Node Provisioning Runbook: Preparing the Nodes

owner: “Platform Engineering” classification: “CONFIDENTIAL” tags: [“provisioning”, “kernel”, “tpm2”, “tetragon”, “tailscale”]

1. Purpose

This runbook covers the Preparation of the Nodes — transforming bare metal or VM into a fully configured chamber node ready to join the pool.

2. Hardware Requirements

Component	Minimum	Recommended
CPU	4 cores, VT-x/AMD-V	8+ cores, nested virt
RAM	16 GB	32+ GB
Storage	256 GB NVMe	1 TB NVMe
TPM	2.0	2.0 with PCR banks
Network	1 Gbps	10 Gbps + dedicated mgmt

3. OS Installation

1. Boot Syn_OS ISO (chamber profile)
2. Select “Chamber Node” profile at installer
3. Disk: LUKS2 + LVM, /var/lib/chamber-pool on separate LV
4. Network: Static IP, Tailscale auth key injected

4. Kernel Hardening

Apply 97-homelab.conf:

cp /usr/share/synos/kernel/97-homelab.conf /etc/sysctl.d/
sysctl --system

Verify:

verify-kernel-hardening.sh --json

GRUB cmdline (persist via grubby):

slab_nomerge page_poison=1 vsyscall=none module.sig_enforce=1 lockdown=confidentiality

5. TPM2 Provisioning

# Take ownership
tpm2_takeownership -c -p <owner-pass>

# Create endorsement key
tpm2_createprimary -C e -g sha256 -c primary.ctx

# Create attestation key
tpm2_create -C primary.ctx -g sha256 -u ak.pub -r ak.priv
tpm2_evictcontrol -C o -c ak.ctx 0x81010001

Verify:

tpm2_getcap handles-persistent | grep 81010001

6. Tetragon Deployment

# Pull image
docker pull quay.io/cilium/tetragon:v1.7.1

# Run with gRPC
docker run -d --name tetragon \
  --privileged --pid=host --cgroupns=host \
  -v /sys/kernel/debug:/sys/kernel/debug \
  -v /run/tetragon:/run/tetragon \
  -p 54321:54321 \
  quay.io/cilium/tetragon:v1.7.1 \
  --enable-policy=true --grpc-endpoint=0.0.0.0:54321

Verify:

tetra getevents -o json | head -1

7. Chamber Pool Worker

# Install systemd service
cp /opt/synos/systemd/chamber-pool-worker.service /etc/systemd/system/
cp /opt/synos/systemd/chamber-pool-worker.service.d/override.conf /etc/systemd/system/chamber-pool-worker.service.d/

# Configure
echo "POOL_DIR=/var/lib/chamber-pool" > /etc/default/chamber-pool
echo "POOL_SIZE=3" >> /etc/default/chamber-pool

# Enable and start
systemctl daemon-reload
systemctl enable --now chamber-pool-worker

Verify:

chamber-pool.sh list

8. Tailscale Registration

tailscale up --authkey=<key> --advertise-tags=tag:chamber-node

Verify ACL:

tailscale status

9. Validation

Run full hardware + software check:

verify-kernel-hardening.sh --json > /var/log/node-validation.json
e2e-test.sh --duration 10 --timeout 40

10. Rollback

Step	Rollback
Kernel params	grubby --remove-args="..."
TPM2 keys	tpm2_evictcontrol -C o -c 0x81010001
Tetragon	docker stop tetragon && docker rm tetragon
Pool worker	systemctl disable --now chamber-pool-worker

11. Contacts

Role	Contact
Platform Engineer	@platform-eng
TPM Custodian	@tpm-custodian