Composing, installing, and managing RHEL for Edge images Red Hat Enterprise Linux 9 Creating, deploying, and managing Edge systems with Red Hat Enterprise Linux 9 Red Hat Customer Content Services

Commands:
dnf install osbuild-composer composer-cli cockpit-composer bash-completion firewalld
firewall-cmd --add-service=cockpit && firewall-cmd --add-service=cockpit --permanent
systemctl enable osbuild-composer.socket cockpit.socket --now
source /etc/bash_completion.d/composer-cli
id = "k8s" name = "Kubernetes" type = "yum-baseurl" url = "https://server.example.com/repos/company_internal_packages/" check_gpg = false check_ssl = false system = false
composer-cli sources add <file-name> .toml
composer-cli sources list
composer-cli sources info <source_id>
check_gpg = true check_ssl = true distros = ["rhel-9"] id = "rh9-local" name = "packages for RHEL" system = false type = "yum-baseurl" url = " https://local/repos/rhel9/projectrepo/ "
composer-cli sources add <file-name> .toml
composer-cli sources list
composer-cli sources info <source_id>
cd repo/
createrepo_c .
cd repodata/
gpg -u <_gpg-key-email_> --yes --detach-sign --armor /srv/repo/example/repomd.xml
check_gpg = true check_ssl = true id = "signed local packages" name = " repository_name " type = "yum-baseurl" url = " https://local/repos/projectrepo/ " check_repogpg = true gpgkeys=[" https://local/keys/repokey.pub "]
check_gpg = true check_ssl = true check_repogpg id = "custom-local" name = "signed local packages" type = "yum-baseurl" url = " https://local/repos/projectrepo/ " gpgkeys=[" https://remote/keys/other-repokey.pub ", '''-----BEGIN PGP PUBLIC KEY BLOCK----- ... -----END PGP PUBLIC KEY BLOCK-----''']
GPG verification is enabled, but GPG signature is not available. This may be an error or the repository does not support GPG verification: Status code: 404 for http://repo-server/rhel/repodata/repomd.xml.asc (IP: 192.168.1.3)
repomd.xml GPG signature verification error: Bad GPG signature
gpg --verify /srv/repo/example/repomd.xml.asc
sudo mkdir -p /etc/osbuild-composer/repositories
{ "x86_64": [ { "name": "baseos", "baseurl": "http://mirror.example.com/composes/released/RHEL-9/9.0/BaseOS/x86_64/os/", "gpgkey": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\n (... )", "check_gpg": true } ] }
cp /usr/share/osbuild-composer/repositories/rhel- version .json /etc/osbuild-composer/repositories/
json_verify < /etc/osbuild-composer/repositories/rhel- version .json
/etc/osbuild-composer/repositories/rhel- version .json
sudo systemctl restart osbuild-composer.service
cat /etc/yum.repos.d/redhat.repo
cat /etc/yum.repos.d/redhat.repo [AppStream] name = AppStream mirror example baseurl = https://mirror.example.com/RHEL-9/9.0/AppStream/x86_64/os/ enabled = 1 gpgcheck = 0 sslverify = 1 sslcacert = /etc/pki/ca1/ca.crt sslclientkey = /etc/pki/ca1/client.key sslclientcert = /etc/pki/ca1/client.crt metadata_expire = 86400 enabled_metadata = 0
{ "x86_64": [ { "name": "AppStream mirror example", "baseurl": "https://mirror.example.com/RHEL-9/9.0/AppStream/x86_64/os/", "gpgkey": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\n (... )", "check_gpg": true, "rhsm": true } ] }
sudo systemctl restart osbuild-composer.service
sudo yum -v repolist "-baseos-rpms" | grep -i repo-baseurl Repo-baseurl :
https://satellite6.example.com/pulp/content/YourOrg/YourEnv/YourCV/content/dist/rhel9/9/x86_64/baseos/os
sudo mkdir -pvm 0755 /etc/osbuild-composer/repositories
sudo cp /usr/share/osbuild-composer/repositories/*.json /etc/osbuild-composer/repositories/
sudo sed -i -e 's|cdn.redhat.com|satellite6.example.com/pulp/content/YourOrg/YourEnv/YourCV|' /etc/osbuild-composer/repositories/*.json
sudo vi /etc/osbuild-composer/repositories/rhel-9.json
sudo systemctl restart osbuild-worker@1.service osbuild-composer.service
sudo composer-cli blueprints list
name = "blueprint-name" description = "blueprint-text-description" version = "0.0.1" modules = [ ] groups = [ ]
[[packages]] name = "package-name" version = "package-version"
composer-cli blueprints push blueprint-name.toml
composer-cli blueprints show BLUEPRINT-NAME
composer-cli blueprints depsolve blueprint-name
composer-cli compose start blueprint-name image-type
composer-cli compose status
<UUID> RUNNING date blueprint-name blueprint-version image-type
composer-cli compose cancel <UUID>
composer-cli compose delete <UUID>
composer-cli compose start-ostree --ref rhel/9/x86_64/edge --parent parent-OSTree-REF --url URL blueprint-name image-type
composer-cli compose start-ostree --ref rhel/9/x86_64/edge --parent rhel/9/x86_64/edge --url http://10.0.2.2:8080/repo rhel_update edge-commit
composer-cli compose start-ostree --ref rhel/9/x86_64/edge --url http://10.0.2.2:8080/repo rhel_update edge-commit
composer-cli compose status
<UUID> RUNNING date blueprint-name blueprint-version image-type
composer-cli compose cancel <UUID>
composer-cli compose delete <UUID>
composer-cli compose status
<UUID> FINISHED date blueprint-name blueprint-version image-type
composer-cli compose image <UUID>
<UUID> -commit.tar: size MB
name = "blueprint-name" description = "blueprint-text-description" version = "0.0.1" modules = [ ] groups = [ ]
[[packages]] name = "package-name" version = "package-version"
composer-cli blueprints push blueprint-name.toml
composer-cli blueprints show BLUEPRINT-NAME
composer-cli blueprints depsolve blueprint-name
name = "blueprint-installer" description = "blueprint-for-installer-image" version = "0.0.1" [[customizations.user]] name = " user " description = " account " password = " user-password " key = " user-ssh-key " home = " path " groups = [" user-groups "]
composer-cli blueprints push blueprint-name.toml
composer-cli blueprints show blueprint-name
composer-cli blueprints depsolve blueprint-name
composer-cli compose start-ostree --ref rhel/9/x86_64/edge --url URL-OSTree-repository blueprint-name image-type
composer-cli compose status
<UUID> RUNNING date blueprint-name blueprint-version image-type
composer-cli compose cancel <UUID>
composer-cli compose delete <UUID>
composer-cli compose start-ostree --ref rhel/9/x86_64/edge --url URL-OSTree-repository blueprint-name image-type
composer-cli compose status
<UUID> RUNNING date blueprint-name blueprint-version image-type
composer-cli compose cancel <UUID>
composer-cli compose delete <UUID>
composer-cli compose status
<UUID> FINISHED date blueprint-name blueprint-version image-type
composer-cli compose image <UUID>
<UUID> -boot.iso: size MB
name = " blueprint_name " description = " blueprint_version " version = "0.1" distro = " different_minor_version "
name = "tmux" description = "tmux image with openssh" version = "1.2.16" distro = "rhel-9.5"
[[groups]] name = " group_name "
[[groups]] name = "anaconda-tools"
[customizations] hostname = "baseimage"
[[customizations.user]] name = " USER-NAME " description = " USER-DESCRIPTION " password = " PASSWORD-HASH " key = " PUBLIC-SSH-KEY " home = "/home/ USER-NAME /" shell = " /usr/bin/bash " groups = [ "users", "wheel" ] uid = NUMBER gid = NUMBER
[[customizations.user]] name = "admin" description = "Administrator account" password = "USD6USDCHO2USD3rN8eviE2t50lmVyBYihTgVRHcaecmeCk31L..." key = "PUBLIC SSH KEY" home = "/srv/widget/" shell = "/usr/bin/bash" groups = ["widget", "users", "wheel"] uid = 1200 gid = 1200 expiredate = 12345
python3 -c 'import crypt,getpass;pw=getpass.getpass();print(crypt.crypt(pw) if (pw==getpass.getpass("Confirm: ")) else exit())'
[[customizations.group]] name = " GROUP-NAME " gid = NUMBER
[[customizations.group]] name = "widget" gid = 1130
[[customizations.sshkey]] user = " root " key = " PUBLIC-SSH-KEY "
[[customizations.sshkey]] user = "root" key = "SSH key for root"
[customizations.kernel] append = " KERNEL-OPTION "
[customizations.kernel] name = "kernel-debug" append = "nosmt=force"
[customizations.timezone] timezone = " TIMEZONE " ntpservers = " NTP_SERVER "
[customizations.timezone] timezone = "US/Eastern" ntpservers = ["0.north-america.pool.ntp.org", "1.north-america.pool.ntp.org"]
[customizations.locale] languages = ["LANGUAGE"] keyboard = " KEYBOARD "
[customizations.locale] languages = ["en_US.UTF-8"] keyboard = "us"
localectl list-locales
localectl list-keymaps
[customizations.firewall] ports = ["PORTS"]
[customizations.firewall] ports = ["22:tcp", "80:tcp", "imap:tcp", "53:tcp", "53:udp", "30000-32767:tcp", "30000-32767:udp"]
[customizations.firewall.services] enabled = ["SERVICES"] disabled = ["SERVICES"]
firewall-cmd --get-services
[customizations.firewall.services] enabled = ["ftp", "ntp", "dhcp"] disabled = ["telnet"]
[customizations.services] enabled = ["SERVICES"] disabled = ["SERVICES"]
[customizations.services] enabled = ["sshd", "cockpit.socket", "httpd"] disabled = ["postfix", "telnetd"]
[[customizations.filesystem]] mountpoint = "MOUNTPOINT" minsize = MINIMUM-PARTITION-SIZE
[[customizations.filesystem]] mountpoint = "/var" minsize = 1073741824
[[customizations.filesystem]] mountpoint = "/opt" minsize = "20 GiB"
[[customizations.filesystem]] mountpoint = "/boot" minsize = "1 GiB"
[[customizations.filesystem]] mountpoint = "/var" minsize = 2147483648
[[customizations.directories]] path = "/etc/ directory_name " mode = " octal_access_permission " user = " user_string_or_integer " group = " group_string_or_integer " ensure_parents = boolean
[[customizations.files]] path = "/etc/ directory_name " mode = " octal_access_permission " user = " user_string_or_integer " group = " group_string_or_integer " data = "Hello world!"
composer-cli blueprints depsolve BLUEPRINT-NAME
mkdir /mnt/rhel9-install/ mount -o loop,ro -t iso9660 /path_directory/installer.iso /mnt/rhel9-install/
mkdir /var/www/html/httpboot/ cp -R /mnt/rhel9-install/* /var/www/html/httpboot/ chmod -R +r /var/www/html/httpboot/*
systemctl start httpd.service
name = "simplified-installer-blueprint" description = "blueprint for the simplified installer image" version = "0.0.1" packages = [] modules = [] groups = [] distro = "" [customizations] installation_device = "/dev/vda" [[customizations.user]] name = "admin" password = "admin" groups = ["users", "wheel"] [customizations.fdo] manufacturing_server_url = "http://10.0.0.2:8080" diun_pub_key_insecure = "true"
composer-cli blueprints push blueprint-name.toml
composer-cli blueprints show blueprint-name
composer-cli blueprints depsolve blueprint-name
composer-cli compose start-ostree blueprint-name edge-simplified-installer --ref rhel/9/x86_64/edge --url URL-OSTree-repository \
composer-cli compose status
<UUID> RUNNING date blueprint-name blueprint-version image-type
composer-cli compose cancel <UUID>
composer-cli compose delete <UUID>
composer-cli compose status
<UUID> FINISHED date blueprint-name blueprint-version image-type
composer-cli compose image <UUID>
<UUID> -simplified-installer.iso: size MB
openssl x509 -fingerprint -sha256 -noout -in /etc/fdo/aio/keys/diun_cert.pem | cut -d"=" -f2 | sed 's/://g'
cat /etc/fdo/aio/keys/diun_cert.pem.
