Skip to main content
Version: 2.0

Components

Constellation takes care of bootstrapping and initializing a Confidential Kubernetes cluster. During the lifetime of the cluster, it handles day 2 operations such as key management, remote attestation, and updates. These features are provided by several components:

The relations between components are shown in the following diagram:

Bootstrapper​

The Bootstrapper is the first component launched after booting a Constellation node image. It sets up that machine as a Kubernetes node and integrates that node into the Kubernetes cluster. To this end, the Bootstrapper first downloads and verifies the Kubernetes components at the configured versions. The Bootstrapper tries to find an existing cluster and if successful, communicates with the JoinService to join the node. Otherwise, it waits for an initialization request to create a new Kubernetes cluster.

JoinService​

The JoinService runs as DaemonSet on each control-plane node. New nodes (at cluster start, or later through autoscaling) send a request to the service over attested TLS (aTLS). The JoinService verifies the new node's certificate and attestation statement. If attestation is successful, the new node is supplied with an encryption key from the KMS for its state disk, and a Kubernetes bootstrap token.

VerificationService​

The VerificationService runs as DaemonSet on each node. It provides user-facing functionality for remote attestation during the cluster's lifetime via an endpoint for verifying the cluster. Read more about the hardware-based attestation feature of Constellation and how to verify a cluster on the client side.

KMS​

The KMS runs as DaemonSet on each control-plane node. It implements the key management for the storage encryption keys in Constellation. These keys are used for the state disk of each node and the transparently encrypted storage for Kubernetes. Depending on wether the constellation-managed or user-managed mode is used, the KMS holds the key encryption key (KEK) directly or calls an external service for key derivation respectively.

AccessManager​

The AccessManager runs as DaemonSet on each node. It manages the user's SSH access to nodes as specified in the config.