mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-25 06:42:52 +08:00
Russell Bryant
c27dd88aa9
The nftables log statement requires CONFIG_NFT_LOG, which was not included in the VM guest kernel config. Without it, nft rejects rules containing the log keyword with "No such file or directory".
130 lines
4.7 KiB
Plaintext
130 lines
4.7 KiB
Plaintext
# Custom kernel config fragment for libkrunfw (OpenShell VM)
|
|
#
|
|
# This fragment is applied on top of libkrunfw's base kernel config
|
|
# to enable bridge CNI, netfilter/iptables, and conntrack support
|
|
# required for Kubernetes pod networking in the VM.
|
|
#
|
|
# Apply with: scripts/merge-kconfig.sh <base_config> <this_file>
|
|
#
|
|
# See also: check-vm-capabilities.sh for runtime verification.
|
|
|
|
# ── Network Namespaces (required for pod isolation) ─────────────────────
|
|
CONFIG_NET_NS=y
|
|
CONFIG_NAMESPACES=y
|
|
|
|
# ── Virtual Ethernet (veth pairs for pod networking) ────────────────────
|
|
CONFIG_VETH=y
|
|
|
|
# ── Linux Bridge (required for bridge CNI plugin) ──────────────────────
|
|
CONFIG_BRIDGE=y
|
|
CONFIG_BRIDGE_NETFILTER=y
|
|
CONFIG_BRIDGE_IGMP_SNOOPING=y
|
|
|
|
# ── Netfilter framework ────────────────────────────────────────────────
|
|
CONFIG_NETFILTER=y
|
|
CONFIG_NETFILTER_ADVANCED=y
|
|
CONFIG_NETFILTER_INGRESS=y
|
|
CONFIG_NETFILTER_NETLINK=y
|
|
CONFIG_NETFILTER_NETLINK_QUEUE=y
|
|
CONFIG_NETFILTER_NETLINK_LOG=y
|
|
|
|
# ── Connection tracking (required for NAT and kube-proxy) ──────────────
|
|
CONFIG_NF_CONNTRACK=y
|
|
CONFIG_NF_CT_NETLINK=y
|
|
CONFIG_NF_CONNTRACK_EVENTS=y
|
|
CONFIG_NF_CONNTRACK_TIMEOUT=y
|
|
CONFIG_NF_CONNTRACK_TIMESTAMP=y
|
|
|
|
# ── Netfilter xtables match modules (required by kube-proxy & kubelet) ─
|
|
# kube-proxy uses xt_conntrack for stateful rules and xt_comment for
|
|
# labeling chains. Without these, iptables fails with:
|
|
# "Couldn't load match 'conntrack': No such file or directory"
|
|
CONFIG_NETFILTER_XTABLES=y
|
|
CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
|
|
CONFIG_NETFILTER_XT_MATCH_COMMENT=y
|
|
CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y
|
|
CONFIG_NETFILTER_XT_MATCH_MARK=y
|
|
CONFIG_NETFILTER_XT_MATCH_STATISTIC=y
|
|
CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y
|
|
CONFIG_NETFILTER_XT_MATCH_RECENT=y
|
|
CONFIG_NETFILTER_XT_MATCH_LIMIT=y
|
|
CONFIG_NETFILTER_XT_TARGET_LOG=y
|
|
CONFIG_NETFILTER_XT_TARGET_MARK=y
|
|
CONFIG_NETFILTER_XT_TARGET_CONNMARK=y
|
|
CONFIG_NETFILTER_XT_MATCH_CONNMARK=y
|
|
|
|
# ── NAT (required for service VIP / DNAT / SNAT) ──────────────────────
|
|
CONFIG_NF_NAT=y
|
|
CONFIG_NF_NAT_MASQUERADE_IPV4=y
|
|
|
|
# ── iptables (CNI bridge masquerade + compat) ──────────────────────────
|
|
CONFIG_IP_NF_IPTABLES=y
|
|
CONFIG_IP_NF_FILTER=y
|
|
CONFIG_IP_NF_NAT=y
|
|
CONFIG_IP_NF_MANGLE=y
|
|
CONFIG_IP_NF_TARGET_MASQUERADE=y
|
|
CONFIG_IP_NF_TARGET_REJECT=y
|
|
|
|
# ── nftables (kube-proxy nftables mode — primary proxy backend) ─────────
|
|
# kube-proxy nftables proxier requires: numgen (random LB), fib (local
|
|
# address detection), counter, ct, nat, masq, reject, limit, redir.
|
|
CONFIG_NF_TABLES=y
|
|
CONFIG_NF_TABLES_INET=y
|
|
CONFIG_NFT_CT=y
|
|
CONFIG_NFT_NAT=y
|
|
CONFIG_NFT_MASQ=y
|
|
CONFIG_NFT_REJECT=y
|
|
CONFIG_NFT_COMPAT=y
|
|
CONFIG_NFT_NUMGEN=y
|
|
CONFIG_NFT_FIB_IPV4=y
|
|
CONFIG_NFT_FIB_IPV6=y
|
|
CONFIG_NFT_LIMIT=y
|
|
CONFIG_NFT_LOG=y
|
|
CONFIG_NFT_REDIR=y
|
|
CONFIG_NFT_TPROXY=y
|
|
|
|
# ── IP forwarding and routing (required for pod-to-pod) ────────────────
|
|
CONFIG_IP_ADVANCED_ROUTER=y
|
|
CONFIG_IP_MULTIPLE_TABLES=y
|
|
CONFIG_IP_ROUTE_MULTIPATH=y
|
|
CONFIG_NET_IP_TUNNEL=y
|
|
|
|
# ── IPVS (optional: kube-proxy IPVS mode) ─────────────────────────────
|
|
CONFIG_IP_VS=y
|
|
CONFIG_IP_VS_PROTO_TCP=y
|
|
CONFIG_IP_VS_PROTO_UDP=y
|
|
CONFIG_IP_VS_RR=y
|
|
CONFIG_IP_VS_WRR=y
|
|
CONFIG_IP_VS_SH=y
|
|
CONFIG_IP_VS_NFCT=y
|
|
|
|
# ── Misc networking required by Kubernetes ─────────────────────────────
|
|
CONFIG_NET_SCH_HTB=y
|
|
CONFIG_NET_CLS_CGROUP=y
|
|
CONFIG_CGROUP_NET_PRIO=y
|
|
CONFIG_CGROUP_NET_CLASSID=y
|
|
|
|
# ── Dummy interface (fallback networking) ──────────────────────────────
|
|
CONFIG_DUMMY=y
|
|
|
|
# ── TUN/TAP (used by some CNI plugins) ────────────────────────────────
|
|
CONFIG_TUN=y
|
|
|
|
# ── Cgroups (already in base, ensure v2 is available) ──────────────────
|
|
CONFIG_CGROUPS=y
|
|
CONFIG_CGROUP_DEVICE=y
|
|
CONFIG_CGROUP_CPUACCT=y
|
|
CONFIG_CGROUP_PIDS=y
|
|
CONFIG_MEMCG=y
|
|
|
|
# ── Disable kernel headers archive (avoids cpio issues in CI) ──────────
|
|
# CONFIG_IKHEADERS is not set
|
|
|
|
# ── POSIX message queues (required by runc to mount /dev/mqueue in containers) ─
|
|
CONFIG_POSIX_MQUEUE=y
|
|
CONFIG_POSIX_MQUEUE_SYSCTL=y
|
|
|
|
# ── Security features required by the sandbox runtime ───────────────────
|
|
CONFIG_SECURITY_LANDLOCK=y
|
|
CONFIG_SECCOMP_FILTER=y
|