caa: adjust peer-pod image to immutable /etc

edgelesssys · Dec 13, 2024 · 2aa1e0d · 2aa1e0d
1 parent 8b6d35c
commit 2aa1e0d
Show file tree

Hide file tree

Showing 5 changed files with 16 additions and 74 deletions.
diff --git a/packages/by-name/kernel-podvm-azure/0001-azure-fix-sublevel.patch b/packages/by-name/kernel-podvm-azure/0001-azure-fix-sublevel.patch
diff --git a/packages/by-name/kernel-podvm-azure/package.nix b/packages/by-name/kernel-podvm-azure/package.nix
diff --git a/packages/by-name/mkNixosConfig/package.nix b/packages/by-name/mkNixosConfig/package.nix
@@ -39,7 +39,6 @@ lib.makeOverridable (
           inherit (outerPkgs)
             azure-no-agent
             cloud-api-adaptor
-            kernel-podvm-azure
             pause-bundle
             nvidia-ctk-oci-hook
             nvidia-ctk-with-config

diff --git a/packages/nixos/azure.nix b/packages/nixos/azure.nix
@@ -55,7 +55,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    boot.kernelPackages = pkgs.recurseIntoAttrs (pkgs.linuxPackagesFor pkgs.kernel-podvm-azure);
+    # TODO(burgerdev): find a recent kernel tailored for Azure.
+    boot.kernelPackages = pkgs.linuxPackages_latest;
 
     boot.initrd = {
       kernelModules = [

diff --git a/packages/nixos/peerpods.nix b/packages/nixos/peerpods.nix
@@ -97,6 +97,20 @@ in
         ExecStop = "${pkgs.iproute2}/bin/ip netns del %I";
       };
     };
+    # Contrary to bare-metal, a peer pod needs regular network access and DNS. The default setup
+    # with dhcpcd and resolvconf does not play well with the immutable /etc, so we use the full
+    # systemd stack instead.
+    networking.dhcpcd.enable = false;
+    systemd.network.enable = true;
+    networking.useNetworkd = true;
+    services.resolved.enable = true;
+
+    # The /etc/machine-id should be populated by systemd, but the immutable /etc seems to prevent
+    # that. However, systemd-networkd requires this file to exist, so we add an empty file which
+    # will then be bind-mounted over by systemd. Let's hope no important services are gated on
+    # first-boot.
+    # https://www.man7.org/linux//man-pages/man5/machine-id.5.html#FIRST_BOOT_SEMANTICS
+    environment.etc."machine-id".text = "uninitialized";
 
     environment.etc."kata-opa/default-policy.rego".source = pkgs.cloud-api-adaptor.default-policy;
   };