virt-install --name edge-install-image --disk path=" ", ,format=qcow2 --ram 3072 --memory 4096 --vcpus 2 --network network=integration,mac=mac_address --os-type linux --os-variant rhel9 --cdrom "/var/lib/libvirt/images/"ISO_FILENAME" --boot uefi,loader_ro=yes,loader_type=pflash,nvram_template=/usr/share/edk2/ovmf/OVMF_VARS.fd,loader_secure=no --virt-type kvm --graphics none --wait=-1 --noreboot
Install Red Hat Enterprise Linux 9 Test this media & install Red Hat Enterprise Linux 9
name = "system-fips-mode-enabled" description = "blueprint with FIPS enabled " version = "0.0.1" [ostree] ref= "example/edge" url= "http://example.com/repo" [customizations] installation_device = "/dev/vda" fips = true [[customizations.user]] name = "admin" password = "admin" groups = ["users", "wheel"] [customizations.fdo] manufacturing_server_url = "https://fdo.example.com" diun_pub_key_insecure = true
composer-cli blueprints push <blueprint-name> .toml
composer-cli blueprints show <blueprint-name>
composer-cli blueprints depsolve <blueprint-name>
composer-cli compose start-ostree \ <blueprint-name> \ edge-simplified-installer \ --ref rhel/8/x86_64/edge \ --url <URL-OSTree-repository> \
composer-cli compose status ... <UUID> FINISHED <date> <blueprint-name> <blueprint-version> <image-type> ...
composer-cli compose image <UUID>
<UUID> -simplified-installer.iso: <size> MB
virt-install \ --name edge-device --disk path="/var/lib/libvirt/images/edge-device.qcow2",size=5,format=qcow2 \ --memory 4096 \ --vcpus 2 \ --network network=default \ --os-type linux \ --os-variant rhel8.9 \ --cdrom /var/lib/libvirt/images/ <UUID> -simplified-installer.iso \ --boot uefi,loader.secure=false \ --virt-type kvm \ --graphics none \ --wait=-1 \ --noreboot
fips-mode-setup --check FIPS mode is enabled.
name = "minimal-raw-blueprint" description = "blueprint for the Minimal Raw image" version = "0.0.1" packages = [] modules = [] groups = [] distro = "" [[customizations.user]] name = "admin" password = "admin" groups = ["users", "wheel"]
composer-cli blueprints push <blueprint_name> .toml
composer-cli blueprints list
composer-cli blueprints depsolve <blueprint_name>
composer-cli compose start <blueprint_name> minimal-raw
composer-cli compose status
<UUID> RUNNING date <blueprint_name> blueprint-version minimal-raw
composer-cli compose status
<UUID> FINISHED date <blueprint_name> <blueprint_version> minimal-raw
composer-cli compose image <UUID>
3f9223c1-6ddb-4915-92fe-9e0869b8e209-raw.img.xz
xz -d <UUID> -raw.img.xz
Install Red Hat Enterprise Linux 9 Test this media & install Red Hat Enterprise Linux 9
cat /etc/os-release
lsblk
name = "rhel-edge-container-no-users" description = "" version = "0.0.1"
composer-cli compose start-ostree <rhel-edge-container-no-users> rhel-edge-container
composer-cli compose status
composer-cli compose image <UUID>
skopeo copy oci-archive:_<UUID>_-container.tar containers-storage:localhost/rfe-93-mirror:latest
podman run -d --rm --name <rfe-93-mirror> -p 8080:8080 localhost/ <rfe-93-mirror>
name = " <edge-raw> " description = "" version = "0.0.1" [[customizations.user]] name = "admin" password = "admin" groups = ["wheel"]
composer-cli compose start-ostree edge-raw edge-raw-image --url http://10.88.0.1:8080/repo
composer-cli compose image <UUID>
xz --decompress <UUID> >-image.raw.xz
sudo dnf/yum install -y butane
variant: r4e version: 1.0.0 ignition: config: merge: - source: http://192.168.122.1:8000/sample.ign passwd: users: - name: core groups: - wheel password_hash: password_hash_here ssh_authorized_keys: - ssh-ed25519 some-ssh-key-here storage: files: - path: /etc/NetworkManager/system-connections/enp1s0.nmconnection contents: inline: | [connection] id=enp1s0 type=ethernet interface-name=enp1s0 [ipv4] address1=192.168.122.42/24,192.168.122.1 dns=8.8.8.8; dns-search= may-fail=false method=manual mode: 0600 - path: /usr/local/bin/startup.sh contents: inline: | #!/bin/bash echo "Hello, World!" mode: 0755 systemd: units: - name: hello.service contents: | [Unit] Description=A hello world [Install] WantedBy=multi-user.target enabled: true - name: fdo-client-linuxapp.service dropins: - name: log_trace.conf contents: | [Service] Environment=LOG_LEVEL=trace
