gcp

Documentation

Overview

Google Cloud Platform attestation

Index

• func GCEInstanceInfo(client gcpMetadataClient) func(context.Context, io.ReadWriteCloser, []byte) ([]byte, error)
• func TrustedKeyGetter(attestationVariant variant.Variant, ...) (...)
• type CVMRestClient
  • func NewRESTClient(ctx context.Context, opts ...option.ClientOption) (CVMRestClient, error)
• type MetadataClient
  • func (c MetadataClient) InstanceName(ctx context.Context) (string, error)
  • func (c MetadataClient) ProjectID(ctx context.Context) (string, error)
  • func (c MetadataClient) Zone(ctx context.Context) (string, error)
• type RESTClient

Functions

func GCEInstanceInfo

func GCEInstanceInfo(client gcpMetadataClient) func(context.Context, io.ReadWriteCloser, []byte) ([]byte, error)

GCEInstanceInfo fetches VM metadata used for attestation from the GCE Metadata API.

func TrustedKeyGetter

func TrustedKeyGetter(
	attestationVariant variant.Variant,
	newRESTClient func(ctx context.Context, opts ...option.ClientOption) (CVMRestClient, error),
) (func(ctx context.Context, attDoc vtpm.AttestationDocument, _ []byte) (crypto.PublicKey, error), error)

TrustedKeyGetter returns a function that queries the GCE API for a shieldedVM's public signing key. This key can be used to verify attestation statements issued by the VM.

Types

type CVMRestClient

type CVMRestClient interface {
	GetShieldedInstanceIdentity(ctx context.Context, req *computepb.GetShieldedInstanceIdentityInstanceRequest, opts ...gax.CallOption) (*computepb.ShieldedInstanceIdentity, error)
	Close() error
}

CVMRestClient is the interface a GCP REST client for a CVM must implement.

func NewRESTClient

func NewRESTClient(ctx context.Context, opts ...option.ClientOption) (CVMRestClient, error)

NewRESTClient creates a new RESTClient.

type MetadataClient

type MetadataClient struct{}

A MetadataClient fetches metadata from the GCE Metadata API.

func (MetadataClient) InstanceName

func (c MetadataClient) InstanceName(ctx context.Context) (string, error)

InstanceName returns the instance name of the GCE instance.

func (MetadataClient) ProjectID

func (c MetadataClient) ProjectID(ctx context.Context) (string, error)

ProjectID returns the project ID of the GCE instance.

func (MetadataClient) Zone

func (c MetadataClient) Zone(ctx context.Context) (string, error)

Zone returns the zone the GCE instance is located in.

type RESTClient

type RESTClient struct {
	*compute.InstancesClient
}

RESTClient is a client for the GCE API.