mirror of
https://github.com/kata-containers/kata-containers.git
synced 2026-07-13 11:49:44 +00:00
716c55abdd
Adds a practical set of kernel config used by docker-in-docker and kind for network bridging and filtering. It also includes the matching IPv6 support to allow tools like kind that require IPv6 network policies to work out of the box. This support includes: - nftables reject and filtering support for inet/ipv4/ipv6 - Bridge filtering for container-to-container traffic - IPv6 NAT, filtering, and packet matching rules for network policies - VXLAN and IPsec crypto support for network tunneling - TMPFS POSIX ACL support for filesystem permissions The configs are organized across fragment files: - common/fs.conf: TMPFS ACL support - common/crypto.conf: IPsec/VXLAN crypto algorithms - common/network.conf: VXLAN, IPsec ESP, nftables bridge/ARP/netdev - common/netfilter.conf: IPv6 netfilter stack and nftables advanced features Fixes: #11886 Signed-off-by: Simon Kaegi <simon.kaegi@gmail.com>
23 lines
687 B
Plaintext
23 lines
687 B
Plaintext
# Need decompressors for root filesystems and kernels.
|
|
# Do we need all of these?
|
|
CONFIG_CRYPTO=y
|
|
# Deflate used by IPSec and IPCOMP protocols
|
|
# Also selects ZLIB and a couple of other algos
|
|
CONFIG_CRYPTO_DEFLATE=y
|
|
CONFIG_XZ_DEC=y
|
|
CONFIG_ZLIB_DEFLATE=y
|
|
# FIXME - check, do we need gzip?
|
|
# https://github.com/kata-containers/packaging/issues/483
|
|
CONFIG_DECOMPRESS_GZIP=y
|
|
# Some items required by systemd: https://github.com/systemd/systemd/blob/master/README
|
|
CONFIG_CRYPTO_USER_API=y
|
|
CONFIG_CRYPTO_USER_API_HASH=y
|
|
CONFIG_CRYPTO_SHA256=y
|
|
CONFIG_CRYPTO_FIPS=y
|
|
CONFIG_CRYPTO_ANSI_CPRNG=y
|
|
|
|
# IPsec and VXLAN crypto requirements
|
|
CONFIG_CRYPTO_GCM=y
|
|
CONFIG_CRYPTO_SEQIV=y
|
|
CONFIG_CRYPTO_GHASH=y
|