Certificates & Authentication on Flatcar Container Linux

Configuring SSSD on Flatcar Container Linux

Mon, 01 Jan 0001 00:00:00 +0000

Flatcar Container Linux ships with the System Security Services Daemon, allowing integration between Flatcar Container Linux and enterprise authentication services.

Configuring SSSD

Edit /etc/sssd/sssd.conf. This configuration file is fully documented here . For example, to configure SSSD to use an IPA server called ipa.example.com, sssd.conf should read:

[sssd]
config_file_version = 2
services = nss, pam
domains = LDAP
[nss]
[pam]
[domain/LDAP]
id_provider = ldap
auth_provider = ldap
ldap_schema = ipa
ldap_uri = ldap://ipa.example.com

Start SSSD

sudo systemctl start sssd

Make SSSD available on future reboots

sudo systemctl enable sssd

Customizing the SSH daemon

Mon, 01 Jan 0001 00:00:00 +0000

Flatcar Container Linux defaults to running an OpenSSH daemon using systemd socket activation – when a client connects to the port configured for SSH, sshd is started on the fly for that client using a systemd unit derived automatically from a template. In some cases you may want to customize this daemon’s authentication methods or other configuration. This guide will show you how to do that at boot time using a Butane Config , and after building by modifying the systemd unit file.

Custom certificate authorities

Mon, 01 Jan 0001 00:00:00 +0000

Flatcar Container Linux supports custom Certificate Authorities (CAs) in addition to the default list of trusted CAs. Adding your own CA allows you to:

Use a corporate wildcard certificate
Use your own CA to communicate with an installation of CoreUpdate

The setup process for any of these use-cases is the same:

Copy the PEM-encoded certificate authority file (usually with a .pem file name extension) to /etc/ssl/certs
Run the update-ca-certificates script to update the system bundle of Certificate Authorities. All programs running on the system will now trust the added CA.

Generate self-signed certificates

Mon, 01 Jan 0001 00:00:00 +0000

If you build Flatcar Container Linux cluster on top of public networks it is recommended to enable encryption for Flatcar Container Linux services to prevent traffic interception and man-in-the-middle attacks. For these purposes you have to use Certificate Authority (CA), private keys and certificates signed by CA. Let’s use cfssl and walk through the whole process to create all these components.

NOTE: We will use basic procedure here. If your configuration requires advanced security options, please refer to official cfssl documentation.

Customizing the etcd unit

Mon, 01 Jan 0001 00:00:00 +0000

The etcd systemd unit can be customized by overriding the unit that ships with the default Flatcar Container Linux settings. Common use-cases for doing this are covered below.

Use client certificates

etcd supports client certificates as a way to provide secure communication between clients ↔ leader and internal traffic between etcd peers in the cluster. Configuring certificates for both scenarios is done through a Butane Config. Options provided here will augment the unit that ships with Flatcar Container Linux.