feat: add production hardening — Ed25519 signing, Portainer Edge, SSH extension (Phase 4)
Image signing: - Ed25519 sign/verify package (pure Go stdlib, zero deps) - genkey and sign CLI subcommands for build system - Optional --pubkey flag for verifying updates on apply - Signature URLs in update metadata (latest.json) Portainer Edge Agent: - cloud-init portainer.go module writes K8s manifest - Auto-deploys Edge Agent when portainer.edge-agent.enabled - Full RBAC (ServiceAccount, ClusterRoleBinding, Deployment) - 5 Portainer tests in portainer_test.go Production tooling: - SSH debug extension builder (hack/build-ssh-extension.sh) - Boot performance benchmark (test/benchmark/bench-boot.sh) - Resource usage benchmark (test/benchmark/bench-resources.sh) - Deployment guide (docs/deployment-guide.md) Test results: 50 update agent tests + 22 cloud-init tests passing. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
136
cloud-init/portainer.go
Normal file
136
cloud-init/portainer.go
Normal file
@@ -0,0 +1,136 @@
|
||||
package cloudinit
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"log/slog"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
)
|
||||
|
||||
// ApplyPortainer writes the Portainer Edge Agent deployment manifest
|
||||
// based on cloud-init config. The manifest is applied by KubeSolo after
|
||||
// the cluster is ready.
|
||||
func ApplyPortainer(cfg *Config, manifestDir string) error {
|
||||
if !cfg.Portainer.EdgeAgent.Enabled {
|
||||
slog.Info("portainer edge agent not enabled, skipping")
|
||||
return nil
|
||||
}
|
||||
|
||||
ea := cfg.Portainer.EdgeAgent
|
||||
if ea.EdgeID == "" || ea.EdgeKey == "" {
|
||||
return fmt.Errorf("portainer edge-agent enabled but edge-id and edge-key are required")
|
||||
}
|
||||
if ea.PortainerURL == "" {
|
||||
return fmt.Errorf("portainer edge-agent enabled but portainer-url is required")
|
||||
}
|
||||
|
||||
image := ea.Image
|
||||
if image == "" {
|
||||
image = "portainer/agent:latest"
|
||||
}
|
||||
|
||||
if err := os.MkdirAll(manifestDir, 0o755); err != nil {
|
||||
return fmt.Errorf("creating manifest dir: %w", err)
|
||||
}
|
||||
|
||||
manifest := buildEdgeAgentManifest(ea.EdgeID, ea.EdgeKey, ea.PortainerURL, image)
|
||||
dest := filepath.Join(manifestDir, "portainer-edge-agent.yaml")
|
||||
if err := os.WriteFile(dest, []byte(manifest), 0o644); err != nil {
|
||||
return fmt.Errorf("writing edge agent manifest: %w", err)
|
||||
}
|
||||
|
||||
slog.Info("portainer edge agent manifest written", "path", dest)
|
||||
return nil
|
||||
}
|
||||
|
||||
func buildEdgeAgentManifest(edgeID, edgeKey, portainerURL, image string) string {
|
||||
var sb strings.Builder
|
||||
|
||||
sb.WriteString("# Auto-generated by KubeSolo OS cloud-init\n")
|
||||
sb.WriteString("# Portainer Edge Agent deployment\n")
|
||||
sb.WriteString("---\n")
|
||||
sb.WriteString("apiVersion: v1\n")
|
||||
sb.WriteString("kind: Namespace\n")
|
||||
sb.WriteString("metadata:\n")
|
||||
sb.WriteString(" name: portainer\n")
|
||||
sb.WriteString(" labels:\n")
|
||||
sb.WriteString(" app.kubernetes.io/name: portainer-agent\n")
|
||||
sb.WriteString(" app.kubernetes.io/component: edge-agent\n")
|
||||
sb.WriteString("---\n")
|
||||
sb.WriteString("apiVersion: v1\n")
|
||||
sb.WriteString("kind: ServiceAccount\n")
