osp-flatcar.yaml

# Copyright 2021 The Operating System Manager contributors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: operatingsystemmanager.k8c.io/v1alpha1
kind: OperatingSystemProfile
metadata:
  name: osp-flatcar
  namespace: kube-system
spec:
  osName: flatcar
  ## Flatcar Stable (09/11/2021)
  osVersion: "2983.2.0"
  version: "v0.1.2"
  supportedCloudProviders:
    - name: aws
    - name: azure
    - name: kubevirt
    - name: openstack
    - name: vsphere
  supportedContainerRuntimes:
    - name: containerd
      files:
        - path: /etc/containerd/config.toml
          permissions: 0600
          content:
            inline:
              data: |
                {{ .ContainerRuntimeConfig }}

        - path: "/etc/systemd/system/containerd.service.d/environment.conf"
          content:
            inline:
              data: |
                [Service]
                Restart=always
                EnvironmentFile=-/etc/environment

        - path: /etc/systemd/system/containerd.service.d/10-custom.conf
          content:
            inline:
              data: |
                [Service]
                EnvironmentFile=/run/metadata/torcx
                Environment=CONTAINERD_CONFIG=/etc/containerd/config.toml
                ExecStart=
                ExecStart=/usr/bin/env PATH=${TORCX_BINDIR}:${PATH} ${TORCX_BINDIR}/containerd --config ${CONTAINERD_CONFIG}

        - path: /etc/crictl.yaml
          content:
            inline:
              data: |
                runtime-endpoint: unix:///run/containerd/containerd.sock

    - name: docker
      files:
        - path: "/etc/systemd/system/containerd.service.d/environment.conf"
          content:
            inline:
              data: |
                [Service]
                Restart=always
                EnvironmentFile=-/etc/environment

        - path: "/etc/systemd/system/docker.service.d/environment.conf"
          content:
            inline:
              data: |
                [Service]
                Restart=always
                EnvironmentFile=-/etc/environment

        - path: /etc/docker/daemon.json
          permissions: 0644
          content:
            inline:
              data: |-
                {{ .ContainerRuntimeConfig }}

  templates:
    safeDownloadBinariesScript: |-
      {{- /* setup some common directories */}}
      opt_bin=/opt/bin
      usr_local_bin=/usr/local/bin
      cni_bin_dir=/opt/cni/bin

      {{- /* create all the necessary dirs */}}
      mkdir -p /etc/cni/net.d /etc/kubernetes/dynamic-config-dir /etc/kubernetes/manifests "$opt_bin" "$cni_bin_dir"

      {{- /* HOST_ARCH can be defined outside of machine-controller (in kubeone for example) */}}
      arch=${HOST_ARCH-}
      if [ -z "$arch" ]
      then
      case $(uname -m) in
      x86_64)
          arch="amd64"
          ;;
      aarch64)
          arch="arm64"
          ;;
      *)
          echo "unsupported CPU architecture, exiting"
          exit 1
          ;;
      esac
      fi

      {{- /* # CNI variables */}}
      CNI_VERSION="${CNI_VERSION:-v0.8.7}"
      cni_base_url="https://github.com/containernetworking/plugins/releases/download/$CNI_VERSION"
      cni_filename="cni-plugins-linux-$arch-$CNI_VERSION.tgz"

      {{- /* download CNI */}}
      curl -Lfo "$cni_bin_dir/$cni_filename" "$cni_base_url/$cni_filename"

      {{- /* download CNI checksum */}}
      cni_sum=$(curl -Lf "$cni_base_url/$cni_filename.sha256")
      cd "$cni_bin_dir"

      {{- /* verify CNI checksum */}}
      sha256sum -c <<<"$cni_sum"

      {{- /* unpack CNI */}}
      tar xvf "$cni_filename"
      rm -f "$cni_filename"
      cd -

      {{- /* # cri-tools variables */}}
      CRI_TOOLS_RELEASE="${CRI_TOOLS_RELEASE:-v1.22.0}"
      cri_tools_base_url="https://github.com/kubernetes-sigs/cri-tools/releases/download/${CRI_TOOLS_RELEASE}"
      cri_tools_filename="crictl-${CRI_TOOLS_RELEASE}-linux-${arch}.tar.gz"

