From 6983d8274b190abf4fd85596f8763901edbff062 Mon Sep 17 00:00:00 2001 From: Petr Evstifeev Date: Thu, 2 Jul 2026 06:26:36 -0500 Subject: [PATCH 1/2] pki-measuruments service --- src/Dockerfile | 9 ++++++++- .../pki-vm-measurements-healthcheck.service | 8 ++++++++ .../systemd/pki-vm-measurements-healthcheck.timer | 11 +++++++++++ .../systemd/pki-vm-measurements.service | 14 ++++++++++++++ .../files/configs/usr/local/bin/hardening-vm.sh | 5 ++++- src/rootfs/files/scripts/install_pki_components.sh | 4 +++- src/rootfs/files/scripts/setup_runtime_tools.sh | 4 ++-- 7 files changed, 50 insertions(+), 5 deletions(-) create mode 100644 src/rootfs/files/configs/pki-service/systemd/pki-vm-measurements-healthcheck.service create mode 100644 src/rootfs/files/configs/pki-service/systemd/pki-vm-measurements-healthcheck.timer create mode 100644 src/rootfs/files/configs/pki-service/systemd/pki-vm-measurements.service diff --git a/src/Dockerfile b/src/Dockerfile index cd476e1b..408f9795 100644 --- a/src/Dockerfile +++ b/src/Dockerfile @@ -222,13 +222,19 @@ ADD rootfs/files/configs/pki-service/scripts/*.sh "${OUTPUTDIR}/usr/local/bin/pk ADD rootfs/files/configs/pki-service/systemd/pki-authority-sync.service "${OUTPUTDIR}/etc/systemd/system" ADD rootfs/files/configs/pki-service/systemd/pki-cert-init.service "${OUTPUTDIR}/etc/systemd/system" ADD rootfs/files/configs/pki-service/systemd/pki-vm-mode.service "${OUTPUTDIR}/etc/systemd/system" +ADD rootfs/files/configs/pki-service/systemd/pki-vm-measurements.service "${OUTPUTDIR}/etc/systemd/system" +ADD rootfs/files/configs/pki-service/systemd/pki-vm-measurements-healthcheck.service "${OUTPUTDIR}/etc/systemd/system" +ADD rootfs/files/configs/pki-service/systemd/pki-vm-measurements-healthcheck.timer "${OUTPUTDIR}/etc/systemd/system" RUN mkdir -p "${OUTPUTDIR}/etc/super/pki-authority-sync" ADD rootfs/files/configs/pki-service/conf/secrets-config.yaml "${OUTPUTDIR}/etc/super/pki-authority-sync/secrets-config.yaml" RUN mkdir -p "${OUTPUTDIR}/etc/super/pki-cert-generator" ADD rootfs/files/configs/pki-service/conf/cert-gen-config-template.yaml "${OUTPUTDIR}/etc/super/pki-cert-generator/cert-gen-config-template.yaml" RUN chmod +x "${OUTPUTDIR}"/usr/local/bin/pki-authority/*.py +RUN mkdir -p "${OUTPUTDIR}/etc/systemd/system/multi-user.target.wants" "${OUTPUTDIR}/etc/systemd/system/timers.target.wants" RUN ln -s /etc/systemd/system/pki-authority-sync.service "${OUTPUTDIR}/etc/systemd/system/multi-user.target.wants/pki-authority-sync.service" RUN ln -s /etc/systemd/system/pki-cert-init.service "${OUTPUTDIR}/etc/systemd/system/multi-user.target.wants/pki-cert-init.service" +RUN ln -s /etc/systemd/system/pki-vm-measurements.service "${OUTPUTDIR}/etc/systemd/system/multi-user.target.wants/pki-vm-measurements.service" +RUN ln -s /etc/systemd/system/pki-vm-measurements-healthcheck.timer "${OUTPUTDIR}/etc/systemd/system/timers.target.wants/pki-vm-measurements-healthcheck.timer" ADD rootfs/files/configs/etc/multipath.conf.append /buildroot/files/configs/etc/multipath.conf.append ADD rootfs/files/configs/etc/sysctl.conf.append /buildroot/files/configs/etc/sysctl.conf.append @@ -342,10 +348,11 @@ RUN --security=insecure /buildroot/files/scripts/setup_runtime_tools.sh # install PKI npm components globally (requires python3-venv from setup_runtime_tools) ARG PKI_SYNC_CLIENT_VERSION=5.0.0 ARG PKI_CERT_GENERATOR_VERSION=5.0.0 +ARG PKI_VM_MEASUREMENTS_VERSION=1.0.1 ADD rootfs/files/scripts/install_pki_components.sh /buildroot/files/scripts/ RUN chmod +x /buildroot/files/scripts/install_pki_components.sh RUN --security=insecure /buildroot/files/scripts/install_pki_components.sh \ - "${PKI_SYNC_CLIENT_VERSION}" "${PKI_CERT_GENERATOR_VERSION}" + "${PKI_SYNC_CLIENT_VERSION}" "${PKI_CERT_GENERATOR_VERSION}" "${PKI_VM_MEASUREMENTS_VERSION}" # Extra system packages required by provision plugins at runtime # mysql-client: bootstrap-services.sh and provision plugins use mysql CLI to talk to SwarmDB diff --git a/src/rootfs/files/configs/pki-service/systemd/pki-vm-measurements-healthcheck.service b/src/rootfs/files/configs/pki-service/systemd/pki-vm-measurements-healthcheck.service new file mode 100644 index 00000000..c9d67b30 --- /dev/null +++ b/src/rootfs/files/configs/pki-service/systemd/pki-vm-measurements-healthcheck.service @@ -0,0 +1,8 @@ +[Unit] +Description=PKI VM measurements healthcheck +After=pki-vm-measurements.service +Wants=pki-vm-measurements.service + +[Service] +Type=oneshot +ExecStart=/bin/bash -c 'if ! /usr/bin/curl --fail --silent --show-error --max-time 5 http://localhost:9180/healthcheck; then /usr/bin/systemctl restart pki-vm-measurements.service; fi' diff --git a/src/rootfs/files/configs/pki-service/systemd/pki-vm-measurements-healthcheck.timer b/src/rootfs/files/configs/pki-service/systemd/pki-vm-measurements-healthcheck.timer new file mode 100644 index 00000000..bd89bfb6 --- /dev/null +++ b/src/rootfs/files/configs/pki-service/systemd/pki-vm-measurements-healthcheck.timer @@ -0,0 +1,11 @@ +[Unit] +Description=PKI VM measurements healthcheck timer + +[Timer] +OnBootSec=60 +OnUnitActiveSec=30 +AccuracySec=5 +Unit=pki-vm-measurements-healthcheck.service + +[Install] +WantedBy=timers.target diff --git a/src/rootfs/files/configs/pki-service/systemd/pki-vm-measurements.service b/src/rootfs/files/configs/pki-service/systemd/pki-vm-measurements.service new file mode 100644 index 00000000..7dd17b30 --- /dev/null +++ b/src/rootfs/files/configs/pki-service/systemd/pki-vm-measurements.service @@ -0,0 +1,14 @@ +[Unit] +Description=PKI VM measurements service +After=network-online.target +Wants=network-online.target + +[Service] +Type=simple +Environment=NODE_ENV=production +ExecStart=/usr/bin/pki-vm-measurements +Restart=always +RestartSec=5 + +[Install] +WantedBy=multi-user.target diff --git a/src/rootfs/files/configs/usr/local/bin/hardening-vm.sh b/src/rootfs/files/configs/usr/local/bin/hardening-vm.sh index b5b47a24..fa817dc8 100755 --- a/src/rootfs/files/configs/usr/local/bin/hardening-vm.sh +++ b/src/rootfs/files/configs/usr/local/bin/hardening-vm.sh @@ -25,6 +25,9 @@ iptables -A INPUT -p tcp --dport 80 -j ACCEPT # Allow HTTPS for PKI service iptables -A INPUT -p tcp --dport 9443 -j ACCEPT +# Allow PKI VM measurements service +iptables -A INPUT -p tcp --dport 9180 -j ACCEPT + # Allow incoming traffic in the