Enable kerberos support for NFSv4

[owenthomas17]

Enable kerberos support for NFSv4

Reasons outlined in flatcar/Flatcar#636 - This is an attempt at its implementation

How to use

• Build a new image
• Load kernel modules
  • sudo modprobe nfsv3 nfs_acl nfsv4 nfs
  • sudo modprobe rpcsec_gss_krb5
• Start systemd unit
  • systemctl start rpc-gssd.service
  • systemctl status rpc-gssd.service
    Optionally (all as root)
• Join the flatcar machine to the domain e.g. realm join -U <da-user>
• Create a krb5.conf at /etc/krb5.conf if your domain doesn't provide one
• Generate a kerberos credential cache: kinit -k
• Mount a kerberos enabled share: mkdir /mnt/test && mount.nfs4 -v -o sec=krb5,vers=4.1 fileserver.domain.local:/test-share /mnt/test

Testing done

These steps have been tested with the flatcar SDK on the flatcar-3127 branch, we produced an OpenStack VM and have tested with the Openstack images. The qemu image also appeared to have the correct packages and kernel modules installed although we didn't perform an end to end test with it.

• Changelog entries added in the respective changelog/ directory (user-facing change, bug fix, security fix, update)

[jepio]

With this:

wget  https://raw.githubusercontent.com/flatcar-linux/flatcar-build-scripts/master/package-diff
FILE=flatcar_production_image_contents.txt bash package-diff 2022.02.20+dev-main-nightly-4904 2022.02.22+dev-flatcar-master-4923

we get the following image diff relative to the last nightly:
diff.txt

This looks fine to me. @pothos can you give this a third pair of eyes, there might be something that I'm missing? @JAORMX has also reviewed this already.

[pothos]

Thanks, I think you can also add a changelog entry or even better create a docs section on how to use this.

[owenthomas17]

Thanks for the reviews all.
@pothos - Those suggestions sound sensible. In order for me to write some docs it will take a bit more time. Would you mind if I raise this in a separate PR? I can link it back to the RFE as well.

[pothos]

Then let's create a changelog entry now, e.g. changelog/changes/2022-02-22-enable-kerberos-for-nfsv4.md:

- Enabled Kerberos support for NFSv4 in kernel and userspace tools ([PR#1664](https://github.com/flatcar-linux/coreos-overlay/pull/1664))

[owenthomas17]

@pothos - Added a commit with the changelog, thanks again.

[pothos]

It's a bit long now for the release notes. Since we link to this PR here which also has the same info, I suggest to shorten it to one bullet point

[owenthomas17]

Makes sense, removed in latest commit.