Notes RSS feed

• Finally Got My Corporate PC to work

  18/07/25, 10:23

  After installing VMWare Workstation Pro

  Run these commands to get CoreOs booting

  $Env:CONFIG_ENCODING="base64"
  $Env:CONFIG_ENCODED="ewogICJpZ25pdGlvbiI6IHsKICAgICJ2ZXJzaW9uIjogIjMuMS4wIgogIH0sCiAgInBhc3N3ZCI6IHsKICAgICJ1c2VycyI6IFsKICAgICAgewogICAgICAgICJuYW1lIjogImNvcmUiLAogICAgICAgICJzc2hBdXRob3JpemVkS2V5cyI6IFsKICAgICAgICAgICJzc2gtZWQyNTUxOSBBQUFBQzNOemFDMWxaREkxTlRFNUFBQUFJSVdpVmg3MEhBN3prM1krQWNYejNzUm1BYU9QMWdVRHZpZFdwcVhpdm9pWCIKICAgICAgICBdCiAgICAgIH0sCiAgICAgIHsKICAgICAgICAibmFtZSI6ICJyb290IiwKICAgICAgICAic3NoQXV0aG9yaXplZEtleXMiOiBbCiAgICAgICAgICAic3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSUlXaVZoNzBIQTd6azNZK0FjWHozc1JtQWFPUDFnVUR2aWRXcHFYaXZvaVgiCiAgICAgICAgXQogICAgICB9CiAgICBdCiAgfSwKICAic3RvcmFnZSI6IHsKICAgICJmaWxlcyI6IFsKICAgICAgewogICAgICAgICJvdmVyd3JpdGUiOiB0cnVlLAogICAgICAgICJwYXRoIjogIi9ldGMvaG9zdG5hbWUiLAogICAgICAgICJjb250ZW50cyI6IHsKICAgICAgICAgICJzb3VyY2UiOiAiZGF0YToscG9kbWFuLWJveCIKICAgICAgICB9LAogICAgICAgICJtb2RlIjogNDIwCiAgICAgIH0KICAgIF0KICB9LAogICJzeXN0ZW1kIjogewogICAgInVuaXRzIjogWwogICAgICB7CiAgICAgICAgImVuYWJsZWQiOiB0cnVlLAogICAgICAgICJuYW1lIjogInBvZG1hbi5zb2NrZXQiCiAgICAgIH0sew0KICAgICAgIm5hbWUiOiAicG9kbWFuLnNlcnZpY2UiLA0KICAgICAgImVuYWJsZWQiOiB0cnVlLA0KICAgICAgImNvbnRlbnRzIjogIltTZXJ2aWNlXVxuVHlwZT1vbmVzaG90XG5FeGVjU3RhcnQ9cG9kbWFuIHN5c3RlbSBzZXJ2aWNlIC0tdGltZT0wIHRjcDovLzAuMC4wLjA6MjQwNzlcblxuW0luc3RhbGxdXG5XYW50ZWRCeT1tdWx0aS11c2VyLnRhcmdldCINCiAgICB9CiAgICBdCiAgfQp9"
  
  $Env:VM_NAME="podman-box"
  $Env:FCOS_OVA="C:\Users\m24669\Downloads\fedora-coreos-42.20250623.3.1-vmware.x86_64.ova"
  $Env:LIBRARY="C:\Users\m24669\tools\vmware"
  cd "C:\Program Files (x86)\VMware\VMware Workstation\OVFTool"
  .\ovftool.exe --powerOffTarget --name="$Env:VM_NAME" --net:"NAT" --allowExtraConfig --extraConfig:guestinfo.ignition.config.data.encoding="$Env:CONFIG_ENCODING" --extraConfig:guestinfo.ignition.config.data="$Env:CONFIG_ENCODED" "$Env:FCOS_OVA" "$Env:LIBRARY"

  TIP remember base64 sometimes needs padding, coreos are a bit strict. Some encoders are not!

  If for some reason network is not NAT’ED change it in VMare UI

  Edit HOST file

  ADD

  192.168.226.128 container-box.development

  Add DOCKER compability env

  DOCKER_HOST = tcp://container-box.development:24079

  Bonus

  powercfg /powerthrottling disable /path "C:\Program Files (x86)\VMware\VMware Workstation\x64\vmware-vmx.exe"

  accept new key

  ssh -i "C:\Users\uid\.ssh\root-podbox-ecdsa" root@container-box.development -p 22

• Cheat sheet for coco

  11/06/25, 10:23

  Peerpod IN pod container added sockets

  confidential data hub - cdh https://github.com/confidential-containers/guest-components/blob/main/confidential-data-hub/example.config.toml socket mount unix:///run/confidential-containers/cdh.sock

  attestation agent https://github.com/confidential-containers/guest-components/blob/main/attestation-agent/attestation-agent/config.example.toml socket mount unix:///run/confidential-containers/attestation-agent/attestation-agent.sock

  • IN pod communication
    • check reachability: wget http://kbs-service.operators.svc.cluster.local:8080

  echo -e “GET /aa/token?token_type=kbs HTTP/1.1\r\nhost: localhost\r\n\r\n” | socat unix-connect:/var/run/docker.sock STDIO

  unix:///run/confidential-containers/attestation-agent/attestation-agent.sock

  127.0.0.1:8006 /aa/token?token_type=kbs

  echo -e “GET /aa/token?token_type=kbs HTTP/1.1\r\nhost: localhost\r\n\r\n” | socat unix-connect:/run/confidential-containers/cdh.sock STDIO

• K8S on CoreOs

  15/05/25, 20:23

  K8S on CoreOs so I can test coco

  https://docs.fedoraproject.org/en-US/fedora-coreos/producing-ign/

  podman pull quay.io/coreos/butane:release
  podman run --interactive --rm quay.io/coreos/butane:release --pretty --strict remote.bu transpiled_config.ign
  podman run --interactive --rm --security-opt label=disable --volume "${PWD}:/pwd" --workdir /pwd quay.io/coreos/butane:release --pretty --strict remote.bu --out transpiled_config.ign

  CoreOs Butane

  variant: fcos
  version: 1.1.0
  passwd:
    users:
      - name: core
        ssh_authorized_keys:
          - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIWiVh70HA7zk3Y+AcXz3sRmAaOP1gUDvidWpqXivoiXm24669@W7N12083
      - name: root
        ssh_authorized_keys:
          - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIWiVh70HA7zk3Y+AcXz3sRmAaOP1gUDvidWpqXivoiXm24669@W7N12083
  storage:
    files:
      - path: /etc/hostname
        mode: 420
        overwrite: true
        contents:
          source: 'data:,podman-box'
  systemd:
    units:
      - name: podman.socket
        enabled: true

  IGN on VMWare

  Install kind

  kind create cluster —config=

  kind: Cluster
  apiVersion: kind.x-k8s.io/v1alpha4
  name: dev01
  networking:
    # WARNING: It is _strongly_ recommended that you keep this the default
    # (127.0.0.1) for security reasons. However it is possible to change this.
    apiServerAddress: "0.0.0.0"
  nodes:
  - role: control-plane
    kubeadmConfigPatches:
    - |
      kind: ClusterConfiguration
      apiServer:
        certSANs:
        - "192.168.1.155"
        - "podman-box"
  - role: worker
    labels:
      "node.kubernetes.io/worker":

• Checking out cncf CoCo

  08/05/25, 10:23

  Looking into CoCo

  And see how CoCo Operator and CoCo Trustee Operator works out.