./path/butane example.bu {"ignition":{"config":{"merge":[{"source":"http://192.168.122.1:8000/sample.ign"}]},"timeouts":{"httpTotal":30},"version":"3.3.0"},"passwd":{"users":[{"groups":["wheel"],"name":"core","passwordHash":"password_hash_here","sshAuthorizedKeys":["ssh-ed25519 some-ssh-key-here"]}]},"storage":{"files":[{"path":"/etc/NetworkManager/system-connections/enp1s0.nmconnection","contents":{"compression":"gzip","source":"data:;base64,H4sIAAAAAAAC/0yKUcrCMBAG3/csf/ObUKQie5LShyX5SgPNNiSr0NuLgiDzNMPM8VBFtHzoQjkxtPp+ITsrGLahKYyyGtoqEYNKwfeZc32OC0lKDb179rfg/HVyPgQ3hv8w/v0WT0k7T+7D/S1Dh7S4MRU5h1XyzqvsHVRg25G4iD5kp1cAAAD//6Cvq2ihAAAA"},"mode":384},{"path":"/usr/local/bin/startup.sh","contents":{"source":"data:;base64,IyEvYmluL2Jhc2gKZWNobyAiSGVsbG8sIFdvcmxkISIK"},"mode":493}]},"systemd":{"units":[{"contents":"[Unit]\nDescription=A hello world\n[Install]\nWantedBy=multi-user.target","enabled":true,"name":"hello.service"},{"dropins":[{"contents":"[Service]\nEnvironment=LOG_LEVEL=trace\n","name":"log_trace.conf"}],"name":"fdo-client-linuxapp.service"}]}}
[customizations.ignition.embedded] config = "eyJ --- BASE64 STRING TRIMMED --- 19fQo="
[customizations.ignition.firstboot] url = "http://your_server/ignition_configuration.ig"
name = "simplified-installer-blueprint" description = "Blueprint with Ignition for the simplified installer image" version = "0.0.1" packages = [] modules = [] groups = [] distro = "" [customizations.ignition.embedded] config = "eyJ --- BASE64 STRING TRIMMED --- 19fQo="
composer-cli blueprints push blueprint-name .toml
composer-cli blueprints show blueprint-name
composer-cli blueprints depsolve blueprint-name
{ "ignition":{ "version":"3.3.0" }, "passwd":{ "users":[ { "groups":[ "wheel" ], "name":"core", "passwordHash":"USD6USDjfuNnO9t1Bv7N" } ] } }
name = "vmdk-image" description = "Blueprint with Ignition for the vmdk image" version = "0.0.1" packages = ["open-vm-tools"] modules = [] groups = [] distro = "" [[customizations.user]] name = "admin" password = "admin" groups = ["wheel"] [customizations.ignition.firstboot] url = http:// <IP_address> :8080/ config.ig
composer-cli blueprints push <blueprint-name> .toml
composer-cli blueprints show <blueprint-name>
composer-cli blueprints depsolve <blueprint-name>
composer-cli compose start start-ostree <blueprint-name> edge-vsphere -- <url>
composer-cli compose status
<UUID> RUNNING date <blueprint-name> <blueprint-version> edge-vsphere
composer-cli compose image <UUID>
GOVC_URL GOVC_DATACENTER GOVC_FOLDER GOVC_DATASTORE GOVC_RESOURCE_POOL GOVC_NETWORK
govc import.vmdk ./composer-api.vmdk foldername
govc vm.create -net="VM Network" -net.adapter=vmxnet3 -disk.controller=pvscsi -on=false -m=4096 -c=2 -g=rhel9_64Guest -firmware=efi vm_name govc vm.disk.attach -disk=" foldername /composer-api.vmdk" govc vm.power -on -vm vm_name -link=false vm_name
govc vm.power -on vmname
HOST=USD(govc vm.ip vmname )
ssh admin@HOST
{ "ignition":{ "version":"3.3.0" }, "passwd":{ "users":[ { "groups":[ "wheel" ], "name":"core", "passwordHash":"USD6USDjfuNnO9t1Bv7N" } ] } }
name = "ami-edge-image" description = "Blueprint for Edge AMI image" version = "0.0.1" packages = ["cloud-init"] modules = [] groups = [] distro = "" [[customizations.user]] name = "admin" password = "admin" groups = ["wheel"] [customizations.ignition.firstboot] url = http:// <IP_address> :8080/ config.ig
composer-cli blueprints push <blueprint-name> .toml
composer-cli blueprints show <blueprint-name>
composer-cli blueprints depsolve <blueprint-name>
composer-cli compose start-ostree <blueprint-name> edge-ami -ref rhel/9/x86_64/edge --url <ostree repo url>
composer-cli compose status
<UUID> RUNNING date <blueprint-name> <blueprint-version> edge-ami
composer-cli compose image <UUID>
aws configure
aws configure --profile
aws s3 ls
aws s3 cp <path_to_image/image> s3:// <your_bucket_name>
aws s3 ls s3:// <your_bucket_name>
Description: RHEL for Edge image
Format: edge-ami
Url: s3://rhel-edge-ami-us-west-2/UUID-image.raw
aws ec2 import-snapshot --description "RHEL edge" \ --disk-container file://container-simple.json --region us-west-2
Description: RHEL for Edge image
Format: edge-ami
Url: s3://rhel-edge-ami-us-west-2/UUID-image.raw
aws ec2 describe-import-snapshot-tasks --import-task-ids import-snap-0f3055c4b7a454c85 { "ImportSnapshotTasks": [ { "Description": "RHEL edge", "ImportTaskId": "import-snap-0f3055c4b7a454c85", "SnapshotTaskDetail": { "Description": "RHEL edge", "DiskImageSize": 10737418240.0, "Format": "RAW", "SnapshotId": "snap-001b267e752039eab", "Status": "completed", "Url": "s3://rhel-edge-ami-us-west-2/2ba3c125-cc58-4cc0-861a-4cc78e892df6-image.raw", "UserBucket": { "S3Bucket": "rhel-edge-ami-us-west-2", "S3Key": "2ba3c125-cc58-4cc0-861a-4cc78e892df6-image.raw" } }, "Tags": [] } ] }