      {{- /* download cri-tools */}}
      curl -Lfo "$opt_bin/$cri_tools_filename" "$cri_tools_base_url/$cri_tools_filename"

      {{- /* download cri-tools checksum */}}
      {{- /* the cri-tools checksum file has a filename prefix that breaks sha256sum so we need to drop it with sed */}}
      cri_tools_sum=$(curl -Lf "$cri_tools_base_url/$cri_tools_filename.sha256" | sed 's/\*\///')
      cd "$opt_bin"

      {{- /* verify cri-tools checksum */}}
      sha256sum -c <<<"$cri_tools_sum"

      {{- /* unpack cri-tools and symlink to path so it's available to all users */}}
      tar xvf "$cri_tools_filename"
      rm -f "$cri_tools_filename"
      ln -sf "$opt_bin/crictl" "$usr_local_bin"/crictl || echo "symbolic link is skipped"
      cd -

      {{- /* kubelet */}}
      KUBE_VERSION="${KUBE_VERSION:-{{ .KubeVersion }}}"
      kube_dir="$opt_bin/kubernetes-$KUBE_VERSION"
      kube_base_url="https://storage.googleapis.com/kubernetes-release/release/$KUBE_VERSION/bin/linux/$arch"
      kube_sum_file="$kube_dir/sha256"

      {{- /* create versioned kube dir */}}
      mkdir -p "$kube_dir"
      : >"$kube_sum_file"

      for bin in kubelet kubeadm kubectl; do
          {{- /* download kube binary */}}
          curl -Lfo "$kube_dir/$bin" "$kube_base_url/$bin"
          chmod +x "$kube_dir/$bin"

          {{- /* download kube binary checksum */}}
          sum=$(curl -Lf "$kube_base_url/$bin.sha256")

          {{- /* save kube binary checksum */}}
          echo "$sum  $kube_dir/$bin" >>"$kube_sum_file"
      done

      {{- /* check kube binaries checksum */}}
      sha256sum -c "$kube_sum_file"

      for bin in kubelet kubeadm kubectl; do
          {{- /* link kube binaries from verioned dir to $opt_bin */}}
          ln -sf "$kube_dir/$bin" "$opt_bin"/$bin
      done

    configureProxyScript: |-
      {{- if .HTTPProxy }}
      cat <<EOF | tee -a /etc/environment
      HTTP_PROXY={{ .HTTPProxy }}
      http_proxy={{ .HTTPProxy }}
      HTTPS_PROXY={{ .HTTPProxy }}
      https_proxy={{ .HTTPProxy }}
      NO_PROXY={{ .NoProxy }}
      no_proxy={{ .NoProxy }}
      EOF
      {{- end }}

  units:
    - name: setup.service
      enable: true
      content: |
        [Install]
        WantedBy=multi-user.target

        [Unit]
        Requires=download-script.service
        Requires=nodeip.service
        After=download-script.service
        After=nodeip.service

        [Service]
        Type=oneshot
        RemainAfterExit=true
        EnvironmentFile=-/etc/environment
        ExecStart=/opt/bin/setup

    - name: download-script.service
      enable: true
      content: |
        [Install]
        WantedBy=multi-user.target

        [Unit]
        Requires=network-online.target
        After=network-online.target

        [Service]
        Type=oneshot
        RemainAfterExit=true
        EnvironmentFile=-/etc/environment
        ExecStart=/opt/bin/download.sh

    - name: nodeip.service
      enable: true
      content: |
        [Unit]
        Description=Setup Kubelet Node IP Env
        Requires=network-online.target
        After=network-online.target

        [Service]
        ExecStart=/opt/bin/setup_net_env.sh
        RemainAfterExit=yes
        Type=oneshot
        [Install]
        WantedBy=multi-user.target

  files:
    - path: "/opt/bin/health-monitor.sh"
      permissions: 0755
      content:
        inline:
          data: |
            #!/usr/bin/env bash

            # Copyright 2016 The Kubernetes Authors.
            #
            # Licensed under the Apache License, Version 2.0 (the "License");
            # you may not use this file except in compliance with the License.
            # You may obtain a copy of the License at
            #
            #     http://www.apache.org/licenses/LICENSE-2.0
            #
            # Unless required by applicable law or agreed to in writing, software
            # distributed under the License is distributed on an "AS IS" BASIS,
            # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
            # See the License for the specific language governing permissions and
            # limitations under the License.

