feature/SP-7750, vm measurements support

src/Dockerfile

@@ -223,13 +223,19 @@ ADD rootfs/files/configs/pki-service/scripts/*.sh "${OUTPUTDIR}/usr/local/bin/pk
 ADD rootfs/files/configs/pki-service/systemd/pki-authority-sync.service "${OUTPUTDIR}/etc/systemd/system"
 ADD rootfs/files/configs/pki-service/systemd/pki-cert-init.service "${OUTPUTDIR}/etc/systemd/system"
 ADD rootfs/files/configs/pki-service/systemd/pki-vm-mode.service "${OUTPUTDIR}/etc/systemd/system"
+ADD rootfs/files/configs/pki-service/systemd/pki-vm-measurements.service "${OUTPUTDIR}/etc/systemd/system"
+ADD rootfs/files/configs/pki-service/systemd/pki-vm-measurements-healthcheck.service "${OUTPUTDIR}/etc/systemd/system"
+ADD rootfs/files/configs/pki-service/systemd/pki-vm-measurements-healthcheck.timer "${OUTPUTDIR}/etc/systemd/system"
 RUN mkdir -p "${OUTPUTDIR}/etc/super/pki-authority-sync"
 ADD rootfs/files/configs/pki-service/conf/secrets-config.yaml "${OUTPUTDIR}/etc/super/pki-authority-sync/secrets-config.yaml"
 RUN mkdir -p "${OUTPUTDIR}/etc/super/pki-cert-generator"
 ADD rootfs/files/configs/pki-service/conf/cert-gen-config-template.yaml "${OUTPUTDIR}/etc/super/pki-cert-generator/cert-gen-config-template.yaml"
 RUN chmod +x "${OUTPUTDIR}"/usr/local/bin/pki-authority/*.py
+RUN mkdir -p "${OUTPUTDIR}/etc/systemd/system/multi-user.target.wants" "${OUTPUTDIR}/etc/systemd/system/timers.target.wants"
 RUN ln -s /etc/systemd/system/pki-authority-sync.service "${OUTPUTDIR}/etc/systemd/system/multi-user.target.wants/pki-authority-sync.service"
 RUN ln -s /etc/systemd/system/pki-cert-init.service "${OUTPUTDIR}/etc/systemd/system/multi-user.target.wants/pki-cert-init.service"
+RUN ln -s /etc/systemd/system/pki-vm-measurements.service "${OUTPUTDIR}/etc/systemd/system/multi-user.target.wants/pki-vm-measurements.service"
+RUN ln -s /etc/systemd/system/pki-vm-measurements-healthcheck.timer "${OUTPUTDIR}/etc/systemd/system/timers.target.wants/pki-vm-measurements-healthcheck.timer"
 
 ADD rootfs/files/configs/etc/multipath.conf.append /buildroot/files/configs/etc/multipath.conf.append
 ADD rootfs/files/configs/etc/sysctl.conf.append /buildroot/files/configs/etc/sysctl.conf.append
@@ -343,10 +349,11 @@ RUN --security=insecure /buildroot/files/scripts/setup_runtime_tools.sh
 # install PKI npm components globally (requires python3-venv from setup_runtime_tools)
 ARG PKI_SYNC_CLIENT_VERSION=5.0.0
 ARG PKI_CERT_GENERATOR_VERSION=5.0.0
+ARG PKI_VM_MEASUREMENTS_VERSION=1.0.3
 ADD rootfs/files/scripts/install_pki_components.sh /buildroot/files/scripts/
 RUN chmod +x /buildroot/files/scripts/install_pki_components.sh
 RUN --security=insecure /buildroot/files/scripts/install_pki_components.sh \
-    "${PKI_SYNC_CLIENT_VERSION}" "${PKI_CERT_GENERATOR_VERSION}"
+    "${PKI_SYNC_CLIENT_VERSION}" "${PKI_CERT_GENERATOR_VERSION}" "${PKI_VM_MEASUREMENTS_VERSION}"
 