aws ec2 register-image \ --name ami-edge-name -ami-x86" \ --architecture <architecture> \ --tag-specifications 'ResourceType=image,Tags=\\\{Key=Name,Value={{ blueprint_name }}-ami-x86}' \ --root-device-name /dev/sda1 \ --block-device-mappings DeviceName=/dev/sda1,Ebs={SnapshotId={{ snapshot_id }}} DeviceName=/dev/sdh,Ebs={VolumeSize=10} \ --boot-mode uefi-preferred --query="ImageId" --output=text \ --region="{{ aws_region }}" i
name = "rhel-edge-container" description = "Minimal RHEL for Edge Container blueprint" version = "0.0.1"
name = "rhel-edge-simplified-installer-with-fdo" description = "Minimal RHEL for Edge Simplified Installer with FDO blueprint" version = "0.0.1" packages = [] modules = [] groups = [] distro = "" [customizations] installation_device = "/dev/vda" [customizations.fdo] manufacturing_server_url = "http://10.0.0.2:8080" diun_pub_key_insecure = "true"
for i in "diun" "manufacturer" "device-ca" "owner"; do fdo-admin-tool generate-key-and-cert USDi; done ls keys device_ca_cert.pem device_ca_key.der diun_cert.pem diun_key.der manufacturer_cert.pem manufacturer_key.der owner_cert.pem owner_key.der
tree keys
- device_ca_cert.pem - device_ca_key.der - diun_cert.pem - diun_key.dre - manufacturer_cert.pem - manufacturer_key.der - owner_cert.pem - owner_key.pem
dnf install -y fdo-admin-cli
rpm -qa | grep fdo-manufacturing-server --refresh
ls /usr/share/doc/fdo
Output: manufacturing-server.yml owner-onboarding-server.yml rendezvous-info.yml rendezvous-server.yml serviceinfo-api-server.yml
cat /usr/share/doc/fdo/manufacturing-server.yml
session_store_driver: Directory: path: /etc/fdo/stores/manufacturing_sessions/ ownership_voucher_store_driver: Directory: path: /etc/fdo/stores/owner_vouchers public_key_store_driver: Directory: path: /etc/fdo/stores/manufacturer_keys bind: "0.0.0.0:8080" protocols: plain_di: false diun: mfg_string_type: SerialNumber key_type: SECP384R1 allowed_key_storage_types: - Tpm - FileSystem key_path: /etc/fdo/keys/diun_key.der cert_path: /etc/fdo/keys/diun_cert.pem rendezvous_info: - deviceport: 8082 ip_address: 192.168.122.99 ownerport: 8082 protocol: http manufacturing: manufacturer_cert_path: /etc/fdo/keys/manufacturer_cert.pem device_cert_ca_private_key: /etc/fdo/keys/device_ca_key.der device_cert_ca_chain: /etc/fdo/keys/device_ca_cert.pem owner_cert_path: /etc/fdo/keys/owner_cert.pem manufacturer_private_key: /etc/fdo/keys/manufacturer_key.der
systemctl list-unit-files | grep fdo | grep manufacturing fdo-manufacturing-server.service disabled disabled
systemctl enable --now fdo-manufacturing-server.service
firewall-cmd --add-port=8080/tcp --permanent systemctl restart firewalld
ss -ltn
dnf install -y fdo-rendezvous-server
storage_driver: Directory: path: /etc/fdo/stores/rendezvous_registered session_store_driver: Directory: path: /etc/fdo/stores/rendezvous_sessions trusted_manufacturer_keys_path: /etc/fdo/keys/manufacturer_cert.pem max_wait_seconds: ~ bind: "0.0.0.0:8082"
systemctl list-unit-files | grep fdo | grep rende fdo-rendezvous-server.service disabled disabled
systemctl enable --now fdo-rendezvous-server.service
ss -ltn
firewall-cmd --add-port=8082/tcp --permanent systemctl restart firewalld
dnf install -y fdo-owner-cli fdo-owner-onboarding-server
--- ownership_voucher_store_driver: Directory: path: /etc/fdo/stores/owner_vouchers session_store_driver: Directory: path: /etc/fdo/stores/owner_onboarding_sessions trusted_device_keys_path: /etc/fdo/keys/device_ca_cert.pem owner_private_key_path: /etc/fdo/keys/owner_key.der owner_public_key_path: /etc/fdo/keys/owner_cert.pem bind: "0.0.0.0:8081" service_info_api_url: "http://localhost:8083/device_info" service_info_api_authentication: BearerToken: token: Kpt5P/5flBkaiNSvDYS3cEdBQXJn2Zv9n1D50431/lo= owner_addresses: - transport: http addresses: - ip_address: 192.168.122.149 port: 8081 report_to_rendezvous_endpoint_enabled: true
--- service_info: initial_user: username: admin sshkeys: - "ssh-rsa AAAA...." files: - path: /root/resolv.conf source_path: /etc/resolv.conf commands: - command: touch args: - /root/test return_stdout: true return_stderr: true diskencryption_clevis: - disk_label: /dev/vda4 binding: pin: tpm2 config: "{}" reencrypt: true additional_serviceinfo: ~ bind: "0.0.0.0:8083" device_specific_store_driver: Directory: path: /etc/fdo/stores/serviceinfo_api_devices service_info_auth_token: Kpt5P/5flBkaiNSvDYS3cEdBQXJn2Zv9n1D50431/lo= admin_auth_token: zJNoErq7aa0RusJ1w0tkTjdITdMCWYkndzVv7F0V42Q=
