Ukukhishwa kwenguqulo entsha yokusatshalaliswa kwe-Linux "Bottlerocket 1.3.0" kumenyezelwe, lapho kwenziwe khona izinguquko ezithile kanye nentuthuko ohlelweni, okuvelele kukho imikhawulo eyengeziwe ye-MCS kwinqubomgomo ye-SELinux , kanye nesixazululo sezinkinga eziningana zenqubomgomo ye-SELinux, ukwesekwa kwe-IPv6 ku-kubelet kanye ne-pluto kanye nokusekelwa kwe-hybrid boot kwe-x86_64.
Kulabo abangajwayelene neBottlerocket, iwukusatshalaliswa kweLinux okwakhiwe ngokubambisana ne-Amazon ukuze kusetshenziswe ama-container ahlukanisiwe ngendlela ephumelelayo nangokuphephile. Le nguqulo entsha ngokuyinhloko iyisibuyekezo sephakheji, yize ihlanganisa nezici ezintsha.
Ukusatshalaliswa kubonakaliswa ngokuhlinzeka ngesithombe sesistimu esingahlukaniseki esibuyekezwa ngokuzenzakalelayo nangokusebenzisa i-athomu esihlanganisa i-kernel ye-Linux kanye nendawo encane yesistimu ehlanganisa kuphela izingxenye ezidingekayo ukuze kusetshenziswe izitsha.
Mayelana neBottlerocket
Indawo ezungezile isebenzisa umphathi wesistimu ye-systemd, umtapo wolwazi we-Glibc, i-Buildroot, umphathi we-boot we-GRUB , i-wicked network configurator, isikhathi sokusebenza se-container sokuhlukaniswa kweziqukathi, ipulatifomu ye-Kubernetes, i-AWS-iam-authenticator, kanye ne-ejenti ye-Amazon ECS.
Amathuluzi okuqondisa izitsha athunyelwa esitsheni sokuphatha esihlukile esivulwa ngokuzenzakalelayo futhi siphathwa nge-AWS SSM API kanye ne-ejenti. Isithombe esiyisisekelo asinayo igobolondo yomyalo, iseva ye-SSH, kanye nezilimi ezihunyushiwe (isibonelo, azikho i-Python noma i-Perl): umlawuli kanye namathuluzi okulungisa amaphutha athuthelwa esitsheni sesevisi esihlukile, esikhutshazwa ngokuzenzakalelayo.
Umehluko oyinhloko uma uqhathaniswa nokusatshalaliswa okufanayo njengeFedora CoreOS, iCentOS/Red Hat Atomic Host ukugxila okuyinhloko ekuhlinzekeni ngokuphepha okuphezulu kumongo wokuqinisa uhlelo ngokumelene nezinsongo ezingaba khona, okwenza kube nzima ukusebenzisa ubuthakathaka ezingxenyeni zesistimu yokusebenza kanye nokwandisa ukuhlukaniswa kwesitsha.
Izici ezintsha eziyinhloko zeBottlerocket 1.3.0
Le nguqulo entsha yokusatshalaliswa igqamisa ukulungiswa kobuthakathaka ku-Docker Toolkit kanye ne-Runtime Container (CVE-2021-41089, CVE-2021-41091, CVE-2021-41092, CVE-2021-41103) okuhlobene nokucushwa kwemvume okungalungile, okuvumela abasebenzisi abangenamalungelo ukuthi bashiye isiqondisi sasekhaya futhi basebenzise izinhlelo zangaphandle.
Phakathi kwezinguquko ezisetshenzisiwe, singathola ukuthi ukwesekwa kwe-IPv6 kungeziwe ku-kubelet kanye ne-pluto , ngaphezu kokunikeza ikhono lokuqalisa kabusha isitsha ngemuva kokushintsha ukucushwa kwaso, kanye nokwengeza ukwesekwa kwe-Amazon EC2 M6i instances kuma-eni-max-pods.
Okunye okuphawulekayo yimikhawulo emisha ye-MCS kunqubomgomo ye-SELinux, kanye nokuxazululwa kwezinkinga eziningana zenqubomgomo ye-SELinux. Ngaphezu kwalokho, kwipulatifomu ye-x86_64, imodi yokuqalisa ye-hybrid iyasetshenziswa (ngokusekelwa kwe-EFI ne-BIOS), futhi i-Open-vm-tools yengeza ukwesekwa kwezihlungi zedivayisi ngokusekelwe kuthuluzi le-Cilium.
Ngakolunye uhlangothi, ukuhambisana nenguqulo yokusatshalaliswa kwe-aws-k8s-1.17 ngokususelwa kuKubernetes 1.17 kwasuswa, yingakho kunconywa ukusebenzisa okuhlukile kwe-aws-k8s-1.21 ngokuhambisana neKubernetes 1.21, ngaphezu kwe k8s kusetshenziswa izilungiselelo ze-cgroup runtime.slice kanye ne-system.slice.
Kwezinye izinguquko ezigqamile kule nguqulo entsha:
- Inkomba yesifunda ingezwe kumyalo we-aws-iam-authenticator
- Qalisa kabusha iziqukathi zokubamba eziguquliwe
- Ngivuselele isitsha sokulawula esizenzakalelayo saba yi-v0.5.2
- Ama-Eni-max-pods abuyekezwa ngezinhlobo ezintsha zesibonelo
- Kungezwe izihlungi zedivayisi entsha ye-cilium kuma-open-vm-tools
- Faka i- / var / log / kdumpen logdog tarballs
- Buyekeza amaphakheji wesithathu
- Incazelo ye-Wave ingezwe ekusetshenzisweni okuhamba kancane
- Kungezwe 'ama-infrasys' ukudala i-TUF infra ku-AWS
- Faka kungobo yomlando ukufuduka okudala
- Izinguquko zemibhalo
Okokugcina, uma unesithakazelo sokufunda okwengeziwe , ungathola imininingwane kusixhumanisi esilandelayo.