 # Extra system packages required by provision plugins at runtime
 # mysql-client: bootstrap-services.sh and provision plugins use mysql CLI to talk to SwarmDB

src/rootfs/files/configs/pki-service/systemd/pki-vm-measurements-healthcheck.service

@@ -0,0 +1,8 @@
+[Unit]
+Description=PKI VM measurements healthcheck
+After=pki-vm-measurements.service
+Wants=pki-vm-measurements.service
+
+[Service]
+Type=oneshot
+ExecStart=/bin/bash -c 'if ! /usr/bin/curl --fail --silent --show-error --max-time 5 http://localhost:9180/healthcheck; then /usr/bin/systemctl restart pki-vm-measurements.service; fi'

src/rootfs/files/configs/pki-service/systemd/pki-vm-measurements-healthcheck.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=PKI VM measurements healthcheck timer
+
+[Timer]
+OnBootSec=60
+OnUnitActiveSec=30
+AccuracySec=5
+Unit=pki-vm-measurements-healthcheck.service
+
+[Install]
+WantedBy=timers.target

src/rootfs/files/configs/pki-service/systemd/pki-vm-measurements.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=PKI VM measurements service
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+Environment=NODE_ENV=production
+ExecStart=/usr/bin/pki-vm-measurements
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target

src/rootfs/files/configs/usr/local/bin/hardening-vm.sh

@@ -25,6 +25,9 @@ iptables -A INPUT -p tcp --dport 80 -j ACCEPT
 # Allow HTTPS for PKI service
 iptables -A INPUT -p tcp --dport 9443 -j ACCEPT
 
+# Allow PKI VM measurements service
+iptables -A INPUT -p tcp --dport 9180 -j ACCEPT
+
 # Allow incoming traffic in the cluster network
 # @TODO this will ignore NetworkPolicies in k8s, refactor in future
 iptables -I INPUT -s 10.43.0.0/16 -j ACCEPT
@@ -48,4 +51,4 @@ iptables -A INPUT -p udp --dport 7946 -j ACCEPT
 # Allow SSH (TCP 22)
 iptables -A INPUT -p tcp --dport 22 -j ACCEPT
 
-systemctl start ssh
+systemctl start ssh

src/rootfs/files/scripts/install_pki_components.sh

@@ -9,6 +9,7 @@ set -euo pipefail;
 # public, optional
 # $1 - PKI_SYNC_CLIENT_VERSION - version to install, if not set - installs latest
 # $2 - PKI_CERT_GENERATOR_VERSION - version to install, if not set - installs latest
+# $3 - PKI_VM_MEASUREMENTS_VERSION - version to install, if not set - installs latest
 
 # private
 BUILDROOT="/buildroot";
@@ -38,4 +39,5 @@ function install_npm_package() {
 chroot_init;
 install_npm_package "@super-protocol/pki-sync-client" "${1:-}";
 install_npm_package "@super-protocol/pki-cert-generator" "${2:-}";
-chroot_deinit;
+install_npm_package "@super-protocol/pki-vm-measurements" "${3:-}";
+chroot_deinit;

src/rootfs/files/scripts/setup_runtime_tools.sh

@@ -17,10 +17,10 @@ function setup_runtime_tools() {
     printf '#!/bin/sh\nexit 101\n' > "${OUTPUTDIR}/usr/sbin/policy-rc.d"
     chmod +x "${OUTPUTDIR}/usr/sbin/policy-rc.d"
 
-    log_info "installing runtime packages into rootfs (python3, mysql client, openssl, netcat, dns tools)"
+    log_info "installing runtime packages into rootfs (python3, mysql client, openssl, netcat, dns tools, curl)"
     chroot "${OUTPUTDIR}" /usr/bin/apt update
     chroot "${OUTPUTDIR}" /usr/bin/apt install -y --no-install-recommends \
-        mysql-client python3 python3-pip python3-venv openssl netcat-openbsd dnsutils nano ncurses-term
+        mysql-client python3 python3-pip python3-venv openssl netcat-openbsd dnsutils curl nano ncurses-term
     chroot "${OUTPUTDIR}" /usr/bin/apt clean
 
     log_info "installing Python runtime dependencies"