Skip to content

Improve persistent storage configuration to only include necessary paths for specific Kubernetes distributions #3713

@ci-robbot

Description

@ci-robbot

We currently have a configuration that makes entire directories like /etc and /var writable and persistent. While this is flexible, it's not optimal for security, auditability, and system cleanliness.

The current approach:

  • Makes /etc, /var, and /srv fully writable and persistent
  • Creates empty directories for components like k0s, k3s, etc. that may not be used by all users
  • Creates a large number of mount points (e.g., for cilium, etc.) that aren't necessary for all configurations

Proposal:
Modify Kairos to dynamically add only the necessary bind mounts for specific Kubernetes distributions based on user configuration. For example:

  • If k0s is selected, add /etc/k0s as a persistent path
  • If k3s is selected, add /etc/k3s as a persistent path
  • If rke2 is selected, add /etc/rke2 as a persistent path

This would result in:

  1. Reduced attack surface (only necessary paths are persistent)
  2. Cleaner, more auditable configuration
  3. Fewer unnecessary mounts
  4. Better resource usage
  5. More tailored experience for different Kubernetes distributions

We could implement this by extending the current configuration system to conditionally add mounts based on the selected Kubernetes distribution, similar to how we handle different system requirements through bundles.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    Status

    No status

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions