podvm: add scratch-space logic

This adds the configuration for an encrypted scratch space in /dev/sda4 on an mkosi image. If the image has space available it will create a "scratch" partition and encrypt it using an adhoc LUKS key. An empty `/run/peerpod/mount-scratch` file is being added to the write-files directive of userdata, if a disk size param has been set. In this case kata-agent will mount the encrypted scratch space to `/run/kata-containers` prior to startup. Signed-off-by: Magnus Kulke <[email protected]>
confidential-containers · Dec 16, 2024 · c19898a · c19898a
1 parent ae1e3c7
commit c19898a
Show file tree

Hide file tree

Showing 11 changed files with 10 additions and 1 deletion.
diff --git a/src/cloud-api-adaptor/podvm-mkosi/mkosi.presets/system/mkosi.conf.d/fedora.conf b/src/cloud-api-adaptor/podvm-mkosi/mkosi.presets/system/mkosi.conf.d/fedora.conf
@@ -7,7 +7,7 @@ Release=40
 
 [Content]
 CleanPackageMetadata=true
-SkeletonTrees=../../resources/binaries-tree
+SkeletonTrees=../../mkosi.skeleton-rootfs,../../resources/binaries-tree,
 Packages=
     kernel
     kernel-core
@@ -23,6 +23,7 @@ Packages=
     iptables
     afterburn
     neofetch
+    e2fsprogs
 
 RemoveFiles=/etc/issue
 RemoveFiles=/etc/issue.net

diff --git a/src/cloud-api-adaptor/podvm-mkosi/mkosi.skeleton-rootfs/etc/crypttab b/src/cloud-api-adaptor/podvm-mkosi/mkosi.skeleton-rootfs/etc/crypttab
@@ -0,0 +1 @@
+scratch /dev/disk/by-label/scratch - try-empty-password
diff --git a/...si/mkosi.skeleton/etc/neofetch/coco.ascii → ...i.skeleton-rootfs/etc/neofetch/coco.ascii b/...si/mkosi.skeleton/etc/neofetch/coco.ascii → ...i.skeleton-rootfs/etc/neofetch/coco.ascii
diff --git a/...i/mkosi.skeleton/etc/neofetch/config.conf → ....skeleton-rootfs/etc/neofetch/config.conf b/...i/mkosi.skeleton/etc/neofetch/config.conf → ....skeleton-rootfs/etc/neofetch/config.conf
diff --git a/.../mkosi.skeleton/etc/profile.d/10-alias.sh → ...skeleton-rootfs/etc/profile.d/10-alias.sh b/.../mkosi.skeleton/etc/profile.d/10-alias.sh → ...skeleton-rootfs/etc/profile.d/10-alias.sh
diff --git a/...i.skeleton/etc/profile.d/20-ssh-banner.sh → ...ton-rootfs/etc/profile.d/20-ssh-banner.sh b/...i.skeleton/etc/profile.d/20-ssh-banner.sh → ...ton-rootfs/etc/profile.d/20-ssh-banner.sh
diff --git a/...erburn-checkin.service.d/10-override.conf → ...erburn-checkin.service.d/10-override.conf b/...erburn-checkin.service.d/10-override.conf → ...erburn-checkin.service.d/10-override.conf
diff --git a/.../usr/lib/systemd/system/gen-issue.service → .../usr/lib/systemd/system/gen-issue.service b/.../usr/lib/systemd/system/gen-issue.service → .../usr/lib/systemd/system/gen-issue.service
diff --git a/...-mkosi/mkosi.skeleton-rootfs/usr/lib/systemd/system/kata-agent.service.d/10-override.conf b/...-mkosi/mkosi.skeleton-rootfs/usr/lib/systemd/system/kata-agent.service.d/10-override.conf
@@ -0,0 +1,2 @@
+[Service]
+ExecStartPre=sh -c '[[ -f /run/peerpod/mount-scratch ]] && mount /dev/mapper/scratch /run/kata-containers'
diff --git a/...cess-user-data.service.d/10-override.conf → ...cess-user-data.service.d/10-override.conf b/...cess-user-data.service.d/10-override.conf → ...cess-user-data.service.d/10-override.conf
diff --git a/src/cloud-api-adaptor/podvm-mkosi/mkosi.skeleton/usr/lib/repart.d/30-scratch.conf b/src/cloud-api-adaptor/podvm-mkosi/mkosi.skeleton/usr/lib/repart.d/30-scratch.conf
@@ -0,0 +1,5 @@
+[Partition]
+Type=linux-generic
+Label=scratch
+Encrypt=key-file
+Format=ext4
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		scratch /dev/disk/by-label/scratch - try-empty-password
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		[Service]
		ExecStartPre=sh -c '[[ -f /run/peerpod/mount-scratch ]] && mount /dev/mapper/scratch /run/kata-containers'