|
||||
sb.WriteString("metadata:\n")
|
||||
sb.WriteString(" name: portainer-sa-clusteradmin\n")
|
||||
sb.WriteString(" namespace: portainer\n")
|
||||
sb.WriteString("---\n")
|
||||
sb.WriteString("apiVersion: rbac.authorization.k8s.io/v1\n")
|
||||
sb.WriteString("kind: ClusterRoleBinding\n")
|
||||
sb.WriteString("metadata:\n")
|
||||
sb.WriteString(" name: portainer-crb-clusteradmin\n")
|
||||
sb.WriteString("roleRef:\n")
|
||||
sb.WriteString(" apiGroup: rbac.authorization.k8s.io\n")
|
||||
sb.WriteString(" kind: ClusterRole\n")
|
||||
sb.WriteString(" name: cluster-admin\n")
|
||||
sb.WriteString("subjects:\n")
|
||||
sb.WriteString(" - kind: ServiceAccount\n")
|
||||
sb.WriteString(" name: portainer-sa-clusteradmin\n")
|
||||
sb.WriteString(" namespace: portainer\n")
|
||||
sb.WriteString("---\n")
|
||||
sb.WriteString("apiVersion: apps/v1\n")
|
||||
sb.WriteString("kind: Deployment\n")
|
||||
sb.WriteString("metadata:\n")
|
||||
sb.WriteString(" name: portainer-agent\n")
|
||||
sb.WriteString(" namespace: portainer\n")
|
||||
sb.WriteString(" labels:\n")
|
||||
sb.WriteString(" app.kubernetes.io/name: portainer-agent\n")
|
||||
sb.WriteString(" app.kubernetes.io/component: edge-agent\n")
|
||||
sb.WriteString("spec:\n")
|
||||
sb.WriteString(" replicas: 1\n")
|
||||
sb.WriteString(" selector:\n")
|
||||
sb.WriteString(" matchLabels:\n")
|
||||
sb.WriteString(" app: portainer-agent\n")
|
||||
sb.WriteString(" template:\n")
|
||||
sb.WriteString(" metadata:\n")
|
||||
sb.WriteString(" labels:\n")
|
||||
sb.WriteString(" app: portainer-agent\n")
|
||||
sb.WriteString(" spec:\n")
|
||||
sb.WriteString(" serviceAccountName: portainer-sa-clusteradmin\n")
|
||||
sb.WriteString(" containers:\n")
|
||||
sb.WriteString(" - name: agent\n")
|
||||
sb.WriteString(fmt.Sprintf(" image: %s\n", image))
|
||||
sb.WriteString(" env:\n")
|
||||
sb.WriteString(" - name: EDGE\n")
|
||||
sb.WriteString(" value: \"1\"\n")
|
||||
sb.WriteString(" - name: EDGE_ID\n")
|
||||
sb.WriteString(fmt.Sprintf(" value: \"%s\"\n", edgeID))
|
||||
sb.WriteString(" - name: EDGE_KEY\n")
|
||||
sb.WriteString(fmt.Sprintf(" value: \"%s\"\n", edgeKey))
|
||||
sb.WriteString(" - name: EDGE_INSECURE_POLL\n")
|
||||
sb.WriteString(" value: \"1\"\n")
|
||||
sb.WriteString(" - name: KUBERNETES_POD_IP\n")
|
||||
sb.WriteString(" valueFrom:\n")
|
||||
sb.WriteString(" fieldRef:\n")
|
||||
sb.WriteString(" fieldPath: status.podIP\n")
|
||||
sb.WriteString(" ports:\n")
|
||||
sb.WriteString(" - containerPort: 9001\n")
|
||||
sb.WriteString(" protocol: TCP\n")
|
||||
sb.WriteString(" resources:\n")
|
||||
sb.WriteString(" requests:\n")
|
||||
sb.WriteString(" memory: 64Mi\n")
|
||||
sb.WriteString(" cpu: 50m\n")
|
||||
sb.WriteString(" limits:\n")
|
||||
sb.WriteString(" memory: 256Mi\n")
|
||||
sb.WriteString(" cpu: 500m\n")
|
||||
sb.WriteString(" volumeMounts:\n")
|
||||
sb.WriteString(" - name: docker-certs\n")
|
||||
sb.WriteString(" mountPath: /certs\n")
|
||||
sb.WriteString(" readOnly: true\n")
|
||||
sb.WriteString(" volumes:\n")
|
||||
sb.WriteString(" - name: docker-certs\n")
|
||||
sb.WriteString(" emptyDir: {}\n")
|
||||
sb.WriteString(" tolerations:\n")
|
||||
sb.WriteString(" - operator: Exists\n")
|
||||
|
||||
return sb.String()
|
||||
}
|
||||
Reference in New Issue
Block a user