This page lists all the features available in Keros 6 that can be customized to meet customer needs.
These features relate to remote access, remote reconfiguration and firmware upgrade.
An SSH connection is the easiest way to securely take control of a remote board.
With Keros 6, all password authentication has been disabled. Only key pair authentication is allowed. One way to do this is for each user to copy their public key onto each array. However, this solution is not very scalable and can pose security problems.
The best way is to use SSH certificates. This is the solution used by Kerlink on Keros 6.
This configuration can be replicated by any customer. Then the public key of their new CA just needs to be copied in the /etc/ssh/trusted_user_ca_keys.d/ directory of each customer board.
A package manager is used to handle softwares installation, updates, or removal. Keros 6 uses APT (Advanced Package Tool) as a package manager.
APT relies on the concept of repositories to find software and resolve dependencies. For APT, a repository is a directory containing packages along with an index file. The repositories are mainly available over the network, but not exclusively.
Kerlink uses aptly to maintain the Keros 6 repositories, which are available at: https://deb.keros.wanesy.com
All Keros 6 boards are pre-configured with the appropriate Kerlink repository. So commands like apt update or apt upgrade are immediately available.
The
/etc/apt/sources.list.d/keros-deb.listfile contains:deb https://deb.keros.wanesy.com/klk6sx stable main
Customers can of course create their own repository (using the tools they prefer). After that, all they need to do is to add a configuration to /etc/apt/sources.list.d/ on their boards to access their packages.
unattended-upgrades is a simple program that automatically triggers APT upgrades.
It is installed by default on Keros 6 but disabled.
Customers can configure it to upgrade just what they need:
Origins-Pattern).Package-Blacklist).More information in the file 50unattended-upgrades
The Kerlink ZTP (Zero Touch Provisioning) is used to perform the initial configuration of the board at runtime.
It downloads a script from the Kerlink servers and runs it. The setup of a ZTP is performed by Kerlink. It cannot be set up by customers themselves.
Here's some useful information to know:
A realistic example would be to use the ZTP to:
unattended-upgrades.Ansible is a well-known automation tool.
When the boards are available in SSH, Ansible can be a simple solution for managing a fleet.
The tasks to run on the managed boards are defined in a YAML file called playbook.
The aim of Ansible is to make tasks repeatable and reusable. So the playbook can be run multiple times without issues on the same board. That's what makes it different from a simple shell script.
JetPorch is a clone of Ansible in rust. It uses almost the same playbook format.
JetPorch is the chosen solution for Keros 6. It can be used by users to perform installation or configuration tasks locally.
WARC (Wanesy Augmented Report Cockpit) is a Kerlink application that is used to interact with the WMC (Wanesy Management Cockpit).
The purpose of WARC is to send statistics to the WMC server and to execute scripts at the server's request. The connection is initiated by the board and can therefore pass through firewalls.
The scripts sent by WMC are either Magic Links or JetPorch:
Keros 6 uses SWUpdate to achieve firmware upgrade, firmware restore or factory reset.
All these actions require a reboot to start on the recovery firmware. The recovery firmware will then use SWUpdate to perform the required action. SWUpdate requires SWU images to be signed with a Kerlink key. Therefore, this mechanism cannot be modified by a customer.
However, it's important to note that after each of these actions, the rootfs is completely reinitialized. This means that the ZTP script will be executed again.
During production, the boards are flashed with the standard Keros 6 image. However, for large-scale production, boards can be pre-stagged with customer-specific configurations.
To do this, we use an autorun which is executed on first boot of the board. Autorun is a Keros6 feature aims to automatically and securely execute jetporch playbook. Once generated, the autorun is added to the test benches that flash the firmware.
This solution can be used to configure the APN for cards that will only use cellular connectivity.