            # This script is for master and node instance health monitoring, which is
            # packed in kube-manifest tarball. It is executed through a systemd service
            # in cluster/gce/gci/<master/node>.yaml. The env variables come from an env
            # file provided by the systemd service.

            # This script is a slightly adjusted version of
            # https://github.com/kubernetes/kubernetes/blob/e1a1aa211224fcd9b213420b80b2ae680669683d/cluster/gce/gci/health-monitor.sh
            # Adjustments are:
            # * Kubelet health port is 10248 not 10255
            # * Removal of all all references to the KUBE_ENV file

            set -o nounset
            set -o pipefail

            # We simply kill the process when there is a failure. Another systemd service will
            # automatically restart the process.
            function container_runtime_monitoring() {
              local -r max_attempts=5
              local attempt=1
              local -r container_runtime_name="${CONTAINER_RUNTIME_NAME:-docker}"
              # We still need to use 'docker ps' when container runtime is "docker". This is because
              # dockershim is still part of kubelet today. When kubelet is down, crictl pods
              # will also fail, and docker will be killed. This is undesirable especially when
              # docker live restore is disabled.
              local healthcheck_command="docker ps"
              if [[ "${CONTAINER_RUNTIME:-docker}" != "docker" ]]; then
                healthcheck_command="crictl pods"
              fi
              # Container runtime startup takes time. Make initial attempts before starting
              # killing the container runtime.
              until timeout 60 ${healthcheck_command} > /dev/null; do
                if ((attempt == max_attempts)); then
                  echo "Max attempt ${max_attempts} reached! Proceeding to monitor container runtime healthiness."
                  break
                fi
                echo "$attempt initial attempt \"${healthcheck_command}\"! Trying again in $attempt seconds..."
                sleep "$((2 ** attempt++))"
              done
              while true; do
                if ! timeout 60 ${healthcheck_command} > /dev/null; then
                  echo "Container runtime ${container_runtime_name} failed!"
                  if [[ "$container_runtime_name" == "docker" ]]; then
                    # Dump stack of docker daemon for investigation.
                    # Log file name looks like goroutine-stacks-TIMESTAMP and will be saved to
                    # the exec root directory, which is /var/run/docker/ on Ubuntu and COS.
                    pkill -SIGUSR1 dockerd
                  fi
                  systemctl kill --kill-who=main "${container_runtime_name}"
                  # Wait for a while, as we don't want to kill it again before it is really up.
                  sleep 120
                else
                  sleep "${SLEEP_SECONDS}"
                fi
              done
            }

            function kubelet_monitoring() {
              echo "Wait for 2 minutes for kubelet to be functional"
              sleep 120
              local -r max_seconds=10
              local output=""
              while true; do
                local failed=false

                if journalctl -u kubelet -n 1 | grep -q "use of closed network connection"; then
                  failed=true
                  echo "Kubelet stopped posting node status. Restarting"
                elif ! output=$(curl -m "${max_seconds}" -f -s -S http://127.0.0.1:10248/healthz 2>&1); then
                  failed=true
                  # Print the response and/or errors.
                  echo "$output"
                fi

                if [[ "$failed" == "true" ]]; then
                  echo "Kubelet is unhealthy!"
                  systemctl kill kubelet
                  # Wait for a while, as we don't want to kill it again before it is really up.
                  sleep 60
                else
                  sleep "${SLEEP_SECONDS}"
                fi
              done
            }

            ############## Main Function ################
            if [[ "$#" -ne 1 ]]; then
              echo "Usage: health-monitor.sh <container-runtime/kubelet>"
              exit 1
            fi

            SLEEP_SECONDS=10
            component=$1
            echo "Start kubernetes health monitoring for ${component}"
            if [[ "${component}" == "container-runtime" ]]; then
              container_runtime_monitoring
            elif [[ "${component}" == "kubelet" ]]; then
              kubelet_monitoring
            else
              echo "Health monitoring for component ${component} is not supported!"
            fi

