Security hardening: bind kubeconfig server to localhost, mount hardening (noexec/nosuid/nodev on tmpfs), sysctl network hardening, kernel module loading lock after boot, SHA256 checksum verification for downloads, kernel AppArmor + Audit support, complain-mode AppArmor profiles for containerd and kubelet, and security integration test. ARM64 Raspberry Pi support: piCore64 base extraction, RPi kernel build from raspberrypi/linux fork, RPi firmware fetch, SD card image with 4- partition GPT and tryboot A/B mechanism, BootEnv Go interface abstracting GRUB vs RPi boot environments, architecture-aware build scripts, QEMU aarch64 dev VM and boot test. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
81 lines
1.5 KiB
Go
81 lines
1.5 KiB
Go
package cmd
|
|
|
|
import (
|
|
"github.com/portainer/kubesolo-os/update/pkg/bootenv"
|
|
)
|
|
|
|
// opts holds shared command-line options for all subcommands.
|
|
type opts struct {
|
|
ServerURL string
|
|
GrubenvPath string
|
|
TimeoutSecs int
|
|
PubKeyPath string
|
|
BootEnvType string // "grub" or "rpi"
|
|
BootEnvPath string // path for RPi boot control dir
|
|
}
|
|
|
|
// NewBootEnv creates a BootEnv from the parsed options.
|
|
func (o opts) NewBootEnv() bootenv.BootEnv {
|
|
switch o.BootEnvType {
|
|
case "rpi":
|
|
return bootenv.NewRPi(o.BootEnvPath)
|
|
default:
|
|
return bootenv.NewGRUB(o.GrubenvPath)
|
|
}
|
|
}
|
|
|
|
// parseOpts extracts command-line flags from args.
|
|
// Simple parser — no external dependencies.
|
|
func parseOpts(args []string) opts {
|
|
o := opts{
|
|
GrubenvPath: "/boot/grub/grubenv",
|
|
TimeoutSecs: 120,
|
|
BootEnvType: "grub",
|
|
}
|
|
|
|
for i := 0; i < len(args); i++ {
|
|
switch args[i] {
|
|
case "--server":
|
|
if i+1 < len(args) {
|
|
o.ServerURL = args[i+1]
|
|
i++
|
|
}
|
|
case "--grubenv":
|
|
if i+1 < len(args) {
|
|
o.GrubenvPath = args[i+1]
|
|
i++
|
|
}
|
|
case "--timeout":
|
|
if i+1 < len(args) {
|
|
val := 0
|
|
for _, c := range args[i+1] {
|
|
if c >= '0' && c <= '9' {
|
|
val = val*10 + int(c-'0')
|
|
}
|
|
}
|
|
if val > 0 {
|
|
o.TimeoutSecs = val
|
|
}
|
|
i++
|
|
}
|
|
case "--pubkey":
|
|
if i+1 < len(args) {
|
|
o.PubKeyPath = args[i+1]
|
|
i++
|
|
}
|
|
case "--bootenv":
|
|
if i+1 < len(args) {
|
|
o.BootEnvType = args[i+1]
|
|
i++
|
|
}
|
|
case "--bootenv-path":
|
|
if i+1 < len(args) {
|
|
o.BootEnvPath = args[i+1]
|
|
i++
|
|
}
|
|
}
|
|
}
|
|
|
|
return o
|
|
}
|