Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2024-10-01 01:36:09 -04:00
Code Issues Packages Projects Releases Wiki Activity

image: base layer

Browse Source
This commit is contained in:
Malte Poll 2023-09-11 15:51:42 +02:00 committed by Malte Poll
parent fc1045a4f7
commit d904766b9c
27 changed files with 567 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

60
image/base/BUILD.bazel Normal file
View File

@ -0,0 +1,60 @@
load("@aspect_bazel_lib//lib:copy_file.bzl", "copy_file")
load("@aspect_bazel_lib//lib:copy_to_directory.bzl", "copy_to_directory")
load("//bazel/mkosi:mkosi_image.bzl", "mkosi_image")
copy_to_directory(
name = "rpms",
srcs = [
"@kernel//file",
"@kernel_core//file",
"@kernel_modules//file",
"@kernel_modules_core//file",
],
include_external_repositories = ["kernel*"],
replace_prefixes = {"file": ""},
)
[
copy_file(
name = name,
src = "@" + name + "//file",
out = name + ".rpm",
allow_symlink = True,
)
for name in [
"kernel",
"kernel_core",
"kernel_modules",
"kernel_modules_core",
]
]
mkosi_image(
name = "base",
srcs = [
"mkosi.postinst",
"mkosi.prepare",
] + glob([
"mkosi.skeleton/**",
"reposdir/**",
]),
outs = [
"image",
"image.tar",
],
extra_trees = [
"//image:sysroot_tar",
],
mkosi_conf = "mkosi.conf",
package_files = [
":kernel",
":kernel_core",
":kernel_modules",
":kernel_modules_core",
],
tags = [
"manual",
"no-cache",
],
visibility = ["//visibility:public"],
)

72
image/base/mkosi.conf Normal file
View File

@ -0,0 +1,72 @@
[Distribution]
Distribution=fedora
Release=38
[Output]
Format=tar
SourceDateEpoch=0
[Content]
Bootable=no
Packages=systemd
systemd-boot
dbus
udev
util-linux
# nvme / disk / udev tools
Packages=nvme-cli
ec2-utils
WALinuxAgent-udev
google-compute-engine-guest-configs-udev # google_nvme_id
device-mapper
cryptsetup
# Containers
Packages=containerd
containernetworking-plugins
iptables-nft
ethtool
socat
iproute-tc
conntrack-tools
podman
# Network
Packages=iproute
dbus
systemd-networkd
systemd-resolved
# measured / secure boot
Packages=e2fsprogs
sbsigntools
efitools
mokutil
tpm2-tools
# selinux
Packages=selinux-policy
selinux-policy-targeted
# tools
Packages=passwd
nano
nano-default-editor
vim
curl
wget
PackageManagerTrees=reposdir:/etc/yum.repos.d
RemoveFiles=/var/log
RemoveFiles=/var/cache
RemoveFiles=/etc/pki/ca-trust/extracted/java/cacerts
/usr/lib/sysimage/libdnf5/transaction_history.sqlite*
/var/cache/ldconfig/aux-cache
# https://github.com/authselect/authselect/pull/348
# RemoveFiles=/etc/authselect/*
RemoveFiles=/etc/issue
RemoveFiles=/etc/issue.net
CleanPackageMetadata=true
Seed=b04a9a33-4559-4af4-8b38-9249cf933229

9
image/base/mkosi.postinst Executable file
View File

@ -0,0 +1,9 @@
#!/usr/bin/env bash
set -euxo pipefail
# create mountpoints in /etc
mkdir -p "${BUILDROOT}"/etc/{cni,kubernetes}
# move issue files away from /etc
# to allow /run/issue and /run/issue.d to take precedence
mv "${BUILDROOT}/etc/issue.d" "${BUILDROOT}/usr/lib/issue.d" || true

5
image/base/mkosi.prepare Executable file
View File

@ -0,0 +1,5 @@
#!/usr/bin/env bash
set -euxo pipefail
# set selinux to permissive
sed -i 's/^SELINUX=.*/SELINUX=permissive/' "${BUILDROOT}/etc/selinux/config"

1
image/base/mkosi.skeleton/etc/crictl.yaml Normal file
View File

@ -0,0 +1 @@
runtime-endpoint: "unix:///run/containerd/containerd.sock"

