Support for TDX v6 CVM instance types on Azure

[strieflin]

It seems that the DCesv6 sizes series CVMs with TDX support that are currently on Public Preview on Azure are not supported by Constellation v2.24.0. Any plans to support this in the near future?

[msanft]

Hey Sven,

you might want to have a look at this PR.

But: If you need these machine types in the future, you might be able to enable support via a tiny patch. You can take this commit as a reference for that.

Best,
Moritz

[pawelpros]

I finally managed to run everything -> thanks again for your help and patience - I'll pass now information about entire procedure to @strieflin

[pawelpros]

@msanft one more question - entire setup works fine but i see that verification-service tries to pull:
"ghcr.io/edgelesssys/constellation/verification-service:v2.24.0@sha256:36fbb47d1d692fb7b4ba4fe551a057b50b9c1a8e1e70cbb289c5c38008341866" image which is not available and actually based on branch release/v2.24 available one is "ghcr.io/edgelesssys/constellation/verification-service:v2.24.0@sha256:154b0b67159d1ea0c925972a07b72747dd96659dd269870be34ade82029912d1". How I can force bazel to replace digest for available image ?

[msanft]

Easiest for you will be to run bazel run //:devbuild --cli_edition=oss --container_prefix=ghcr.io/USERNAME/constellation (replacing USERNAME or the whole URL with the appropriate registry). The devbuild command will upload the appropriate container images to there so you can use them. Depending on the registry you might need to mark the images as public before being able to use them.

[pawelpros]

Hmm it may produce a lot more questions than answers ^^ - maybe some file patching exactly to pin correct version ? (rest of them are available so only with this one there is problem) I would avoid re-deploying images on external repo. Maybe there is some OCI-pinining or something like that which will check newest available image for tag and should work ?

[msanft]

I can't give you a more detailed explanation since I'm not super well-versed with Bazel, but you'd need to exclude the verification service in this GENERATED_SOURCES expansion:

constellation/internal/constellation/helm/imageversion/BUILD.bazel

Lines 7 to 10 in 588b8bc

	GENERATED_SRCS = [
	":" + container["name"]
	for container in helm_containers()
	]

and then use a custom file (see e.g. placeholder.go) instead with some custom digest there. AI may help you here. I don't have an instant idea on how to do that either.

Or you revert to building with go build and just fill everything in placeholder.go by hand. But then, other things might break. Not sure.
Easiest option is honestly to just use your own registry.