cluster network # @TODO this will ignore NetworkPolicies in k8s, refactor in future iptables -I INPUT -s 10.43.0.0/16 -j ACCEPT @@ -48,4 +51,4 @@ iptables -A INPUT -p udp --dport 7946 -j ACCEPT # Allow SSH (TCP 22) iptables -A INPUT -p tcp --dport 22 -j ACCEPT -systemctl start ssh \ No newline at end of file +systemctl start ssh diff --git a/src/rootfs/files/scripts/install_pki_components.sh b/src/rootfs/files/scripts/install_pki_components.sh index 4eae2a18..7266801e 100644 --- a/src/rootfs/files/scripts/install_pki_components.sh +++ b/src/rootfs/files/scripts/install_pki_components.sh @@ -9,6 +9,7 @@ set -euo pipefail; # public, optional # $1 - PKI_SYNC_CLIENT_VERSION - version to install, if not set - installs latest # $2 - PKI_CERT_GENERATOR_VERSION - version to install, if not set - installs latest +# $3 - PKI_VM_MEASUREMENTS_VERSION - version to install, if not set - installs latest # private BUILDROOT="/buildroot"; @@ -38,4 +39,5 @@ function install_npm_package() { chroot_init; install_npm_package "@super-protocol/pki-sync-client" "${1:-}"; install_npm_package "@super-protocol/pki-cert-generator" "${2:-}"; -chroot_deinit; \ No newline at end of file +install_npm_package "@super-protocol/pki-vm-measurements" "${3:-}"; +chroot_deinit; diff --git a/src/rootfs/files/scripts/setup_runtime_tools.sh b/src/rootfs/files/scripts/setup_runtime_tools.sh index a9dcef69..cecf2d6d 100644 --- a/src/rootfs/files/scripts/setup_runtime_tools.sh +++ b/src/rootfs/files/scripts/setup_runtime_tools.sh @@ -17,10 +17,10 @@ function setup_runtime_tools() { printf '#!/bin/sh\nexit 101\n' > "${OUTPUTDIR}/usr/sbin/policy-rc.d" chmod +x "${OUTPUTDIR}/usr/sbin/policy-rc.d" - log_info "installing runtime packages into rootfs (python3, mysql client, openssl, netcat, dns tools)" + log_info "installing runtime packages into rootfs (python3, mysql client, openssl, netcat, dns tools, curl)" chroot "${OUTPUTDIR}" /usr/bin/apt update chroot "${OUTPUTDIR}" /usr/bin/apt install -y --no-install-recommends \ - mysql-client python3 python3-pip python3-venv openssl netcat-openbsd dnsutils nano ncurses-term + mysql-client python3 python3-pip python3-venv openssl netcat-openbsd dnsutils curl nano ncurses-term chroot "${OUTPUTDIR}" /usr/bin/apt clean log_info "installing Python runtime dependencies" From 52b97a7e3281dd8181aa8bca8f8efdc8b62ac71c Mon Sep 17 00:00:00 2001 From: Petr Evstifeev Date: Thu, 2 Jul 2026 09:27:05 -0500 Subject: [PATCH 2/2] fix for snp --- src/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/Dockerfile b/src/Dockerfile index 400aa2bd..ed400c8b 100644 --- a/src/Dockerfile +++ b/src/Dockerfile @@ -349,7 +349,7 @@ RUN --security=insecure /buildroot/files/scripts/setup_runtime_tools.sh # install PKI npm components globally (requires python3-venv from setup_runtime_tools) ARG PKI_SYNC_CLIENT_VERSION=5.0.0 ARG PKI_CERT_GENERATOR_VERSION=5.0.0 -ARG PKI_VM_MEASUREMENTS_VERSION=1.0.1 +ARG PKI_VM_MEASUREMENTS_VERSION=1.0.3 ADD rootfs/files/scripts/install_pki_components.sh /buildroot/files/scripts/ RUN chmod +x /buildroot/files/scripts/install_pki_components.sh RUN --security=insecure /buildroot/files/scripts/install_pki_components.sh \