systemctl list-unit-files | grep fdo fdo-owner-onboarding-server.service disabled disabled fdo-serviceinfo-api-server.service disabled disabled
systemctl enable --now fdo-owner-onboarding-server.service systemctl enable --now fdo-serviceinfo-api-server.service
ss -ltn
firewall-cmd --add-port=8081/tcp --permanent firewall-cmd --add-port=8083/tcp --permanent systemctl restart firewalld
dnf install -y sqlite sqlite-devel libpq libpq-devel
sudo editor manufacturing-server.yml
/home/rhel/fido-device-onboard-rs/aio-dir/stores/owner_vouchers
ownership_voucher_store_driver: Postgres: Manufacturer
sudo LOG-LEVEL=debug SQLITE_MANUFACTURER-DATABASE_URL=./manufacturer-db.sqlite ./usr/libexec/fdo/fdo-manufacturing-server
mkdir export
fdo-owner-tool export-manufacturer-vouchers DB_TYPE DB_URL PATH [GUID]
fdo-owner-tool import-ownership-vouchers DB_TYPE DB_URL SOURCE_PATH
tar xvf <UUID> -commit.tar
jq '.["ostree-commit"]' < compose.json
rpm-ostree db list rhel/9/x86_64/edge --repo=repo
lang en_US.UTF-8 keyboard us timezone Etc/UTC --isUtc text zerombr clearpart --all --initlabel autopart reboot user --name=core --group=wheel sshkey --username=core "ssh-rsa AAAA3Nza... ." rootpw --lock network --bootproto=dhcp ostreesetup --nogpg --osname=rhel --remote=edge --url=https://mirror.example.com/repo/ --ref=rhel/9/x86_64/edge
events { } http { server{ listen 8080; root /usr/share/nginx/html; } } pid /run/nginx.pid; daemon off;
FROM registry.access.redhat.com/ubi8/ubi RUN dnf -y install nginx && dnf clean all COPY kickstart.ks /usr/share/nginx/html/ COPY repo /usr/share/nginx/html/ COPY nginx /etc/nginx.conf EXPOSE 8080 CMD ["/usr/sbin/nginx", "-c", "/etc/nginx.conf"] ARG commit ADD USD{commit} /usr/share/nginx/html/
lang en_US.UTF-8 keyboard us timezone Etc/UTC --isUtc text zerombr clearpart --all --initlabel autopart reboot user --name=core --group=wheel sshkey --username=core "ssh-rsa AAAA3Nza... ." ostreesetup --nogpg --osname=rhel --remote=edge --url=https://mirror.example.com/repo/ --ref=rhel/9/x86_64/edge %post cat << EOF > /etc/greenboot/check/required.d/check-dns.sh #!/bin/bash DNS_SERVER=USD(grep nameserver /etc/resolv.conf | cut -f2 -d" ") COUNT=0 check DNS server is available ping -c1 USDDNS_SERVER while [ USD? != '0' ] && [ USDCOUNT -lt 10 ]; do COUNT++ echo "Checking for DNS: Attempt USDCOUNT ." sleep 10 ping -c 1 USDDNS_SERVER done EOF %end
podman build -t name-of-container-image --build-arg commit= uuid -commit.tar .
podman run --rm -d -p port :8080 localhost/ name-of-container-image
lang en_US.UTF-8 keyboard us timezone UTC zerombr clearpart --all --initlabel autopart --type=plain --fstype=xfs --nohome reboot text network --bootproto=dhcp user --name=core --groups=wheel --password=edge services --enabled=ostree-remount ostreesetup --nogpg --url=http://edge_device_ip:port/repo/ --osname=rhel --remote=edge --ref=rhel/9/x86_64/edge
virt-install --name rhel-edge-test-1 --memory 2048 --vcpus 2 --disk path=prepared_disk_image.qcow2,format=qcow2,size=8 --os-variant rhel9 --cdrom /home/username/Downloads/rhel-9-x86_64-boot.iso
inst.ks=http://web-server_device_ip:port/kickstart.ks
rpm-ostree status
State: idle Deployments: * ostree://edge:rhel/9/x86_64/edge Timestamp: 2020-09-18T20:06:54Z Commit: 836e637095554e0b634a0a48ea05c75280519dd6576a392635e6fa7d4d5e96
virt-install --name rhel-edge-test-1 --memory 2048 --vcpus 2 --disk path=prepared_disk_image.qcow2,format=qcow2,size=8 --os-variant rhel9 --cdrom /home/username/Downloads/rhel-9-x86_64-boot.iso
inst.ks=http://web-server_device_ip:port/kickstart.ks
rpm-ostree status
State: idle Deployments: * ostree://edge:rhel/9/x86_64/edge Timestamp: 2020-09-18T20:06:54Z Commit: 836e637095554e0b634a0a48ea05c75280519dd6576a392635e6fa7d4d5e96
sudo podman load -i UUID -container.tar
sudo podman tag image-ID localhost/edge-container
sudo podman run -d --name= edge-container -p 8080:8080 localhost/edge-container
sudo podman ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 2988198c4c4b ..../localhost/edge-container /bin/bash 3 seconds ago Up 2 seconds ago edge-container
composer-cli compose start-ostree --ref rhel/9/x86_64/edge --url URL-OSTree-repository blueprint-name image-type
composer-cli compose status
<UUID> RUNNING date blueprint-name blueprint-version image-type
composer-cli compose cancel <UUID>
composer-cli compose delete <UUID>
qemu-img create -f qcow2 diskfile .qcow2 20G
virt-install --boot uefi --name VM_NAME --memory 2048 --vcpus 2 --disk path= diskfile.qcow2 --cdrom /var/lib/libvirt/images/ UUID -installer.iso --os-variant rhel9.0
