Feature: gardener
Description
A feature that configures Garden Linux for Gardener Kubernetes cluster nodes. Garden Linux is the Container Node OS for Gardener.
What it does
Installs containerd, Kubernetes tooling (ipvsadm, ethtool, socat), filesystem clients (btrfs-progs, xfsprogs, nfs-common, cifs-utils), and standard tools (curl, jq). Configures:
- AppArmor as the Linux Security Module (replaces SELinux)
containerdservice (disabled by default; Gardener enables it)/usrmounted as a separate read-only partition for immutabilitydmesgaccessible to all users (Gardener requirement)- IPVS kernel module loading
aptdaily timer disabled (Gardener manages updates)
Removes /etc/containerd/config.toml (Gardener provides its own) and /etc/sysctl.d/40-restrict-dmesg.conf (must allow dmesg).
Files
Files present in this feature and their purpose. See the feature file reference for the semantics of each file type.
| File | Purpose |
|---|---|
exec.config (ref) | Configures AppArmor LSM, enables containerd, disables the apt daily timer, and adjusts dmesg access. |
file.exclude (ref) | Removes from rootfs: /etc/containerd/config.toml, /etc/sysctl.d/40-restrict-dmesg.conf. |
file.include.markers.yaml (ref) | Maps files to test-coverage marker IDs. |
fstab.mod (ref) | Adds a read-only /usr mount entry to the fstab for immutable filesystem support. |
info.yaml (ref) | Declares type: element and included/excluded features. |
pkg.include (ref) | Installs: apparmor, containerd, ethtool, ipvsadm, socat, curl, logrotate, and others. |
file.include/etc/kernel/cmdline.d/90-lsm.cfg (file.include) | Sets AppArmor as the active Linux Security Module. |
file.include/etc/modules-load.d/ipvs.conf (file.include) | Loads IPVS kernel modules at boot for Kubernetes load balancing. |
file.include/etc/sysctl.d/40-allow-nonroot-dmesg.conf (file.include) | Allows non-root users to read dmesg (required by Gardener). |
file.include/etc/systemd/system/containerd.service.d/override.conf (file.include) | Sets containerd start dependencies and resource limits. |
file.include/etc/systemd/system-preset/91-disable-apt-daily.preset (file.include) | Disables the apt daily timer (Gardener manages package updates). |
Related features
Includes:
server— base server configuration.sap— SAP-specific configurations used in Gardener environments.iscsi— iSCSI support for Kubernetes persistent volumes.nvme— NVMe support for Kubernetes persistent volumes.
Excludes (incompatible with):
_selinux— replaced by AppArmor as the Linux Security Module.firewall— Gardener manages networking; the nftables firewall conflicts with Kubernetes CNI networking.