5
image/base/mkosi.skeleton/etc/fstab Normal file
View File

@ -0,0 +1,5 @@
/dev/mapper/state /run/state ext4 defaults,x-systemd.makefs,x-mount.mkdir 0 0
/run/state/var /var none defaults,bind,x-mount.mkdir 0 0
/run/state/kubernetes /etc/kubernetes none defaults,bind,x-mount.mkdir 0 0
/run/state/etccni /etc/cni/ none defaults,bind,x-mount.mkdir 0 0
/run/state/opt /opt none defaults,bind,x-mount.mkdir 0 0

11
image/base/mkosi.skeleton/etc/profile.d/constellation.sh Executable file
View File

@ -0,0 +1,11 @@
#!/usr/bin/env bash
# Copyright (c) Edgeless Systems GmbH
#
# SPDX-License-Identifier: AGPL-3.0-only
# Note: This script is sourced.
export TERM=linux
export PATH=/run/state/bin:${PATH}
export KUBECONFIG=/etc/kubernetes/admin.conf
alias k=kubectl

216
image/base/mkosi.skeleton/usr/etc/containerd/config.toml Normal file
View File

@ -0,0 +1,216 @@
disabled_plugins = []
imports = []
oom_score = 0
plugin_dir = ""
required_plugins = []
root = "/var/lib/containerd"
state = "/run/containerd"
version = 2
[cgroup]
path = ""
[debug]
address = ""
format = ""
gid = 0
level = ""
uid = 0
[grpc]
address = "/run/containerd/containerd.sock"
gid = 0
max_recv_message_size = 16777216
max_send_message_size = 16777216
tcp_address = ""
tcp_tls_cert = ""
tcp_tls_key = ""
uid = 0
[metrics]
address = ""
grpc_histogram = false
[plugins]
[plugins."io.containerd.gc.v1.scheduler"]
deletion_threshold = 0
mutation_threshold = 100
pause_threshold = 0.02
schedule_delay = "0s"
startup_delay = "100ms"
[plugins."io.containerd.grpc.v1.cri"]
disable_apparmor = false
disable_cgroup = false
disable_hugetlb_controller = true
disable_proc_mount = false
disable_tcp_service = true
enable_selinux = false
enable_tls_streaming = false
ignore_image_defined_volumes = false
max_concurrent_downloads = 3
max_container_log_line_size = 16384
netns_mounts_under_state_dir = false
restrict_oom_score_adj = false
sandbox_image = "registry.k8s.io/pause:3.9@sha256:7031c1b283388d2c2e09b57badb803c05ebed362dc88d84b480cc47f72a21097"
selinux_category_range = 1024
stats_collect_period = 10
stream_idle_timeout = "4h0m0s"
stream_server_address = "127.0.0.1"
stream_server_port = "0"
systemd_cgroup = false
tolerate_missing_hugetlb_controller = true
unset_seccomp_profile = ""
[plugins."io.containerd.grpc.v1.cri".cni]
bin_dir = "/opt/cni/bin"
conf_dir = "/etc/cni/net.d"
conf_template = ""
max_conf_num = 1
[plugins."io.containerd.grpc.v1.cri".containerd]
default_runtime_name = "runc"
disable_snapshot_annotations = true
discard_unpacked_layers = false
no_pivot = false
snapshotter = "overlayfs"
[plugins."io.containerd.grpc.v1.cri".containerd.default_runtime]
base_runtime_spec = ""
container_annotations = []
pod_annotations = []
privileged_without_host_devices = false
runtime_engine = ""
runtime_root = ""
runtime_type = ""
[plugins."io.containerd.grpc.v1.cri".containerd.default_runtime.options]
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes]
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
base_runtime_spec = ""
container_annotations = []
pod_annotations = []
privileged_without_host_devices = false
runtime_engine = ""
runtime_root = ""
runtime_type = "io.containerd.runc.v2"
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
BinaryName = ""
CriuImagePath = ""
CriuPath = ""
CriuWorkPath = ""
IoGid = 0
IoUid = 0
NoNewKeyring = false
NoPivotRoot = false
Root = ""
ShimCgroup = ""
SystemdCgroup = true
[plugins."io.containerd.grpc.v1.cri".containerd.untrusted_workload_runtime]
base_runtime_spec = ""
container_annotations = []
pod_annotations = []
privileged_without_host_devices = false
runtime_engine = ""
runtime_root = ""
runtime_type = ""
[plugins."io.containerd.grpc.v1.cri".containerd.untrusted_workload_runtime.options]
[plugins."io.containerd.grpc.v1.cri".image_decryption]
key_model = "node"
[plugins."io.containerd.grpc.v1.cri".registry]
config_path = ""
[plugins."io.containerd.grpc.v1.cri".registry.auths]
[plugins."io.containerd.grpc.v1.cri".registry.configs]
[plugins."io.containerd.grpc.v1.cri".registry.headers]
[plugins."io.containerd.grpc.v1.cri".registry.mirrors]
[plugins."io.containerd.grpc.v1.cri".x509_key_pair_streaming]
tls_cert_file = ""
tls_key_file = ""
[plugins."io.containerd.internal.v1.opt"]
path = "/opt/containerd"
[plugins."io.containerd.internal.v1.restart"]
interval = "10s"
[plugins."io.containerd.metadata.v1.bolt"]
content_sharing_policy = "shared"
[plugins."io.containerd.monitor.v1.cgroups"]
no_prometheus = false
[plugins."io.containerd.runtime.v1.linux"]
no_shim = false
runtime = "runc"
runtime_root = ""
shim = "containerd-shim"
shim_debug = false
[plugins."io.containerd.runtime.v2.task"]
platforms = ["linux/amd64"]
[plugins."io.containerd.service.v1.diff-service"]
default = ["walking"]
[plugins."io.containerd.snapshotter.v1.aufs"]
root_path = ""
[plugins."io.containerd.snapshotter.v1.btrfs"]
root_path = ""
[plugins."io.containerd.snapshotter.v1.devmapper"]
async_remove = false
base_image_size = ""
pool_name = ""
root_path = ""
[plugins."io.containerd.snapshotter.v1.native"]
root_path = ""
[plugins."io.containerd.snapshotter.v1.overlayfs"]
root_path = ""
[plugins."io.containerd.snapshotter.v1.zfs"]
root_path = ""
[proxy_plugins]
[stream_processors]
[stream_processors."io.containerd.ocicrypt.decoder.v1.tar"]
accepts = ["application/vnd.oci.image.layer.v1.tar+encrypted"]
args = ["--decryption-keys-path", "/etc/containerd/ocicrypt/keys"]
env = ["OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf"]
path = "ctd-decoder"
returns = "application/vnd.oci.image.layer.v1.tar"
[stream_processors."io.containerd.ocicrypt.decoder.v1.tar.gzip"]
accepts = ["application/vnd.oci.image.layer.v1.tar+gzip+encrypted"]
args = ["--decryption-keys-path", "/etc/containerd/ocicrypt/keys"]
env = ["OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf"]
path = "ctd-decoder"
returns = "application/vnd.oci.image.layer.v1.tar+gzip"
[timeouts]
"io.containerd.timeout.shim.cleanup" = "5s"
"io.containerd.timeout.shim.load" = "5s"
"io.containerd.timeout.shim.shutdown" = "3s"
"io.containerd.timeout.task.state" = "2s"
[ttrpc]
address = ""
gid = 0
uid = 0