    - path: /etc/systemd/system/systemd-networkd.service.d/10-static-network.conf
      content:
        inline:
          data: |
            {{- if .NetworkConfig }}
            [Match]
            # Because of difficulty predicting specific NIC names on different cloud providers,
            # we only support static addressing on VSphere. There should be a single NIC attached
            # that we will match by name prefix 'en' which denotes ethernet devices.
            Name=en*

            [Network]
            DHCP=no
            Address={{ .NetworkConfig.CIDR }}
            Gateway={{ .NetworkConfig.Gateway }}
            {{ range .NetworkConfig.DNS.Servers }}DNS={{ . }}
            {{ end }}
            {{- end }}

    - path: /etc/systemd/journald.conf.d/max_disk_use.conf
      content:
        inline:
          data: |
            [Journal]
            SystemMaxUse=5G

    - path: /opt/load-kernel-modules.sh
      permissions: 0755
      content:
        inline:
          data: |
            #!/usr/bin/env bash
            set -euo pipefail

            modprobe ip_vs
            modprobe ip_vs_rr
            modprobe ip_vs_wrr
            modprobe ip_vs_sh

            if modinfo nf_conntrack_ipv4 &> /dev/null; then
              modprobe nf_conntrack_ipv4
            else
              modprobe nf_conntrack
            fi

    - path: /etc/sysctl.d/k8s.conf
      content:
        inline:
          data: |
            net.bridge.bridge-nf-call-ip6tables = 1
            net.bridge.bridge-nf-call-iptables = 1
            kernel.panic_on_oops = 1
            kernel.panic = 10
            net.ipv4.ip_forward = 1
            vm.overcommit_memory = 1
            fs.inotify.max_user_watches = 1048576
            fs.inotify.max_user_instances = 8192

    - path: /opt/bin/setup_net_env.sh
      permissions: 0755
      content:
        inline:
          data: |
            #!/usr/bin/env bash
            echodate() {
              echo "[$(date -Is)]" "$@"
            }

            # get the default interface IP address
            DEFAULT_IFC_IP=$(ip -o  route get 1 | grep -oP "src \K\S+")

            if [ -z "${DEFAULT_IFC_IP}" ]
            then
              echodate "Failed to get IP address for the default route interface"
              exit 1
            fi

            # get the full hostname
            FULL_HOSTNAME=$(hostname -f)
            # if /etc/hostname is not empty then use the hostname from there
            if [ -s /etc/hostname ]; then
                FULL_HOSTNAME=$(cat /etc/hostname)
            fi

            # write the nodeip_env file
            # we need the line below because flatcar has the same string "coreos" in that file
            if grep -q coreos /etc/os-release
            then
              echo -e "KUBELET_NODE_IP=${DEFAULT_IFC_IP}\nKUBELET_HOSTNAME=${FULL_HOSTNAME}" > /etc/kubernetes/nodeip.conf
            elif [ ! -d /etc/systemd/system/kubelet.service.d ]
            then
              echodate "Can't find kubelet service extras directory"
              exit 1
            else
              echo -e "[Service]\nEnvironment=\"KUBELET_NODE_IP=${DEFAULT_IFC_IP}\"\nEnvironment=\"KUBELET_HOSTNAME=${FULL_HOSTNAME}\"" > /etc/systemd/system/kubelet.service.d/nodeip.conf
            fi

    - path: /opt/bin/download.sh
      permissions: 0755
      content:
        inline:
          data: |
            #!/usr/bin/env bash
            set -xeuo pipefail

            {{- template "safeDownloadBinariesScript" }}

            {{- template "configureProxyScript" }}

            systemctl disable download-script.service

    - path: /opt/bin/setup
      permissions: 0755
      content:
        inline:
          data: |
            #!/bin/bash
            set -xeuo pipefail

            {{- if not .FlatcarConfig.DisableAutoUpdate }}
            cat << EOF | tee /etc/polkit-1/rules.d/60-noreboot_norestart.rules
            polkit.addRule(function(action, subject) {
              if (action.id == "org.freedesktop.login1.reboot" ||
                  action.id == "org.freedesktop.login1.reboot-multiple-sessions") {
                  if (subject.user == "core") {
                      return polkit.Result.YES;
                  } else {
                      return polkit.Result.AUTH_ADMIN;
                  }
              }
            });
            EOF
            {{- end }}

