tormath1

Cluster API OpenStack using Flatcar

This is done on devstack environment.

Resources

• YouTube video: https://www.youtube.com/watch?v=H2Eqw33m2S0
• https://github.com/tormath1/tormath1.github.io/blob/main/kcd-munich-flatcar-capi.pdf

From an existing Kubernetes cluster deployed with Kind:

tormath1

# butane < config.yml > ignition.json
---
variant: flatcar
version: 1.0.0
storage:
  disks:
    - device: /dev/vda
      partitions:
        - number: 9
          label: ROOT

tormath1

The goal of this Gist is to run a Tor bridge from a Flatcar instance provisioned through Ignition - in this example, it's deployed locally with QEMU but it can be extend elsewhere (with Terraform and so on.)

Requirements:

• ct
• qemu setup

Pull the latest stable release of Flatcar:

tormath1

# ct --platform custom < ./config.yml | jq > ignition.json
systemd:
  units:
    - name: update-engine.service
      enable: true
    - name: etcd-member.service
      enable: true
    - name: locksmithd.service
      enable: true
      dropins:

tormath1

# ct --in-file ./config.yml --pretty > ./ignition.json
storage:
  files:
    - path: /var/lib/iptables/rules-save
      filesystem: root
      mode: 0644
      contents:
        inline: |
          *filter
          -A INPUT -p tcp --dport ssh -j ACCEPT

tormath1

sudo ./bin/kola run \
    --board arm64-usr \
    -d -v -b cl -p qemu \
    --qemu-image /home/mathieu/kinvolk/arm64/flatcar_production_image.bin \
    --qemu-bios=./flatcar_production_qemu_uefi_efi_code.fd \
    cl.internet
=== RUN   cl.internet/UpdateEngine
=== RUN   cl.internet/DockerPing
=== RUN   cl.internet/DockerEcho
=== RUN   cl.internet/NTPDate

tormath1

From dacbed2586288c5040e61c2856f455f64c35d39c Mon Sep 17 00:00:00 2001
From: Mathieu Tortuyaux <[email protected]>
Date: Tue, 20 Jul 2021 14:07:48 +0200
Subject: [PATCH] dev-lang/perl: apply tmp flatcar changes

temporary patch to fix https://github.com/Perl/perl5/issues/10651#issuecomment-882722892

Signed-off-by: Mathieu Tortuyaux <[email protected]>
---
 dev-lang/perl/files/define.patch | 11 +++++++++++

tormath1

--- services/virt.te
+++ services/virt.te
@@ -1377,3 +1377,31 @@ sysnet_dns_name_resolve(virtlogd_t)

 virt_manage_log(virtlogd_t)
 virt_read_config(virtlogd_t)
+
+require {
+	type kernel_t;
+	type tmpfs_t;

tormath1

diff --git a/eclass/selinux-policy-2.eclass b/eclass/selinux-policy-2.eclass
index 5def86fbe..8f69847a9 100644
--- a/eclass/selinux-policy-2.eclass
+++ b/eclass/selinux-policy-2.eclass
@@ -179,11 +179,12 @@ selinux-policy-2_src_prepare() {

 	# Apply the additional patches refered to by the module ebuild.
 	# But first some magic to differentiate between bash arrays and strings
-	if [[ "$(declare -p POLICY_PATCH 2>/dev/null 2>&1)" == "declare -a"* ]]; then
-		[[ -n ${POLICY_PATCH[*]} ]] && eapply -d "${S}/refpolicy/policy/modules" "${POLICY_PATCH[@]}"

tormath1

Usage example:

$ go run ./main.go -cvefile ./cves.txt | jq
[
  {
    "score": 5.9,
    "severity": "MEDIUM",
    "description": "A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability."
  },
  {