2
image/base/mkosi.skeleton/usr/etc/containers/containers.conf Normal file
View File

@ -0,0 +1,2 @@
[network]
network_config_dir = "/run/containers/networks"

1
image/base/mkosi.skeleton/usr/etc/containers/registries.conf Normal file
View File

@ -0,0 +1 @@
unqualified-search-registries = ["docker.io"]

2
image/base/mkosi.skeleton/usr/lib/environment.d/99-constellation.conf Normal file
View File

@ -0,0 +1,2 @@
PATH=/run/state/bin:$PATH
KUBECONFIG=/etc/kubernetes/admin.conf

1
image/base/mkosi.skeleton/usr/lib/issue.d/01_constellation.issue Normal file
View File

@ -0,0 +1 @@
\S{IMAGE_ID} \S{IMAGE_VERSION}

2
image/base/mkosi.skeleton/usr/lib/modules-load.d/k8s.conf Normal file
View File

@ -0,0 +1,2 @@
overlay
br_netfilter

3
image/base/mkosi.skeleton/usr/lib/sysctl.d/10-cilium.conf Normal file
View File

@ -0,0 +1,3 @@
# See https://github.com/cilium/cilium/issues/10645
net.ipv4.conf.lxc*.rp_filter = 0
net.ipv4.conf.cilium_*.rp_filter = 0

