Adolfo Delorenzo
efc7f80b65
Security hardening: bind kubeconfig server to localhost, mount hardening (noexec/nosuid/nodev on tmpfs), sysctl network hardening, kernel module loading lock after boot, SHA256 checksum verification for downloads, kernel AppArmor + Audit support, complain-mode AppArmor profiles for containerd and kubelet, and security integration test. ARM64 Raspberry Pi support: piCore64 base extraction, RPi kernel build from raspberrypi/linux fork, RPi firmware fetch, SD card image with 4- partition GPT and tryboot A/B mechanism, BootEnv Go interface abstracting GRUB vs RPi boot environments, architecture-aware build scripts, QEMU aarch64 dev VM and boot test. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
70 lines
1.4 KiB
Plaintext
70 lines
1.4 KiB
Plaintext
# KubeSolo OS — Raspberry Pi kernel config overrides
|
|
# Applied on top of bcm2711_defconfig (Pi 4) or bcm2712_defconfig (Pi 5)
|
|
# These ensure container runtime support is enabled.
|
|
|
|
# cgroup v2 (mandatory for containerd/runc)
|
|
CONFIG_CGROUPS=y
|
|
CONFIG_CGROUP_CPUACCT=y
|
|
CONFIG_CGROUP_DEVICE=y
|
|
CONFIG_CGROUP_FREEZER=y
|
|
CONFIG_CGROUP_SCHED=y
|
|
CONFIG_CGROUP_PIDS=y
|
|
CONFIG_MEMCG=y
|
|
CONFIG_CGROUP_BPF=y
|
|
CONFIG_CFS_BANDWIDTH=y
|
|
|
|
# BPF (required for cgroup v2 device control)
|
|
CONFIG_BPF=y
|
|
CONFIG_BPF_SYSCALL=y
|
|
|
|
# Namespaces (mandatory for containers)
|
|
CONFIG_NAMESPACES=y
|
|
CONFIG_NET_NS=y
|
|
CONFIG_PID_NS=y
|
|
CONFIG_USER_NS=y
|
|
CONFIG_UTS_NS=y
|
|
CONFIG_IPC_NS=y
|
|
|
|
# Device management
|
|
CONFIG_DEVTMPFS=y
|
|
CONFIG_DEVTMPFS_MOUNT=y
|
|
|
|
# Filesystem
|
|
CONFIG_OVERLAY_FS=y
|
|
CONFIG_SQUASHFS=y
|
|
CONFIG_EXT4_FS=y
|
|
CONFIG_VFAT_FS=y
|
|
|
|
# Networking
|
|
CONFIG_BRIDGE=m
|
|
CONFIG_NETFILTER=y
|
|
CONFIG_NF_CONNTRACK=m
|
|
CONFIG_NF_NAT=m
|
|
CONFIG_NF_TABLES=m
|
|
CONFIG_VETH=m
|
|
CONFIG_VXLAN=m
|
|
|
|
# Security: AppArmor + Audit
|
|
CONFIG_AUDIT=y
|
|
CONFIG_AUDITSYSCALL=y
|
|
CONFIG_SECURITY=y
|
|
CONFIG_SECURITYFS=y
|
|
CONFIG_SECURITY_NETWORK=y
|
|
CONFIG_SECURITY_APPARMOR=y
|
|
CONFIG_DEFAULT_SECURITY_APPARMOR=y
|
|
|
|
# Security: seccomp
|
|
CONFIG_SECCOMP=y
|
|
CONFIG_SECCOMP_FILTER=y
|
|
|
|
# Crypto (image verification)
|
|
CONFIG_CRYPTO_SHA256=y
|
|
|
|
# Disable unnecessary subsystems for edge appliance
|
|
# CONFIG_SOUND is not set
|
|
# CONFIG_DRM is not set
|
|
# CONFIG_MEDIA_SUPPORT is not set
|
|
# CONFIG_WIRELESS is not set
|
|
# CONFIG_BT is not set
|
|
# CONFIG_NFC is not set
|