -82,6 +82,9 @@ type Config struct {
 	//   A fallback to DNS name is always available.
 	CustomEndpoint string `yaml:"customEndpoint" validate:"omitempty,hostname_rfc1123"`
 	// description: |
+	//   Flag to enable/disable the internal load balancer. If enabled, the Constellation is only accessible from within the VPC.
+	InternalLoadBalancer bool `yaml:"internalLoadBalancer" validate:"omitempty"`
+	// description: |
 	//   Supported cloud providers and their specific configurations.
 	Provider ProviderConfig `yaml:"provider" validate:"dive"`
 	// description: |
@@ -830,6 +833,12 @@ func (c *Config) Validate(force bool) error {
 		}
 	}
 
+	if c.InternalLoadBalancer {
+		if c.GetProvider() != cloudprovider.AWS && c.GetProvider() != cloudprovider.GCP {
+			return &ValidationError{validationErrMsgs: []string{"internalLoadBalancer is only supported for AWS and GCP"}}
+		}
+	}
+
 	err := validate.Struct(c)
 	if err == nil {
 		return nil