virt-viewer --connect qemu:///system --wait VM_NAME
rpm-ostree status
composer-cli blueprints save BLUEPRINT-NAME
composer-cli blueprints push BLUEPRINT-NAME.toml
composer-cli blueprints show BLUEPRINT-NAME
composer-cli blueprints depsolve BLUEPRINT-NAME
composer-cli compose start-ostree --ref rhel/9/x86_64/edge --url http://localhost:8080/repo <blueprint-name> edge-commit
composer-cli compose image <UUID>
tar -xf UUID .tar -C /var/tmp
ostree --repo=/var/tmp/repo log rhel/9/x86_64/edge commit d523ef801e8b1df69ddbf73ce810521b5c44e9127a379a4e3bba5889829546fa Parent: f47842de7e6859cee07d743d3c67949420874727883fa9dbbaeb5824ad949d91 ContentChecksum: f0f6703696331b661fa22d97358db48ba5f8b62711d9db83a00a79b3ae0dfe16 Date: 2023-06-04 20:22:28 /+0000 Version: 9
sudo ostree --repo=/var/srv/httpd/repo pull-local /var/tmp/repo 20 metadata, 22 content objects imported; 0 bytes content written
ostree --repo=/var/srv/httpd/repo log rhel/9/x86_64/edge commit d523ef801e8b1df69ddbf73ce810521b5c44e9127a379a4e3bba5889829546fa Parent: f47842de7e6859cee07d743d3c67949420874727883fa9dbbaeb5824ad949d91 ContentChecksum: f0f6703696331b661fa22d97358db48ba5f8b62711d9db83a00a79b3ae0dfe16 Date: 2023-06-04 20:22:28 /+0000 Version: 9 (no subject) commit f47842de7e6859cee07d743d3c67949420874727883fa9dbbaeb5824ad949d91 ContentChecksum: 9054de3fe5f1210e3e52b38955bea0510915f89971e3b1ba121e15559d5f3a63 Date: 2023-06-04 20:01:08 /+0000 Version: 9 (no subject)
tar -xf UUID-commit.tar -C UPGRADE_FOLDER
ostree --repo=/usr/share/nginx/html/repo pull-local UPGRADE_FOLDER ostree --repo=/usr/share/nginx/html/repo summary -u
rpm-ostree status
rpm-ostree upgrade --check
rpm-ostree upgrade
rpm-ostree status
systemctl reboot
rpm-ostree status
rpm-ostree db diff parent_commit new_commit
composer-cli compose start-ostree --ref ostree_ref --url URL-OSTree-repository -blueprint_name_ image-type
composer-cli compose status
tar -xf UUID-commit.tar -C upgrade_folder
ostree --repo=/var/www/html/repo pull-local /tmp/ostree-commit/repo ostree --repo=/var/www/html/repo summary -u
rpm-ostree status
rpm-ostree upgrade --check
rpm-ostree upgrade
rpm-ostree status
systemctl reboot
rpm-ostree status
rpm-ostree db diff parent_commit new_commit
cat ./child-commit_ID-container.tar | sudo podman load
sudo podman run -p 8080:8080 localhost/edge-test
ostree --repo=/var/www/html/repo pull-local /tmp/ostree-commit/repo ostree --repo=/var/www/html/repo summary -u
rpm-ostree status
rpm-ostree upgrade --check
rpm-ostree upgrade
rpm-ostree status
systemctl reboot
rpm-ostree upgrade
rpm-ostree status
rpm-ostree db diff parent_commit new_commit
sudo composer-cli compose start blueprint-name edge-commit
sudo composer-cli compose start-ostree --ref rhel/8/x86_64/edge --parent parent-OSTree-REF --url URL blueprint-name edge-commit
sudo tar -xf image_file -C /var/www/html
systemctl start httpd.service
sudo cat /etc/ostree/remotes.d/edge.conf
sudo ostree remote show-url edge
ostree remote refs edge
Error: Remote refs not available; server has no summary file
sudo ostree remote add \ --no-gpg-verify rhel9 http://192.168.122.1/repo/
sudo cat /etc/ostree/remotes.d/ edge .conf [remote "edge"] url=http://192.168.122.1/ostree/repo/ gpg-verify=false
sudo cat /etc/ostree/remotes.d/ rhel9 .conf [remote "edge"] url=http://192.168.122.1/repo/ gpg-verify=false
sudo ostree remote show-url rhel9 http://192.168.122.1/ostree-rhel9/repo/
sudo ostree remote list output: edge rhel9
rpm-ostree rebase rhel9:rhel/9/x86_64/edge
systemctl reboot
rpm-ostree status
rpm-ostree status
top
sudo rpm-ostree rollback
systemctl reboot
sudo ostree remote delete edge
systemctl reload rpm-ostreed systemctl enable rpm-ostreed-automatic.timer --now
rpm-ostree status
State: idle; auto updates enabled (check; last run <minutes> ago)
systemctl enable rpm-ostreed-automatic.timer --now
rpm-ostree status
State: idle AutomaticUpdates: stage; rpm-ostreed-automatic.timer: last run <time> ago
systemctl start rpm-ostreed-automatic.service
rpm-ostree status State: busy AutomaticUpdates: stage; rpm-ostreed-automatic.service: running Transaction: automatic (stage)
rpm-ostree status State: idle AutomaticUpdates: stage; rpm-ostreed-automatic.timer: last run <time> ago Deployments:
etc └─ greenboot ├─ check | └─ required.d | └─ init .py └─ green.d └─ red.d
systemctl show --property=SubState --value greenboot-healthcheck.service
systemctl show --property=ExecMainStatus --value greenboot-healthcheck.service
cat /run/motd.d/boot-status
journalctl -u greenboot-healthcheck.service.
