Adolfo Delorenzo
39732488ef
Build a custom Tiny Core 17.0 kernel (6.18.2) with missing configs that the stock kernel lacks for container workloads: - CONFIG_CGROUP_BPF=y (cgroup v2 device control via BPF) - CONFIG_DEVTMPFS=y (auto-create /dev device nodes) - CONFIG_DEVTMPFS_MOUNT=y (auto-mount devtmpfs) - CONFIG_MEMCG=y (memory cgroup controller for memory.max) - CONFIG_CFS_BANDWIDTH=y (CPU bandwidth throttling for cpu.max) Also strips unnecessary subsystems (sound, GPU, wireless, Bluetooth, KVM, etc.) for minimal footprint on a headless K8s edge appliance. Init system fixes for successful boot-to-running-pods: - Add switch_root in init.sh to escape initramfs (runc pivot_root) - Add mountpoint guards in 00-early-mount.sh (skip if already mounted) - Create essential device nodes after switch_root (kmsg, console, etc.) - Enable cgroup v2 controller delegation with init process isolation - Mount BPF filesystem for cgroup v2 device control - Add mknod fallback from sysfs in 20-persistent-mount.sh for /dev/vda - Move KubeSolo binary to /usr/bin (avoid /usr/local bind mount hiding) - Generate /etc/machine-id in 60-hostname.sh (kubelet requires it) - Pre-initialize iptables tables before kube-proxy starts - Add nft_reject, nft_fib, xt_nfacct to kernel modules list Build system changes: - New build-kernel.sh script for custom kernel compilation - Dockerfile.builder adds kernel build deps (flex, bison, libelf, etc.) - Selective kernel module install (only modules.list + transitive deps) - Install iptables-nft (xtables-nft-multi) + shared libs in rootfs Tested: ISO boots in QEMU, node reaches Ready in ~35s, CoreDNS and local-path-provisioner pods start and run successfully. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
80 lines
1.5 KiB
Plaintext
80 lines
1.5 KiB
Plaintext
# Kernel modules loaded at boot by init
|
|
# One module per line. Lines starting with # are ignored.
|
|
# Modules are loaded in order listed — dependencies must come first.
|
|
|
|
# Network device drivers (loaded early so interfaces are available)
|
|
e1000
|
|
e1000e
|
|
virtio_net
|
|
|
|
# Virtio support (for VMs — block, entropy)
|
|
virtio_blk
|
|
virtio_rng
|
|
|
|
# Filesystem — overlay (required for containerd)
|
|
overlay
|
|
|
|
# Netfilter dependencies (must load before conntrack)
|
|
nf_defrag_ipv4
|
|
nf_defrag_ipv6
|
|
|
|
# Netfilter / connection tracking (required for kube-proxy)
|
|
nf_conntrack
|
|
nf_nat
|
|
nf_conntrack_netlink
|
|
|
|
# nftables (modern iptables backend — kernel 6.18 uses nf_tables, not ip_tables)
|
|
nf_tables
|
|
nft_compat
|
|
nft_chain_nat
|
|
nft_ct
|
|
nft_masq
|
|
nft_nat
|
|
nft_redir
|
|
|
|
# Netfilter xt match/target modules (used by kube-proxy iptables rules via nft_compat)
|
|
xt_conntrack
|
|
xt_MASQUERADE
|
|
xt_mark
|
|
xt_comment
|
|
xt_multiport
|
|
xt_nat
|
|
xt_addrtype
|
|
xt_connmark
|
|
xt_REDIRECT
|
|
xt_recent
|
|
xt_statistic
|
|
xt_set
|
|
|
|
# nft extras (reject, fib — used by kube-proxy nf_tables rules)
|
|
nft_reject
|
|
nft_reject_ipv4
|
|
nft_reject_ipv6
|
|
nft_fib
|
|
nft_fib_ipv4
|
|
nft_fib_ipv6
|
|
|
|
# Reject targets (used by kube-proxy iptables-restore rules)
|
|
nf_reject_ipv4
|
|
nf_reject_ipv6
|
|
ipt_REJECT
|
|
ip6t_REJECT
|
|
|
|
# nfacct extension (kube-proxy probes for it)
|
|
xt_nfacct
|
|
|
|
# Networking — bridge and netfilter (required for K8s pod networking)
|
|
# Load order: llc → stp → bridge → br_netfilter
|
|
llc
|
|
stp
|
|
bridge
|
|
br_netfilter
|
|
veth
|
|
vxlan
|
|
|
|
# IPVS — useful for kube-proxy IPVS mode and CNI plugins
|
|
ip_vs
|
|
ip_vs_rr
|
|
ip_vs_wrr
|
|
ip_vs_sh
|