Adolfo Delorenzo
efc7f80b65
Security hardening: bind kubeconfig server to localhost, mount hardening (noexec/nosuid/nodev on tmpfs), sysctl network hardening, kernel module loading lock after boot, SHA256 checksum verification for downloads, kernel AppArmor + Audit support, complain-mode AppArmor profiles for containerd and kubelet, and security integration test. ARM64 Raspberry Pi support: piCore64 base extraction, RPi kernel build from raspberrypi/linux fork, RPi firmware fetch, SD card image with 4- partition GPT and tryboot A/B mechanism, BootEnv Go interface abstracting GRUB vs RPi boot environments, architecture-aware build scripts, QEMU aarch64 dev VM and boot test. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
109 lines
3.8 KiB
Bash
Executable File
109 lines
3.8 KiB
Bash
Executable File
#!/bin/sh
|
|
# 90-kubesolo.sh — Start KubeSolo (final init stage)
|
|
#
|
|
# Starts KubeSolo, waits for it to become ready, then prints the kubeconfig
|
|
# to the console so it can be copied for remote kubectl access.
|
|
|
|
KUBESOLO_BIN="/usr/bin/kubesolo"
|
|
|
|
if [ ! -x "$KUBESOLO_BIN" ]; then
|
|
log_err "KubeSolo binary not found at $KUBESOLO_BIN"
|
|
return 1
|
|
fi
|
|
|
|
# Build KubeSolo command line
|
|
KUBESOLO_ARGS="--path /var/lib/kubesolo --local-storage"
|
|
|
|
# Add SANs for remote access (127.0.0.1 for QEMU port forwarding, 10.0.2.15 for QEMU NAT)
|
|
EXTRA_SANS="127.0.0.1,10.0.2.15"
|
|
HOSTNAME="$(hostname)"
|
|
if [ -n "$HOSTNAME" ]; then
|
|
EXTRA_SANS="$EXTRA_SANS,$HOSTNAME"
|
|
fi
|
|
KUBESOLO_ARGS="$KUBESOLO_ARGS --apiserver-extra-sans $EXTRA_SANS"
|
|
|
|
# Add any extra flags from boot parameters
|
|
if [ -n "$KUBESOLO_EXTRA_FLAGS" ]; then
|
|
KUBESOLO_ARGS="$KUBESOLO_ARGS $KUBESOLO_EXTRA_FLAGS"
|
|
fi
|
|
|
|
# Add flags from persistent config file
|
|
if [ -f /etc/kubesolo/extra-flags ]; then
|
|
KUBESOLO_ARGS="$KUBESOLO_ARGS $(cat /etc/kubesolo/extra-flags)"
|
|
fi
|
|
|
|
# Pre-initialize iptables filter table and base chains.
|
|
# KubeSolo's kube-proxy uses iptables-restore (nf_tables backend) which needs
|
|
# the filter table to exist. Without this, the first iptables-restore fails
|
|
# with "RULE_APPEND failed (No such file or directory)".
|
|
if command -v iptables >/dev/null 2>&1; then
|
|
iptables -t filter -L -n >/dev/null 2>&1 || true
|
|
iptables -t nat -L -n >/dev/null 2>&1 || true
|
|
iptables -t mangle -L -n >/dev/null 2>&1 || true
|
|
log "Pre-initialized iptables tables (filter, nat, mangle)"
|
|
fi
|
|
|
|
# Export Portainer Edge env vars if set (via boot params or cloud-init)
|
|
if [ -n "${KUBESOLO_PORTAINER_EDGE_ID:-}" ]; then
|
|
export KUBESOLO_PORTAINER_EDGE_ID
|
|
log "Portainer Edge ID configured"
|
|
fi
|
|
if [ -n "${KUBESOLO_PORTAINER_EDGE_KEY:-}" ]; then
|
|
export KUBESOLO_PORTAINER_EDGE_KEY
|
|
log "Portainer Edge Key configured"
|
|
fi
|
|
|
|
log "Starting KubeSolo: $KUBESOLO_BIN $KUBESOLO_ARGS"
|
|
|
|
KUBECONFIG_PATH="/var/lib/kubesolo/pki/admin/admin.kubeconfig"
|
|
|
|
# Start KubeSolo in background so we can wait for readiness and print kubeconfig
|
|
# shellcheck disable=SC2086
|
|
$KUBESOLO_BIN $KUBESOLO_ARGS &
|
|
KUBESOLO_PID=$!
|
|
|
|
# Wait for kubeconfig to appear (KubeSolo generates it during startup)
|
|
log "Waiting for KubeSolo to generate kubeconfig..."
|
|
WAIT=0
|
|
while [ ! -f "$KUBECONFIG_PATH" ] && [ $WAIT -lt 120 ]; do
|
|
sleep 2
|
|
WAIT=$((WAIT + 2))
|
|
# Check KubeSolo is still running
|
|
if ! kill -0 $KUBESOLO_PID 2>/dev/null; then
|
|
log_err "KubeSolo exited unexpectedly"
|
|
wait $KUBESOLO_PID 2>/dev/null || true
|
|
return 1
|
|
fi
|
|
done
|
|
|
|
if [ -f "$KUBECONFIG_PATH" ]; then
|
|
log_ok "KubeSolo is running (PID $KUBESOLO_PID)"
|
|
|
|
# Rewrite server URL for external access and serve via HTTP.
|
|
# Serial console truncates long base64 cert lines, so we serve
|
|
# the kubeconfig over HTTP for reliable retrieval.
|
|
EXTERNAL_KC="/tmp/kubeconfig-external.yaml"
|
|
sed 's|server: https://.*:6443|server: https://localhost:6443|' "$KUBECONFIG_PATH" > "$EXTERNAL_KC"
|
|
|
|
# Serve kubeconfig via HTTP on port 8080 using BusyBox nc
|
|
(while true; do
|
|
printf "HTTP/1.1 200 OK\r\nContent-Type: text/yaml\r\nConnection: close\r\n\r\n" | cat - "$EXTERNAL_KC" | nc -l -s 127.0.0.1 -p 8080 2>/dev/null
|
|
done) &
|
|
|
|
log_ok "Kubeconfig available via HTTP"
|
|
echo ""
|
|
echo "============================================================"
|
|
echo " From your host machine, run:"
|
|
echo ""
|
|
echo " curl -s http://localhost:8080 > ~/.kube/kubesolo-config"
|
|
echo " kubectl --kubeconfig ~/.kube/kubesolo-config get nodes"
|
|
echo "============================================================"
|
|
echo ""
|
|
else
|
|
log_warn "Kubeconfig not found after ${WAIT}s — KubeSolo may still be starting"
|
|
log_warn "Check manually: cat $KUBECONFIG_PATH"
|
|
fi
|
|
|
|
# Keep init alive — wait on KubeSolo process
|
|
wait $KUBESOLO_PID
|