diff --git a/Posts/Albatross b/Posts/Albatross index dac7d9a..5f385c2 100644 --- a/Posts/Albatross +++ b/Posts/Albatross @@ -5,6 +5,8 @@ tags: mirageos, deployment abstract: fleet management for MirageOS unikernels using a mutually authenticated TLS handshake --- +EDIT (2023-05-16): Updated with albatross release version 2.0.0. + ## Deploying MirageOS unikernels More than five years ago, I posted [how to deploy MirageOS unikernels](/Posts/VMM). My motivation to work on this topic is that I'm convinced of reduced complexity, improved security, and more sustainable resource footprint of MirageOS unikernels, and want to ease deployment thereof. More than one year ago, I described [how to deploy reproducible unikernels](/Posts/Deploy). @@ -81,11 +83,11 @@ The albatross-daemon keeps state about the running unikernels, and if it is rest ## Remote management -There's one more daemon program, either albatross-tls-inetd (to be executed by inetd), or albatross-tls-endpoint. They accept clients via a remote TCP connection, and establish a mutual-authenticated TLS handshake. When done, they forward the command to the respective Unix domain socket, and send back the reply. +There's one more daemon program: albatross-tls-endpoint. It accepts clients via a remote TCP connection, and establish a mutual-authenticated TLS handshake. When done, the command is forwarded to the respective Unix domain socket, and the reply is sent back to the client. The daemon itself has a X.509 certificate to authenticate, but the client is requested to show its certificate chain as well. This by now requires TLS 1.3, so the client certificates are sent over the encrypted channel. -A step back, x X.509 certificate contains a public key and a signature from one level up. When the server knows about the root (or certificate authority (CA)) certificate, and following the chain can verify that the leaf certificate is valid. Additionally, a X.509 certificate is a ASN.1 structure with some fixed fields, but also contains extensions, a key-value store where the keys are object identifiers, and the values are key-dependent data. Also note that this key-value store is cryptographically signed. +A step back, X.509 certificate contains a public key and a signature from one level up. When the server knows about the root (or certificate authority (CA)) certificate, and following the chain can verify that the leaf certificate is valid. Additionally, a X.509 certificate is a ASN.1 structure with some fixed fields, but also contains extensions, a key-value store where the keys are object identifiers, and the values are key-dependent data. Also note that this key-value store is cryptographically signed. Albatross uses the object identifier, assigned to Camelus Dromedarius (MirageOS - 1.3.6.1.4.1.49836.42) to encode the command to be executed. This means that once the TLS handshake is established, the command to be executed is already transferred. @@ -101,7 +103,7 @@ The whole result of reproducible builds for us means: we have a hash of a uniker Of course, your mileage may vary and you want automated deployments where each git commit triggers recompilation and redeployment. The downside would be that sometimes only dependencies are updated and you've to cope with that. -At the moment, there is a client connecting directly to the unix domain sockets, `albatross-client-local`, and one connecting to the TLS endpoint, `albatross-client-bistro`. The latter applies compression to the unikernel image. +There is a client `albatross-client`, depending on arguments either connects to a local Unix domain socket, or to a remote albatross instance via TCP and TLS, or outputs a certificate signing request for later usage. Data, such as the unikernel ELF image, is compressed in certificates. ## Installation @@ -129,6 +131,8 @@ $ pkg update $ pkg install solo5 albatross ``` +Please ensure to have at least version 2.0.0 of albatross installed. + For other distributions and systems we do not (yet?) provide binary packages. You can compile and install them using opam (`opam install solo5 albatross`). Get in touch if you're keen on adding some other distribution to our reproducible build infrastructure. ## Conclusion diff --git a/Posts/Monitoring b/Posts/Monitoring index 3a6dcd0..719eab0 100644 --- a/Posts/Monitoring +++ b/Posts/Monitoring @@ -36,7 +36,7 @@ Setup telegraf to contain a socket listener: data_format = "influx" ``` -Use a unikernel that reports to Influx (below the heading "Unikernels (with metrics reported to Influx)" on [builds.robur.coop](https://builds.robur.coop)) and provide `--monitor=192.168.42.14` as boot parameter. Conventionally, these unikernels expect a second network interface (on the "management" bridge) where telegraf (and a syslog sink) are running. You'll need to pass `--net=management` and `--arg='--management-ipv4=192.168.42.x/24'` to albatross-client-local. +Use a unikernel that reports to Influx (below the heading "Unikernels (with metrics reported to Influx)" on [builds.robur.coop](https://builds.robur.coop)) and provide `--monitor=192.168.42.14` as boot parameter. Conventionally, these unikernels expect a second network interface (on the "management" bridge) where telegraf (and a syslog sink) are running. You'll need to pass `--net=management` and `--arg='--management-ipv4=192.168.42.x/24'` to albatross-client. Albatross provides a `albatross-influx` daemon that reports information from the host system about the unikernels to influx. Start it with `--influx=192.168.42.14`. diff --git a/Posts/VMM b/Posts/VMM index 37a43ef..f1eca0f 100644 --- a/Posts/VMM +++ b/Posts/VMM @@ -5,6 +5,8 @@ tags: mirageos, deployment, provisioning abstract: all we need is X.509 --- +EDIT (2023-05-16): Please take a look at [the updated article](/Posts/Albatross). + ## How to deploy unikernels? MirageOS has a pretty good story on how to compose your OCaml libraries into a