Skip to content

Commit 352173a

Browse files
christophercochristopherco
authored
osguard-amd64: initial config (#14439)
Introduce new osguard-amd64.yaml with the intent is to create a more full-featured Azure Linux OS Guard base image. This yaml file is expected to be used with Azure Linux Image Customizer, starting from a base image like the minimal-os base image, and will yield this new Azure Linux OS Guard image. To help with migration from Ubuntu hosts to Azure Linux OS guard host, create a directory at the /usr/local/share/ca-certificates location to allow containers/pods to mount certs there at runtime. Signed-off-by: Chris Co <[email protected]>
1 parent df10332 commit 352173a

25 files changed

+569
-7
lines changed

‎toolkit/imageconfigs/files/common/99-dhcp-eth0.network

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
[Match]
2+
Name=eth0
3+
4+
[Network]
5+
DHCP=yes
6+
IPv6AcceptRA=no

‎toolkit/imageconfigs/files/osguard/10-repart.conf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
add_dracutmodules+=" systemd-repart "

‎toolkit/imageconfigs/files/osguard/additional-repo-files.repo

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
[azurelinux-cloud-native]
2+
name=Azure Linux Cloud Native $releasever $basearch
3+
baseurl=https://packages.microsoft.com/azurelinux/$releasever/prod/cloud-native/$basearch
4+
gpgkey=file:///etc/pki/rpm-gpg/MICROSOFT-RPM-GPG-KEY
5+
gpgcheck=1
6+
repo_gpgcheck=1
7+
enabled=1
8+
skip_if_unavailable=True
9+
sslverify=1
10+
11+
[azurelinux-official-extended]
12+
name=Azure Linux Official Extended $releasever $basearch
13+
baseurl=https://packages.microsoft.com/azurelinux/$releasever/prod/extended/$basearch
14+
gpgkey=file:///etc/pki/rpm-gpg/MICROSOFT-RPM-GPG-KEY
15+
gpgcheck=1
16+
repo_gpgcheck=1
17+
enabled=1
18+
skip_if_unavailable=True
19+
sslverify=1

‎toolkit/imageconfigs/files/osguard/chrony.conf

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
# CLOUD_IMG: This file was created/modified by the Cloud Image build process
2+
# Welcome to the chrony configuration file. See chrony.conf(5) for more
3+
# information about usable directives.
4+
# Include configuration files found in /etc/chrony.conf.d.
5+
confdir /etc/chrony.conf.d
6+
# This will use (up to):
7+
# - 4 sources from ntp.ubuntu.com which some are ipv6 enabled
8+
# - 2 sources from 2.ubuntu.pool.ntp.org which is ipv6 enabled as well
9+
# - 1 source from [01].ubuntu.pool.ntp.org each (ipv4 only atm)
10+
# This means by default, up to 6 dual-stack and up to 2 additional IPv4-only
11+
# sources will be used.
12+
# At the same time it retains some protection against one of the entries being
13+
# down (compare to just using one of the lines). See (LP: #1754358) for the
14+
# discussion.
15+
#
16+
# About using servers from the NTP Pool Project in general see (LP: #104525).
17+
# Approved by Ubuntu Technical Board on 2011-02-08.
18+
# See http://www.pool.ntp.org/join.html for more information.
19+
#pool ntp.ubuntu.com iburst maxsources 4
20+
#pool 0.ubuntu.pool.ntp.org iburst maxsources 1
21+
#pool 1.ubuntu.pool.ntp.org iburst maxsources 1
22+
#pool 2.ubuntu.pool.ntp.org iburst maxsources 2
23+
# Use time sources from DHCP.
24+
sourcedir /run/chrony-dhcp
25+
# This directive specify the location of the file containing ID/key pairs for
26+
# NTP authentication.
27+
keyfile /etc/chrony.keys
28+
# This directive specify the file into which chronyd will store the rate
29+
# information.
30+
driftfile /var/lib/chrony/drift
31+
# Save NTS keys and cookies.
32+
ntsdumpdir /var/lib/chrony
33+
# Uncomment the following line to turn logging on.
34+
#log tracking measurements statistics
35+
# Log files location.
36+
logdir /var/log/chrony
37+
# Stop bad estimates upsetting machine clock.
38+
maxupdateskew 100.0
39+
# This directive enables kernel synchronisation (every 11 minutes) of the
40+
# real-time clock. Note that it can’t be used along with the 'rtcfile' directive.
41+
rtcsync
42+
# Step the system clock instead of slewing it if the adjustment is larger than
43+
# one second, with no limit to how many clock updates have occurred.
44+
makestep 1.0 -1
45+
# Get TAI-UTC offset and leap seconds from the system tz database.
46+
# This directive must be commented out when using time sources serving
47+
# leap-smeared time.
48+
leapsectz right/UTC
49+
# Azure hosts are synchronized to internal Microsoft time servers that
50+
# take their time from Microsoft-owned Stratum 1 devices. The Hyper-V
51+
# drivers surface this time source as a PTP-based time source in the
52+
# guest. This configures chrony to use it. This also causes chronyd
53+
# to require the /dev/ptp_hyperv device; chronyd will fail to start if
54+
# it is not present. If this line is removed (so chronyd no longer
55+
# uses the /dev/ptp_hyperv device), also remove (or comment out) the
56+
# /etc/systemd/system/chronyd.service.d/wait-for-ptp-hyperv.conf file.
57+
refclock PHC /dev/ptp_hyperv poll 3 dpoll -2 offset 0