            {{- if or .FlatcarConfig.DisableUpdateEngine .FlatcarConfig.DisableAutoUpdate }}
            systemctl stop update-engine.service
            systemctl mask update-engine.service
            {{ else if .HTTPProxy }}
            mkdir -p /etc/systemd/system/update-engine.service.d/
            cat <<EOF | tee -a /etc/systemd/system/update-engine.service.d/50-proxy.conf
            [Service]
            Environment=ALL_PROXY={{ .HTTPProxy }}
            EOF
            systemctl daemon-reload
            systemctl restart update-engine.service
            {{- end }}

            {{- if or .FlatcarConfig.DisableLocksmithD .FlatcarConfig.DisableAutoUpdate }}
            systemctl stop locksmithd.service
            systemctl mask locksmithd.service
            {{- end }}

            {{- /* Since both container runtimes are enabled/started by default in flatcar, disable the one that is not required */}}
            {{- if eq .ContainerRuntime "containerd" }}
            systemctl stop docker
            systemctl disable docker
            {{- end }}
            {{- if eq .ContainerRuntime "docker" }}
            systemctl stop containerd
            systemctl disable containerd
            {{- end }}

            systemctl enable --now kubelet
            systemctl enable --now --no-block kubelet-healthcheck.service
            systemctl disable setup.service

    - path: /etc/kubernetes/pki/ca.crt
      content:
        inline:
          data: |
            {{ .KubernetesCACert }}

    - path: /etc/systemd/system/kubelet.service
      content:
        inline:
          data: |
            [Unit]
            After={{ .ContainerRuntime }}.service
            Requires={{ .ContainerRuntime }}.service

            Description=kubelet: The Kubernetes Node Agent
            Documentation=https://kubernetes.io/docs/home/

            [Service]
            Restart=always
            StartLimitInterval=0
            RestartSec=10
            CPUAccounting=true
            MemoryAccounting=true

            Environment="PATH=/opt/bin:/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin/"
            EnvironmentFile=-/etc/environment
            EnvironmentFile=/etc/kubernetes/nodeip.conf

            ExecStartPre=/bin/bash /opt/load-kernel-modules.sh
            ExecStartPre=/bin/bash /opt/bin/setup_net_env.sh
            ExecStart=/opt/bin/kubelet $KUBELET_EXTRA_ARGS \
              --bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf \
              --kubeconfig=/var/lib/kubelet/kubeconfig \
              --config=/etc/kubernetes/kubelet.conf \
              --network-plugin=cni \
              --cert-dir=/etc/kubernetes/pki \
              {{- if .ExternalCloudProvider }}
              --cloud-provider=external \
              {{- else if .InTreeCCMAvailable }}
              --cloud-provider={{- .CloudProviderName }} \
              --cloud-config=/etc/kubernetes/cloud-config \
              {{- end }}
              {{- if ne .CloudProviderName "aws" }}
              --hostname-override=${KUBELET_HOSTNAME} \
              {{- else if and (eq .CloudProviderName "aws") (.ExternalCloudProvider) }}
              --hostname-override=${KUBELET_HOSTNAME} \
              {{- end }}
              --dynamic-config-dir=/etc/kubernetes/dynamic-config-dir \
              --feature-gates=DynamicKubeletConfig=true \
              --exit-on-lock-contention \
              --lock-file=/tmp/kubelet.lock \
              {{- if .PauseImage }}
              --pod-infra-container-image={{ .PauseImage }} \
              {{- end }}
              {{- if .InitialTaints }}
              --register-with-taints={{- .InitialTaints }} \
              {{- end }}
              {{- if eq .ContainerRuntime "containerd" }}
              --container-runtime=remote \
              --container-runtime-endpoint=unix:///run/containerd/containerd.sock \
              {{- end }}
              {{- if eq .ContainerRuntime "docker" }}
              --container-runtime=docker \
              --container-runtime-endpoint=unix:///var/run/dockershim.sock \
              {{- end }}
              --node-ip ${KUBELET_NODE_IP}

            [Install]
            WantedBy=multi-user.target

    - path: /etc/kubernetes/cloud-config
      permissions: 0400
      content:
        inline:
          data: |
            {{ .CloudConfig }}

    - path: /etc/kubernetes/kubelet.conf
      content:
        inline:
          data: |
            apiVersion: kubelet.config.k8s.io/v1beta1
            kind: KubeletConfiguration
            authentication:
              anonymous:
                enabled: false
              webhook:
                enabled: true
              x509:
                clientCAFile: /etc/kubernetes/pki/ca.crt
            authorization:
              mode: Webhook
            cgroupDriver: systemd
            clusterDNS:
            {{- range .ClusterDNSIPs }}
            - "{{ . }}"
            {{- end }}
            clusterDomain: cluster.local
            {{- /* containerLogMaxSize and containerLogMaxFiles have no effect for docker  */}}
            {{- if ne .ContainerRuntime "docker" }}
            {{- if .ContainerLogMaxSize }}
            containerLogMaxSize: {{ .ContainerLogMaxSize }}
            {{- else }}
            containerLogMaxSize: 100Mi
            {{- end }}
            {{- if .ContainerLogMaxFiles }}
            containerLogMaxFiles: {{ .ContainerLogMaxFiles }}
            {{- else }}
            containerLogMaxFiles: 5
            {{- end }}
            {{- end }}
            featureGates:
            {{- if .KubeletFeatureGates -}}
              {{ range $key, $val := .KubeletFeatureGates }}
              {{ $key }}: {{ $val }}
              {{- end -}}
            {{- end }}
            protectKernelDefaults: true
            readOnlyPort: 0
            rotateCertificates: true
            serverTLSBootstrap: true
            staticPodPath: /etc/kubernetes/manifests
            kubeReserved:
            {{- if .KubeReserved -}}
              {{ range $key, $val := .KubeReserved }}
              {{ $key }}: {{ $val }}
              {{- end -}}
            {{- else }}
              cpu: 200m
              ephemeral-storage: 1Gi
              memory: 200Mi
            {{- end }}
            systemReserved:
            {{- if .SystemReserved -}}
              {{ range $key, $val := .SystemReserved }}
              {{ $key }}: {{ $val }}
              {{- end -}}
            {{- else }}
              cpu: 200m
              ephemeral-storage: 1Gi
              memory: 200Mi
            {{- end }}
            evictionHard:
            {{- if .EvictionHard -}}
              {{ range $key, $val := .EvictionHard }}
              {{ $key }}: {{ $val }}
              {{- end -}}
            {{- else }}
              imagefs.available: 15%
              memory.available: 100Mi
              nodefs.available: 10%
              nodefs.inodesFree: 5%
            {{- end }}
            tlsCipherSuites:
            - TLS_AES_128_GCM_SHA256
            - TLS_AES_256_GCM_SHA384
            - TLS_CHACHA20_POLY1305_SHA256
            - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
            - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
            - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
            - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
            - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
            - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
            volumePluginDir: /var/lib/kubelet/volumeplugins

    - path: /etc/systemd/system/kubelet-healthcheck.service
      permissions: 0644
      content:
        inline:
          data: |
            [Unit]
            Requires=kubelet.service
            After=kubelet.service

            [Service]
            ExecStart=/opt/bin/health-monitor.sh kubelet

            [Install]
            WantedBy=multi-user.target

    ## Flatcar specific configuration
    - path: /proc/sys/kernel/panic_on_oops
      permissions: 0644
      content:
        inline:
          data: |
            1

    - path: /proc/sys/kernel/panic
      permissions: 0644
      content:
        inline:
          data: |
            10

    - path: /proc/sys/vm/overcommit_memory
      permissions: 0644
      content:
        inline:
          data: |
            1

    - path: /etc/ssh/sshd_config
      permissions: 0600
      content:
        inline:
          data: |
            # Use most defaults for sshd configuration.
            Subsystem sftp internal-sftp
            ClientAliveInterval 180
            UseDNS no
            UsePAM yes
            PrintLastLog no # handled by PAM
            PrintMotd no # handled by PAM
            PasswordAuthentication no
            ChallengeResponseAuthentication no