Meta-Distribution

We like to define Kairos as a meta-Linux Distribution, as its goal is to convert other distros to an immutable layout with Kubernetes Native components.

Kairos

Kairos is a software stack is composed of the following:

• A core OS image release for each flavor in ISO, qcow2, and other similar formats (see the list of supported distributions) provided for user convenience
• A standard release with provider-based Kubernetes support (officially maintained provider supports k3s and k0s, optional).
• An agent installed into the nodes to manage the node lifecycle.

Every component is extensible and modular such as it can be customized and replaced in the stack and built off either locally or with Kubernetes.

Requirements

In order to convert a Linux Distribution to Kairos, the distribution must meet the following requirements:

• Trusted Boot Images
  • Use a recent enough version of systemd (256+) as init system
  • Use systemd-boot as bootloader
• Secure Boot Only Images
  • Either use systemd or openrc init system
  • Use grub as bootloader
• All
  • If the system is meant to be used with EFI, the kernel needs to have enabled the CONFIG_EFI_STUB option ( see: https://docs.kernel.org/admin-guide/efi-stub.html)

To build Kairos from scratch, see the documentation section.

Internal components

The Kairos artifacts are composed by a base OS (an upstream Linux distribution, like Ubuntu, Alpine, ...) and a set of components that are installed on top of it. The components are:

Internal (all live in the kairos-io/kairos monorepo starting with the v4.3 release):

• kairos-init/ builds Kairos OS images on top of a stock upstream distribution and pins the components below at build time.
• immucore/ is the immutability management interface.
• agent/ manages the installation, reset, and upgrade of the Kairos nodes.
• system packages contains additional packages, cross-distro.
• kcrypt/discovery/ is the component responsible for encryption and decryption of data at rest.
• kcrypt/challenger/ is the KMS side that pairs with the TPM chip to unlock LUKS partitions.
• installer/ is the interactive terminal-UI installer that kairos-agent interactive-install execs into on livecd boot.

The runtime kairos-agent, immucore and kcrypt-discovery-challenger binaries are all served by one multi-call kairos executable that dispatches on argv[0]; the historical binary names are symlinks to it. The kairos-installer binary is separate (it runs as its own process, invoked by kairos-agent interactive-install, and lives at /system/installer/kairos-installer inside the image). See the monorepo README for the full layout.

Optional/External:

• K3s as a Kubernetes distribution
• edgevpn (optional) as fabric for the distributed network, node coordination and bootstrap. Provides also embedded DNS capabilities for the cluster. Internally uses libp2p for the P2P mesh capabilities.
• nohang A sophisticated low memory handler for Linux.
• entangle a CRD to interconnect Kubernetes clusters
• entangle-proxy a CRD to control interconnected clusters
• osbuilder is used to build bootable artifacts from container images
• AuroraBoot is the Kairos Node bootstrapper

For an architecture-focused overview of providers and how they integrate with kairos-agent, see Providers.