generate: add flag for aks reference values

The manifest will be generated with invalid null values when the flag is
not specified which must be filled out by the user.

cli/cmd/generate.go

@@ -63,6 +63,7 @@ subcommands.`,
 	cmd.Flags().StringP("policy", "p", rulesFilename, "path to policy (.rego) file")
 	cmd.Flags().StringP("settings", "s", settingsFilename, "path to settings (.json) file")
 	cmd.Flags().StringP("manifest", "m", manifestFilename, "path to manifest (.json) file")
+	cmd.Flags().String("reference-values", "", "set the default reference values used for attestation (one of: aks)")
 	cmd.Flags().StringArrayP("workload-owner-key", "w", []string{workloadOwnerPEM}, "path to workload owner key (.pem) file")
 	cmd.Flags().BoolP("disable-updates", "d", false, "prevent further updates of the manifest")
 	cmd.Flags().String("image-replacements", "", "path to image replacements file")
@@ -115,6 +116,9 @@ func runGenerate(cmd *cobra.Command, args []string) error {
 	}
 
 	defaultManifest := manifest.Default()
+	if flags.referenceValues == "aks" {
+		defaultManifest = manifest.DefaultAKS()
+	}
 	defaultManifestData, err := json.MarshalIndent(&defaultManifest, "", "  ")
 	if err != nil {
 		return fmt.Errorf("marshaling default manifest: %w", err)
@@ -445,6 +449,7 @@ type generateFlags struct {
 	policyPath            string
 	settingsPath          string
 	manifestPath          string
+	referenceValues       string
 	workloadOwnerKeys     []string
 	disableUpdates        bool
 	workspaceDir          string
@@ -465,6 +470,13 @@ func parseGenerateFlags(cmd *cobra.Command) (*generateFlags, error) {
 	if err != nil {
 		return nil, err
 	}
+	referenceValues, err := cmd.Flags().GetString("reference-values")
+	if err != nil {
+		return nil, err
+	}
+	if !slices.Contains([]string{"", "aks"}, referenceValues) {
+		return nil, fmt.Errorf("unknown reference values")
+	}
 	workloadOwnerKeys, err := cmd.Flags().GetStringArray("workload-owner-key")
 	if err != nil {
 		return nil, err
@@ -507,6 +519,7 @@ func parseGenerateFlags(cmd *cobra.Command) (*generateFlags, error) {
 		policyPath:            policyPath,
 		settingsPath:          settingsPath,
 		manifestPath:          manifestPath,
+		referenceValues:       referenceValues,
 		workloadOwnerKeys:     workloadOwnerKeys,
 		disableUpdates:        disableUpdates,
 		workspaceDir:          workspaceDir,

coordinator/internal/authority/authority_test.go

@@ -92,7 +92,7 @@ func newManifest(t *testing.T) (*manifest.Manifest, []byte, [][]byte) {
 	policyHash := sha256.Sum256(policy)
 	policyHashHex := manifest.NewHexString(policyHash[:])
 
-	mnfst := manifest.Default()
+	mnfst := manifest.DefaultAKS()
 	mnfst.Policies = map[manifest.HexString][]string{policyHashHex: {"test"}}
 	mnfst.WorkloadOwnerKeyDigests = []manifest.HexString{keyDigest}
 	mnfstBytes, err := json.Marshal(mnfst)

e2e/internal/contrasttest/contrasttest.go

@@ -133,7 +133,12 @@ func (ct *ContrastTest) Init(t *testing.T, resources []any) {
 func (ct *ContrastTest) Generate(t *testing.T) {
 	require := require.New(t)
 
-	args := append(ct.commonArgs(), "--image-replacements", ct.ImageReplacementsFile, path.Join(ct.WorkDir, "resources.yaml"))
+	args := append(
+		ct.commonArgs(),
+		"--image-replacements", ct.ImageReplacementsFile,
+		"--reference-values", "aks",
+		path.Join(ct.WorkDir, "resources.yaml"),
+	)
 
 	generate := cmd.NewGenerateCmd()
 	generate.Flags().String("workspace-dir", "", "") // Make generate aware of root flags

internal/manifest/constants.go

@@ -10,19 +10,25 @@ var trustedMeasurement = "000000000000000000000000000000000000000000000000000000
 func Default() Manifest {
 	return Manifest{
 		ReferenceValues: ReferenceValues{
-			SNP: SNPReferenceValues{
-				MinimumTCB: SNPTCB{
-					BootloaderVersion: toPtr(SVN(3)),
-					TEEVersion:        toPtr(SVN(0)),
-					SNPVersion:        toPtr(SVN(8)),
-					MicrocodeVersion:  toPtr(SVN(115)),
-				},
-			},
 			TrustedMeasurement: HexString(trustedMeasurement),
 		},
 	}
 }
 
+// DefaultAKS returns a default manifest with AKS reference values.
+func DefaultAKS() Manifest {
+	mnfst := Default()
+	mnfst.ReferenceValues.SNP = SNPReferenceValues{
+		MinimumTCB: SNPTCB{
+			BootloaderVersion: toPtr(SVN(3)),
+			TEEVersion:        toPtr(SVN(0)),
+			SNPVersion:        toPtr(SVN(8)),
+			MicrocodeVersion:  toPtr(SVN(115)),
+		},
+	}
+	return mnfst
+}
+
 func toPtr[T any](t T) *T {
 	return &t
 }

justfile

@@ -79,6 +79,7 @@ generate cli=default_cli:
     nix run .#{{ cli }} -- generate \
         --workspace-dir ./{{ workspace_dir }} \
         --image-replacements ./{{ workspace_dir }}/just.containerlookup \
+        --reference-values aks \
         ./{{ workspace_dir }}/deployment/*.yml
     duration=$(( $(date +%s) - $t ))
     echo "Generated policies in $duration seconds."