We currently have a configuration that makes entire directories like /etc and /var writable and persistent. While this is flexible, it's not optimal for security, auditability, and system cleanliness.
The current approach:
- Makes /etc, /var, and /srv fully writable and persistent
- Creates empty directories for components like k0s, k3s, etc. that may not be used by all users
- Creates a large number of mount points (e.g., for cilium, etc.) that aren't necessary for all configurations
Proposal:
Modify Kairos to dynamically add only the necessary bind mounts for specific Kubernetes distributions based on user configuration. For example:
- If k0s is selected, add /etc/k0s as a persistent path
- If k3s is selected, add /etc/k3s as a persistent path
- If rke2 is selected, add /etc/rke2 as a persistent path
This would result in:
- Reduced attack surface (only necessary paths are persistent)
- Cleaner, more auditable configuration
- Fewer unnecessary mounts
- Better resource usage
- More tailored experience for different Kubernetes distributions
We could implement this by extending the current configuration system to conditionally add mounts based on the selected Kubernetes distribution, similar to how we handle different system requirements through bundles.