9
image/base/mkosi.skeleton/usr/lib/sysctl.d/10-k8s.conf Normal file
View File

@ -0,0 +1,9 @@
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
fs.inotify.max_user_instances = 8192
fs.inotify.max_user_watches = 524288
# kubernetes hardening (protectKernelDefaults=true)
vm.overcommit_memory = 1
kernel.panic = 10
kernel.panic_on_oops = 1

12
image/base/mkosi.skeleton/usr/lib/systemd/system-preset/30-constellation.preset Normal file
View File

@ -0,0 +1,12 @@
enable configure-constel-csp.service
enable constellation-upgrade-agent.service
enable constellation-bootstrapper.service
enable containerd.service
enable kubelet.service
enable systemd-networkd.service
enable systemd-networkd.socket
enable systemd-resolved.service
enable measurements.service
enable export_constellation_debug.service
enable systemd-timesyncd
enable udev-trigger.service

16
image/base/mkosi.skeleton/usr/lib/systemd/system/constellation-bootstrapper.service Normal file
View File

@ -0,0 +1,16 @@
[Unit]
Description=Constellation Bootstrapper
Wants=network-online.target
After=network-online.target configure-constel-csp.service
After=export_constellation_debug.service
[Service]
Type=simple
RemainAfterExit=yes
Restart=on-failure
EnvironmentFile=/run/constellation.env
Environment=PATH=/run/state/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin
ExecStart=/usr/bin/bootstrapper $CONSTELLATION_DEBUG_FLAGS
[Install]
WantedBy=multi-user.target

14
image/base/mkosi.skeleton/usr/lib/systemd/system/constellation-upgrade-agent.service Normal file
View File

@ -0,0 +1,14 @@
[Unit]
Description=Constellation Upgrade Agent
After=export_constellation_debug.service
[Service]
Type=simple
RemainAfterExit=yes
Restart=on-failure
EnvironmentFile=/run/constellation.env
Environment=PATH=/run/state/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin
ExecStart=/usr/bin/upgrade-agent $CONSTELLATION_DEBUG_FLAGS
[Install]
WantedBy=multi-user.target

3
image/base/mkosi.skeleton/usr/lib/systemd/system/containerd.service.d/local.conf Normal file
View File

@ -0,0 +1,3 @@
[Service]
ExecStart=
ExecStart=/usr/bin/containerd --config /usr/etc/containerd/config.toml

10
image/base/mkosi.skeleton/usr/lib/systemd/system/export_constellation_debug.service Normal file
View File

@ -0,0 +1,10 @@
[Unit]
Description=Export Constellation Debug Level to Environment
[Service]
Type=oneshot
ExecStart=/bin/bash -c "tr ' ' '\n' < /proc/cmdline | grep -q 'constellation.debug' && echo CONSTELLATION_DEBUG_FLAGS=--debug >> /run/constellation.env"
RemainAfterExit=yes
[Install]
WantedBy=multi-user.target

21
image/base/mkosi.skeleton/usr/lib/systemd/system/kubelet.service Normal file
View File

@ -0,0 +1,21 @@
[Unit]
Description=kubelet: The Kubernetes Node Agent
Documentation=https://kubernetes.io/docs/home/
Wants=network-online.target
After=network-online.target
[Service]
Environment="KUBELET_KUBECONFIG_ARGS=--bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf"
Environment="KUBELET_CONFIG_ARGS=--config=/var/lib/kubelet/config.yaml"
# This is a file that "kubeadm init" and "kubeadm join" generates at runtime, populating the KUBELET_KUBEADM_ARGS variable dynamically
EnvironmentFile=-/var/lib/kubelet/kubeadm-flags.env
# This is a file that the user can use for overrides of the kubelet args as a last resort. Preferably, the user should use
# the .NodeRegistration.KubeletExtraArgs object in the configuration files instead. KUBELET_EXTRA_ARGS should be sourced from this file.
EnvironmentFile=-/etc/default/kubelet
ExecStart=/run/state/bin/kubelet $KUBELET_KUBECONFIG_ARGS $KUBELET_CONFIG_ARGS $KUBELET_KUBEADM_ARGS $KUBELET_EXTRA_ARGS
Restart=always
StartLimitInterval=0
RestartSec=10
[Install]
WantedBy=multi-user.target

12
image/base/mkosi.skeleton/usr/lib/systemd/system/measurements.service Normal file
View File

@ -0,0 +1,12 @@
[Unit]
Description=Print image measurements on startup
Before=constellation-bootstrapper.service
[Service]
Type=oneshot
RemainAfterExit=yes
EnvironmentFile=/run/constellation.env
ExecStart=/usr/libexec/constellation-pcrs
[Install]
WantedBy=multi-user.target

15
image/base/mkosi.skeleton/usr/lib/systemd/system/udev-trigger.service Normal file
View File

@ -0,0 +1,15 @@
[Unit]
Description=Trigger udev events for constellation
Before=blockdev@dev-mapper-state.target
Requires=systemd-udevd.service
After=systemd-udev-trigger.service
DefaultDependencies=no
[Service]
Type=oneshot
ExecStart=-udevadm trigger -v
RemainAfterExit=yes
TimeoutSec=infinity
[Install]
RequiredBy=dev-mapper-state.device

2
image/base/mkosi.skeleton/usr/lib/sysusers.d/constellation.conf Normal file
View File

@ -0,0 +1,2 @@
#Type Name ID GECOS Home directory Shell
u etcd 998:997 "etcd user" /var/lib/etcd

10
image/base/mkosi.skeleton/usr/lib/tmpfiles.d/constellation.conf Normal file
View File

@ -0,0 +1,10 @@
#Type Path Mode User Group Age Argument
d /var/lib/etcd 0700 998 997 - -
d /var/log/kubernetes/audit/ 0700 0 0 - -
d /run/state/bin 0755 0 0 - -
C /run/issue.d - - - - /usr/lib/issue.d/
C /run/issue - - - - /usr/lib/issue
C /run/motd.d - - - - /usr/lib/motd.d/
C /run/motd - - - - /usr/lib/motd
# merge all CNI binaries in writable folder until containerd can use multiple CNI bins: https://github.com/containerd/containerd/issues/6600
C /opt/cni/bin - - - - /usr/libexec/cni/

14
image/base/mkosi.skeleton/usr/libexec/constellation-pcrs Executable file
View File

@ -0,0 +1,14 @@
#!/usr/bin/env bash
# Copyright (c) Edgeless Systems GmbH
#
# SPDX-License-Identifier: AGPL-3.0-only
# This script reads the measurements of the system
# and prints the message to the serial console
main() {
pcr_state="$(/usr/sbin/measurement-reader)"
echo -e "${pcr_state}\n" > /run/issue.d/35_constellation_pcrs.issue
}
main

39
image/base/reposdir/amzn2-core.repo Normal file
View File

@ -0,0 +1,39 @@
[amzn2-core]
name=Amazon Linux 2 core repository
#mirrorlist=$awsproto://$amazonlinux.$awsregion.$awsdomain/$releasever/$product/$target/$basearch/mirror.list
mirrorlist=https://amazonlinux-2-repos-us-east-2.s3.dualstack.us-east-2.amazonaws.com/2/core/latest/x86_64/mirror.list
priority=10
gpgcheck=1
#gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-amazon-linux-2
gpgkey=https://cdn.amazonlinux.com/_assets/11CF1F95C87F5B1A.asc
enabled=1
metadata_expire=300
mirrorlist_expire=300
report_instanceid=yes
includepkgs=ec2-utils
# [amzn2-core-source]
# name=Amazon Linux 2 core repository - source packages
# mirrorlist=$awsproto://$amazonlinux.$awsregion.$awsdomain/$releasever/$product/$target/SRPMS/mirror.list
# priority=10
# gpgcheck=1
# #gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-amazon-linux-2
# gpgkey=https://cdn.amazonlinux.com/_assets/11CF1F95C87F5B1A.asc
# enabled=0
# metadata_expire=300
# mirrorlist_expire=300
# report_instanceid=yes
# includepkgs=ec2-utils
# [amzn2-core-debuginfo]
# name=Amazon Linux 2 core repository - debuginfo packages
# mirrorlist=$awsproto://$amazonlinux.$awsregion.$awsdomain/$releasever/$product/$target/debuginfo/$basearch/mirror.list
# priority=10
# gpgcheck=1
# #gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-amazon-linux-2
# gpgkey=https://cdn.amazonlinux.com/_assets/11CF1F95C87F5B1A.asc
# enabled=0
# metadata_expire=300
# mirrorlist_expire=300
# report_instanceid=yes
# includepkgs=ec2-utils