rpm-ostree rollback
systemctl reboot
#!/bin/bash DNS_SERVER=USD(grep ^nameserver /etc/resolv.conf | head -n 1 | cut -f2 -d" ") COUNT=0 check DNS server is available ping -c1 USDDNS_SERVER while [ USD? != '0' ] && [ USDCOUNT -lt 10 ]; do ((COUNT++)) echo "Checking for DNS: Attempt USDCOUNT ." sleep 10 ping -c 1 USDDNS_SERVER done
chmod +x check-dns.sh
#!/bin/bash DEF_GW=USD(ip r | awk '/^default/ {print USD3}') SCRIPT=USD(basename USD0) count=10 connected=0 ping_timeout=5 interval=5 while [ USDcount -gt 0 -a USDconnected -eq 0 ]; do echo "USDSCRIPT: Pinging default gateway USDDEF_GW" ping -c 1 -q -W USDping_timeout USDDEF_GW > /dev/null 2>&1 && connected=1 || sleep USDinterval ((--count)) done if [ USDconnected -eq 1 ]; then echo "USDSCRIPT: Default gateway USDDEF_GW is reachable." exit 0 else echo "USDSCRIPT: Failed to ping default gateway USDDEF_GW!" 1>&2 exit 1 fi
chmod +x check-gw.sh
composer-cli compose image _<UUID>
skopeo copy oci-archive:_<UUID>_-container.tar containers-storage:localhost/ostree
podman run -rm -p 8080:8080 ostree
podman ps -a
name = "minimal-rhel92" description = "minimal blueprint for ostree commit" version = "1.0.0" modules = [] groups = [] distro = "rhel-92"
composer-cli blueprints push minimal-rhel92.toml
composer-cli compose start-ostree minimal-rhel92 edge-commit
composer-cli compose image _<rhel-92-uuid> tar -xf <rhel-92-uuid>.tar -C /usr/share/nginx/html/
name = "minimal-rhel87" description = "minimal blueprint for ostree commit" version = "1.0.0" modules = [] groups = [] distro = "rhel-87"
composer-cli blueprints push minimal-rhel87.toml composer-cli compose start-ostree minimal-rhel87 edge-commit
composer-cli compose image <rhel-87-uuid> tar -xf <rhel-87-uuid>.tar
ostree --repo=/usr/share/nginx/html/repo pull-local repo
ostree --repo=/usr/share/nginx/html/repo refs rhel/8/x86_64/edge rhel/9/x86_64/edge ostree --repo=/usr/share/nginx/html/repo show rhel/8/x86_64/edge commit f7d4d95465fbd875f6358141f39d0c573df6a321627bafde68c73850667e5443 ContentChecksum: 41bf2f8b442a770e9bf03e096a46a286f5836e0a0702b7c3516ef4e0acec2dea Date: 2023-09-15 16:17:04 +0000 Version: 8.7 (no subject) ostree --repo=/usr/share/nginx/html/repo show rhel/9/x86_64/edge commit 89290dbfd6f749700c77cbc434c121432defb0c1c367532368eee170d9e53ea9 ContentChecksum: 70235bfb9cae82c53f856183750e809becf0b9b076122b19c40fec92fc6d74c1 Date: 2023-09-15 15:30:24 +0000 Version: 9.2 (no subject)
name = "minimal-rhel92" description = "minimal blueprint for ostree commit" version = "1.1.0" modules = [] groups = [] distro = "rhel-92" [[packages]] name = "strace" version = "*"
composer-cli blueprints push minimal-rhel92.toml composer-cli compose start-ostree minimal-rhel92 edge-commit --url http://localhost/repo --ref rhel/9/x86_64/edge
rm -rf repo composer-cli compose image <rhel-92-uuid> tar -xf <rhel-92-uuid>.tar
ostree --repo=/usr/share/nginx/html/repo pull-local repo
ostree --repo=/usr/share/nginx/html/repo refs rhel/8/x86_64/edge rhel/9/x86_64/edge ostree --repo=/usr/share/nginx/html/repo show rhel/8/x86_64/edge commit f7d4d95465fbd875f6358141f39d0c573df6a321627bafde68c73850667e5443 ContentChecksum: 41bf2f8b442a770e9bf03e096a46a286f5836e0a0702b7c3516ef4e0acec2dea Date: 2023-09-15 16:17:04 +0000 Version: 8.7 (no subject) ostree --repo=/usr/share/nginx/html/repo show rhel/9/x86_64/edge commit a35c3b1a9e731622f32396bb1aa84c73b16bd9b9b423e09d72efaca11b0411c9 Parent: 89290dbfd6f749700c77cbc434c121432defb0c1c367532368eee170d9e53ea9 ContentChecksum: 2335930df6551bf7808e49f8b35c45e3aa2a11a6c84d988623fd3f36df42a1f1 Date: 2023-09-15 18:21:31 +0000 Version: 9.2 (no subject) ostree --repo=/usr/share/nginx/html/repo log rhel/9/x86_64/edge commit a35c3b1a9e731622f32396bb1aa84c73b16bd9b9b423e09d72efaca11b0411c9 Parent: 89290dbfd6f749700c77cbc434c121432defb0c1c367532368eee170d9e53ea9 ContentChecksum: 2335930df6551bf7808e49f8b35c45e3aa2a11a6c84d988623fd3f36df42a1f1 Date: 2023-09-15 18:21:31 +0000 Version: 9.2 (no subject) commit 89290dbfd6f749700c77cbc434c121432defb0c1c367532368eee170d9e53ea9 ContentChecksum: 70235bfb9cae82c53f856183750e809becf0b9b076122b19c40fec92fc6d74c1 Date: 2023-09-15 15:30:24 +0000 Version: 9.2 (no subject) rpm-ostree db diff --repo=/usr/share/nginx/html/repo 89290dbfd6f749700c77cbc434c121432defb0c1c367532368eee170d9e53ea9 a35c3b1a9e731622f32396bb1aa84c73b16bd9b9b423e09d72efaca11b0411c9 ostree diff commit from: 89290dbfd6f749700c77cbc434c121432defb0c1c367532368eee170d9e53ea9 ostree diff commit to: a35c3b1a9e731622f32396bb1aa84c73b16bd9b9b423e09d72efaca11b0411c9 Added: elfutils-default-yama-scope-0.188-3.el9.noarch elfutils-libs-0.188-3.el9.x86_64 strace-5.18-2.el9.x86_64
ostree --repo=/usr/share/nginx/html/repo pull-local repo-prod
ostree --repo=/usr/share/nginx/html/client-server static-delta generate exampleos/x86_64/standard
ostree --repo=repo-prod static-delta generate --from=exampleos/x86_64/standard^^ --to=exampleos/x86_64/standard
ostree --repo=repo-prod summary -u
ostree --repo=/ostree/repo-prod static-delta <delta-update-file-path>
sudo rpm-ostree upgrade
systemctl reboot