mirror of
https://github.com/kata-containers/kata-containers.git
synced 2026-07-12 10:16:48 +00:00
716c55abdd
Adds a practical set of kernel config used by docker-in-docker and kind for network bridging and filtering. It also includes the matching IPv6 support to allow tools like kind that require IPv6 network policies to work out of the box. This support includes: - nftables reject and filtering support for inet/ipv4/ipv6 - Bridge filtering for container-to-container traffic - IPv6 NAT, filtering, and packet matching rules for network policies - VXLAN and IPsec crypto support for network tunneling - TMPFS POSIX ACL support for filesystem permissions The configs are organized across fragment files: - common/fs.conf: TMPFS ACL support - common/crypto.conf: IPsec/VXLAN crypto algorithms - common/network.conf: VXLAN, IPsec ESP, nftables bridge/ARP/netdev - common/netfilter.conf: IPv6 netfilter stack and nftables advanced features Fixes: #11886 Signed-off-by: Simon Kaegi <simon.kaegi@gmail.com>
104 lines
2.2 KiB
Plaintext
104 lines
2.2 KiB
Plaintext
# Our networking requirements
|
|
### FIXME - this probably needs a good review ###
|
|
# https://github.com/kata-containers/packaging/issues/483
|
|
|
|
# pre-reqs
|
|
CONFIG_NETDEVICES=y
|
|
CONFIG_PROC_FS=y
|
|
CONFIG_SYSFS=y
|
|
CONFIG_SECURITY=y
|
|
|
|
# The list
|
|
CONFIG_NET=y
|
|
CONFIG_ETHERNET=y
|
|
CONFIG_NET_CORE=y
|
|
CONFIG_NET_INGRESS=y
|
|
CONFIG_PACKET=y
|
|
CONFIG_PACKET_DIAG=y
|
|
CONFIG_UNIX=y
|
|
CONFIG_XFRM=y
|
|
CONFIG_XFRM_ALGO=y
|
|
CONFIG_XFRM_USER=y
|
|
CONFIG_XFRM_SUB_POLICY=y
|
|
# Used for mobile ipv6 type instances, unlikely we need
|
|
#CONFIG_XFRM_MIGRATE=y
|
|
# Developer feature - unlikely we need it
|
|
#CONFIG_XFRM_STATISTICS=y
|
|
CONFIG_INET=y
|
|
CONFIG_IP_ADVANCED_ROUTER=y
|
|
CONFIG_IP_MULTICAST=y
|
|
CONFIG_IP_MULTIPLE_TABLES=y
|
|
CONFIG_IP_ROUTE_CLASSID=y
|
|
CONFIG_IP_PNP=y
|
|
CONFIG_IP_PNP_DHCP=y
|
|
CONFIG_SYN_COOKIES=y
|
|
CONFIG_TCP_CONG_ADVANCED=y
|
|
CONFIG_TCP_CONG_BBR=y
|
|
CONFIG_DEFAULT_BBR=y
|
|
CONFIG_TCP_MD5SIG=y
|
|
CONFIG_IPV6=y
|
|
CONFIG_IPV6_MULTIPLE_TABLES=y
|
|
|
|
CONFIG_STP=y
|
|
CONFIG_BRIDGE=y
|
|
CONFIG_BRIDGE_IGMP_SNOOPING=y
|
|
CONFIG_LLC=y
|
|
CONFIG_NET_SCHED=y
|
|
CONFIG_NET_SCH_MULTIQ=y
|
|
CONFIG_NET_SCH_FQ_CODEL=y
|
|
CONFIG_NET_SCH_FQ=y
|
|
CONFIG_NET_CLS=y
|
|
CONFIG_NET_CLS_CGROUP=y
|
|
CONFIG_NET_EMATCH=y
|
|
CONFIG_NET_SCH_FIFO=y
|
|
CONFIG_VSOCKETS=y
|
|
CONFIG_VIRTIO_VSOCKETS=y
|
|
CONFIG_VIRTIO_VSOCKETS_COMMON=y
|
|
CONFIG_NET_SWITCHDEV=y
|
|
CONFIG_RPS=y
|
|
CONFIG_RFS_ACCEL=y
|
|
CONFIG_XPS=y
|
|
CONFIG_CGROUP_NET_PRIO=y
|
|
CONFIG_CGROUP_NET_CLASSID=y
|
|
CONFIG_NET_RX_BUSY_POLL=y
|
|
CONFIG_BQL=y
|
|
CONFIG_NET_FLOW_LIMIT=y
|
|
CONFIG_GRO_CELLS=y
|
|
CONFIG_FAILOVER=y
|
|
CONFIG_HAVE_EBPF_JIT=y
|
|
|
|
# We v.likely need some intel chip support
|
|
CONFIG_NET_VENDOR_INTEL=y
|
|
|
|
# Add VETH support (necessary for running Docker in the guest)
|
|
CONFIG_VETH=y
|
|
# We quite likely need to add others for passthrough and maybe SRIOV support
|
|
|
|
# We need TUN/TAP support is a must for VPN kinda services
|
|
CONFIG_TUN=y
|
|
CONFIG_MACVLAN=y
|
|
CONFIG_MACVTAP=y
|
|
CONFIG_BRIDGE_NETFILTER=y
|
|
CONFIG_VXLAN=y
|
|
CONFIG_INET_ESP=y
|
|
|
|
|
|
# Need netfilter support for iptables
|
|
CONFIG_NF_TABLES=y
|
|
CONFIG_NF_TABLES_INET=y
|
|
CONFIG_NF_TABLES_IPV4=y
|
|
CONFIG_NF_TABLES_IPV6=y
|
|
CONFIG_NF_TABLES_BRIDGE=y
|
|
CONFIG_NF_TABLES_ARP=y
|
|
CONFIG_NF_TABLES_NETDEV=y
|
|
CONFIG_NFT_CT=y
|
|
CONFIG_NFT_LIMIT=y
|
|
CONFIG_NFT_MASQ=y
|
|
CONFIG_NFT_REDIR=y
|
|
CONFIG_NFT_NAT=y
|
|
CONFIG_NFT_TUNNEL=y
|
|
CONFIG_NFT_QUEUE=y
|
|
CONFIG_NFT_QUOTA=y
|
|
CONFIG_NFT_COMPAT=y
|
|
CONFIG_NFT_HASH=y
|