mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-13 04:51:00 +08:00
Drew Newberry
910d3f09f2
* feat(vm): boot sandboxes from ext4 root disks * feat(vm): boot sandboxes with writable overlay disk * fix(sandbox): improve sandbox provisioning behavior * fix(vm): repair sandbox image provisioning * fix(vm): clean up rebase fallout * perf(vm): cache empty overlay images * perf(vm): skip repeated sandbox ownership repair * fix(vm): address lifecycle review issues * fix(vm): repair gateway vm startup * wip
137 lines
5.0 KiB
Plaintext
137 lines
5.0 KiB
Plaintext
# Custom kernel config fragment for libkrunfw (OpenShell VM)
|
|
#
|
|
# This fragment is applied on top of libkrunfw's base kernel config
|
|
# to enable bridge CNI, netfilter/iptables, and conntrack support
|
|
# required for Kubernetes pod networking in the VM.
|
|
#
|
|
# Apply with: scripts/merge-kconfig.sh <base_config> <this_file>
|
|
#
|
|
# See also: check-vm-capabilities.sh for runtime verification.
|
|
|
|
# ── Root disk transport and filesystem ─────────────────────────────────
|
|
CONFIG_BLOCK=y
|
|
CONFIG_BLK_DEV=y
|
|
CONFIG_VIRTIO_BLK=y
|
|
CONFIG_EXT4_FS=y
|
|
CONFIG_EXT4_USE_FOR_EXT2=y
|
|
|
|
# ── Network Namespaces (required for pod isolation) ─────────────────────
|
|
CONFIG_NET_NS=y
|
|
CONFIG_NAMESPACES=y
|
|
|
|
# ── Virtual Ethernet (veth pairs for pod networking) ────────────────────
|
|
CONFIG_VETH=y
|
|
|
|
# ── Linux Bridge (required for bridge CNI plugin) ──────────────────────
|
|
CONFIG_BRIDGE=y
|
|
CONFIG_BRIDGE_NETFILTER=y
|
|
CONFIG_BRIDGE_IGMP_SNOOPING=y
|
|
|
|
# ── Netfilter framework ────────────────────────────────────────────────
|
|
CONFIG_NETFILTER=y
|
|
CONFIG_NETFILTER_ADVANCED=y
|
|
CONFIG_NETFILTER_INGRESS=y
|
|
CONFIG_NETFILTER_NETLINK=y
|
|
CONFIG_NETFILTER_NETLINK_QUEUE=y
|
|
CONFIG_NETFILTER_NETLINK_LOG=y
|
|
|
|
# ── Connection tracking (required for NAT and kube-proxy) ──────────────
|
|
CONFIG_NF_CONNTRACK=y
|
|
CONFIG_NF_CT_NETLINK=y
|
|
CONFIG_NF_CONNTRACK_EVENTS=y
|
|
CONFIG_NF_CONNTRACK_TIMEOUT=y
|
|
CONFIG_NF_CONNTRACK_TIMESTAMP=y
|
|
|
|
# ── Netfilter xtables match modules (required by kube-proxy & kubelet) ─
|
|
# kube-proxy uses xt_conntrack for stateful rules and xt_comment for
|
|
# labeling chains. Without these, iptables fails with:
|
|
# "Couldn't load match 'conntrack': No such file or directory"
|
|
CONFIG_NETFILTER_XTABLES=y
|
|
CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
|
|
CONFIG_NETFILTER_XT_MATCH_COMMENT=y
|
|
CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y
|
|
CONFIG_NETFILTER_XT_MATCH_MARK=y
|
|
CONFIG_NETFILTER_XT_MATCH_STATISTIC=y
|
|
CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y
|
|
CONFIG_NETFILTER_XT_MATCH_RECENT=y
|
|
CONFIG_NETFILTER_XT_MATCH_LIMIT=y
|
|
CONFIG_NETFILTER_XT_TARGET_LOG=y
|
|
CONFIG_NETFILTER_XT_TARGET_MARK=y
|
|
CONFIG_NETFILTER_XT_TARGET_CONNMARK=y
|
|
CONFIG_NETFILTER_XT_MATCH_CONNMARK=y
|
|
|
|
# ── NAT (required for service VIP / DNAT / SNAT) ──────────────────────
|
|
CONFIG_NF_NAT=y
|
|
CONFIG_NF_NAT_MASQUERADE_IPV4=y
|
|
|
|
# ── iptables (CNI bridge masquerade + compat) ──────────────────────────
|
|
CONFIG_IP_NF_IPTABLES=y
|
|
CONFIG_IP_NF_FILTER=y
|
|
CONFIG_IP_NF_NAT=y
|
|
CONFIG_IP_NF_MANGLE=y
|
|
CONFIG_IP_NF_TARGET_MASQUERADE=y
|
|
CONFIG_IP_NF_TARGET_REJECT=y
|
|
|
|
# ── nftables (kube-proxy nftables mode — primary proxy backend) ─────────
|
|
# kube-proxy nftables proxier requires: numgen (random LB), fib (local
|
|
# address detection), counter, ct, nat, masq, reject, limit, redir.
|
|
CONFIG_NF_TABLES=y
|
|
CONFIG_NF_TABLES_INET=y
|
|
CONFIG_NFT_CT=y
|
|
CONFIG_NFT_NAT=y
|
|
CONFIG_NFT_MASQ=y
|
|
CONFIG_NFT_REJECT=y
|
|
CONFIG_NFT_COMPAT=y
|
|
CONFIG_NFT_NUMGEN=y
|
|
CONFIG_NFT_FIB_IPV4=y
|
|
CONFIG_NFT_FIB_IPV6=y
|
|
CONFIG_NFT_LIMIT=y
|
|
CONFIG_NFT_LOG=y
|
|
CONFIG_NFT_REDIR=y
|
|
CONFIG_NFT_TPROXY=y
|
|
|
|
# ── IP forwarding and routing (required for pod-to-pod) ────────────────
|
|
CONFIG_IP_ADVANCED_ROUTER=y
|
|
CONFIG_IP_MULTIPLE_TABLES=y
|
|
CONFIG_IP_ROUTE_MULTIPATH=y
|
|
CONFIG_NET_IP_TUNNEL=y
|
|
|
|
# ── IPVS (optional: kube-proxy IPVS mode) ─────────────────────────────
|
|
CONFIG_IP_VS=y
|
|
CONFIG_IP_VS_PROTO_TCP=y
|
|
CONFIG_IP_VS_PROTO_UDP=y
|
|
CONFIG_IP_VS_RR=y
|
|
CONFIG_IP_VS_WRR=y
|
|
CONFIG_IP_VS_SH=y
|
|
CONFIG_IP_VS_NFCT=y
|
|
|
|
# ── Misc networking required by Kubernetes ─────────────────────────────
|
|
CONFIG_NET_SCH_HTB=y
|
|
CONFIG_NET_CLS_CGROUP=y
|
|
CONFIG_CGROUP_NET_PRIO=y
|
|
CONFIG_CGROUP_NET_CLASSID=y
|
|
|
|
# ── Dummy interface (fallback networking) ──────────────────────────────
|
|
CONFIG_DUMMY=y
|
|
|
|
# ── TUN/TAP (used by some CNI plugins) ────────────────────────────────
|
|
CONFIG_TUN=y
|
|
|
|
# ── Cgroups (already in base, ensure v2 is available) ──────────────────
|
|
CONFIG_CGROUPS=y
|
|
CONFIG_CGROUP_DEVICE=y
|
|
CONFIG_CGROUP_CPUACCT=y
|
|
CONFIG_CGROUP_PIDS=y
|
|
CONFIG_MEMCG=y
|
|
|
|
# ── Disable kernel headers archive (avoids cpio issues in CI) ──────────
|
|
# CONFIG_IKHEADERS is not set
|
|
|
|
# ── POSIX message queues (required by runc to mount /dev/mqueue in containers) ─
|
|
CONFIG_POSIX_MQUEUE=y
|
|
CONFIG_POSIX_MQUEUE_SYSCTL=y
|
|
|
|
# ── Security features required by the sandbox runtime ───────────────────
|
|
CONFIG_SECURITY_LANDLOCK=y
|
|
CONFIG_SECCOMP_FILTER=y
|