‎toolkit/imageconfigs/files/osguard/cloud.cfg

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
# The top level settings are used as module
2+
# and base configuration.
3+
4+
# A set of users which may be applied and/or used by various modules
5+
# when a 'default' entry is found it will reference the 'default_user'
6+
# from the distro configuration specified below
7+
# users:
8+
# - default
9+
10+
# If this is set, 'root' will not be able to ssh in and they
11+
# will get a message to login instead as the default $user
12+
# disable_root: false
13+
14+
# This will cause the set+update hostname module to not operate (if true)
15+
# preserve_hostname: false
16+
17+
# If you use datasource_list array, keep array items in a single line.
18+
# If you use multi line array, ds-identify script won't read array items.
19+
# Example datasource config
20+
datasource:
21+
Azure:
22+
apply_network_config: false
23+
# Ec2:
24+
# metadata_urls: [ 'blah.com' ]
25+
# timeout: 5 # (defaults to 50 seconds)
26+
# max_wait: 10 # (defaults to 120 seconds)
27+
28+
# The modules that run in the 'init' stage
29+
cloud_init_modules:
30+
# - seed_random
31+
# - bootcmd
32+
# - write_files
33+
# - growpart
34+
# - resizefs
35+
- disk_setup
36+
- mounts
37+
- set_hostname
38+
# - update_hostname
39+
# - update_etc_hosts
40+
# - ca_certs
41+
# - rsyslog
42+
# - users_groups
43+
# - ssh
44+
# - set_passwords
45+
46+
# The modules that run in the 'config' stage
47+
# cloud_config_modules:
48+
# - ssh_import_id
49+
# - keyboard
50+
# - locale
51+
# - spacewalk
52+
# - yum_add_repo
53+
# - ntp
54+
# - timezone
55+
# - disable_ec2_metadata
56+
# - runcmd
57+
58+
# The modules that run in the 'final' stage
59+
# cloud_final_modules:
60+
# - package_update_upgrade_install
61+
# - write_files_deferred
62+
# - puppet
63+
# - chef
64+
# - ansible
65+
# - mcollective
66+
# - salt_minion
67+
# - reset_rmc
68+
# - scripts_vendor
69+
# - scripts_per_once
70+
# - scripts_per_boot
71+
# - scripts_per_instance
72+
# - scripts_user
73+
# - ssh_authkey_fingerprints
74+
# - keys_to_console
75+
# - install_hotplug
76+
# - phone_home
77+
# - final_message
78+
# - power_state_change
79+
80+
# System and/or distro specific settings
81+
# (not accessible to handlers/transforms)
82+
# system_info:
83+
# # This will affect which distro class gets used
84+
# distro: azurelinux
85+
# # Default user name + that default users groups (if added/used)
86+
# default_user:
87+
# name: azurelinux
88+
# lock_passwd: True
89+
# gecos: Azure Linux
90+
# groups: [wheel]
91+
# sudo: ["ALL=(ALL) NOPASSWD:ALL"]
92+
# shell: /bin/bash
93+
# # network:
94+
# # renderers: ['networkd']
95+
# # # Other config here will be given to the distro class and/or path classes
96+
# # paths:
97+
# # cloud_dir: /var/lib/cloud/
98+
# # templates_dir: /etc/cloud/templates/
99+
# ssh_svcname: sshd

‎toolkit/imageconfigs/files/osguard/repart.d/10-esp.conf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
[Partition]
2+
Type=esp
3+
Label=esp
4+
SizeMinBytes=512M
5+
SizeMaxBytes=512M

‎toolkit/imageconfigs/files/osguard/repart.d/11-boot-a.conf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
[Partition]
2+
Type=linux-generic
3+
Label=boot-a
4+
SizeMinBytes=100M
5+
SizeMaxBytes=100M

‎toolkit/imageconfigs/files/osguard/repart.d/12-usr-a.conf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
[Partition]
2+
Type=usr
3+
Label=usr-a
4+
SizeMinBytes=1G
5+
SizeMaxBytes=1G

‎toolkit/imageconfigs/files/osguard/repart.d/13-usr-hash-a.conf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
[Partition]
2+
Type=usr-verity
3+
Label=usr-hash-a
4+
SizeMinBytes=128M
5+
SizeMaxBytes=128M

‎toolkit/imageconfigs/files/osguard/repart.d/14-root-a.conf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
[Partition]
2+
Type=root
3+
Label=root-a
4+
SizeMinBytes=10G
5+
Weight=1000
6+
GrowFileSystem=true

0 commit comments

Comments
 (0)