Chapter 1. Embedding in a RHEL for Edge image using image builder Use this guide to build a RHEL image containing MicroShift. 1.1. Preparing for image building Use the image builder tool to compose customized Red Hat Enterprise Linux for Edge (RHEL for Edge) images optimized for edge deployments. You can run a MicroShift cluster with your applications on a RHEL for Edge virtual machine for development and testing first, then use your whole solution in edge production environments. Use the following RHEL documentation to understand the full details of using RHEL for Edge: Read Introduction to RHEL for Edge images . To build an Red Hat Enterprise Linux for Edge (RHEL for Edge) 9.4 image for a given CPU architecture, you need a RHEL 9.4 build host of the same CPU architecture that meets the Image builder system requirements . Follow the instructions in Installing image builder to install image builder and the composer-cli tool. 1.2. Enabling extended support repositories for image building If you have an extended support (EUS) release of MicroShift or Red Hat Enterprise Linux (RHEL), you must enable the RHEL EUS repositories for image builder to use. If you do not have an EUS version, you can skip these steps. Prerequisites You have an EUS version of MicroShift or RHEL or are updating to one. You have root-user access to your build host. You reviewed the Red Hat Device Edge release compatibility matrix . Warning Keeping component versions in a supported configuration of Red Hat Device Edge can require updating MicroShift and RHEL at the same time. Ensure that your version of RHEL is compatible with the version of MicroShift you are updating to, especially if you are updating MicroShift across two minor versions. Otherwise, you can create an unsupported configuration, break your cluster, or both. For more information, see the Red Hat Device Edge release compatibility matrix . Procedure Create the /etc/osbuild-composer/repositories directory by running the following command: USD sudo mkdir -p /etc/osbuild-composer/repositories Copy the /usr/share/osbuild-composer/repositories/rhel-9.4.json file into the /etc/osbuild-composer/repositories directory by running the following command: USD sudo cp /usr/share/osbuild-composer/repositories/rhel-9.4.json /etc/osbuild-composer/repositories/rhel-9.4.json Update the baseos source by modifying the /etc/osbuild-composer/repositories/rhel-9.4.json file with the following values: # ... "baseurl": "https://cdn.redhat.com/content/eus/rhel<9>/<9.4>//baseos/os", 1 # ... 1 Replace <9> with the major RHEL version you are using, and replace <9.4> with the <major.minor> version. Be certain that the RHEL version you choose is compatible with the MicroShift version you are using. Optional. Apply the baseos update by running the following command: USD sudo sed -i "s,dist/rhel<9>/<9.4>/USD(uname -m)/baseos/,eus/rhel<9>/<9.4>/USD(uname -m)/baseos/,g" \ /etc/osbuild-composer/repositories/rhel-<9.4>.json 1 1 Replace <9> with the major RHEL version you are using, and replace <9.4> with the <major.minor> version. Be certain that the RHEL version you choose is compatible with the MicroShift version you are using. Update the appstream source by modifying the /etc/osbuild-composer/repositories/rhel-<major.minor>.json file with the following values: # ... "baseurl": "https://cdn.redhat.com/content/eus/rhel<9>/<9.4>//appstream/os", 1 # ... 1 Replace <9> with the major RHEL version you are using, and replace <9.4> with the <major.minor> version. Be certain that the RHEL version you choose is compatible with the MicroShift version you are using. Optional. Apply the appstream update by running the following command: USD sudo sed -i "s,dist/rhel<9>/<9.4>/USD(uname -m)/appstream/,eus/rhel<9>/<9.4>/USD(uname -m)/appstream/,g" \ /etc/osbuild-composer/repositories/rhel-<9.4>.json 1 1 Replace <9> with the major RHEL version you are using, and replace <9.4> with the <major.minor> version. Be certain that the RHEL version you choose is compatible with the MicroShift version you are using. Verification You can verify the repositories by using the composer-cli tool to display information about the source. Verify the baseos source by running the following command: USD sudo composer-cli sources info baseos | grep 'url =' Example output url = "https://cdn.redhat.com/content/eus/rhel9/9.4/x86_64/baseos/os" Verify the appstream source by running the following command: USD sudo composer-cli sources info appstream | grep 'url =' Example output url = "https://cdn.redhat.com/content/eus/rhel9/9.4/x86_64/appstream/os" 1.3. Adding MicroShift repositories to image builder Use the following procedure to add the MicroShift repositories to image builder on your build host. Prerequisites Your build host meets the image builder system requirements. You have installed and set up image builder and the composer-cli tool. You have root-user access to your build host. Procedure Create an image builder configuration file for adding the rhocp-4.18 RPM repository source required to pull MicroShift RPMs by running the following command: cat > rhocp-4.18.toml <<EOF id = "rhocp-4.18" name = "Red Hat OpenShift Container Platform 4.18 for RHEL 9" type = "yum-baseurl" url = "https://cdn.redhat.com/content/dist/layered/rhel9/USD(uname -m)/rhocp/4.18/os" check_gpg = true check_ssl = true system = false rhsm = true EOF Create an image builder configuration file for adding the fast-datapath RPM repository by running the following command: cat > fast-datapath.toml <<EOF id = "fast-datapath" name = "Fast Datapath for RHEL 9" type = "yum-baseurl" url = "https://cdn.redhat.com/content/dist/layered/rhel9/USD(uname -m)/fast-datapath/os" check_gpg = true check_ssl = true system = false rhsm = true EOF Add the sources to the image builder by running the following commands: USD sudo composer-cli sources add rhocp-4.18.toml USD sudo composer-cli sources add fast-datapath.toml Verification Confirm that the sources were added properly by running the following command: USD sudo composer-cli sources list Example output appstream baseos fast-datapath rhocp-4.18 Additional resources Image builder system requirements Installing image builder 1.4. Adding the MicroShift service to a blueprint Adding the MicroShift RPM package to an image builder blueprint enables the build of a RHEL for Edge image with MicroShift embedded. Start with step 1 to create your own minimal blueprint file which results in a faster MicroShift installation. Start with step 2 to use the generated blueprint for installation which includes all the RPM packages and container images. This is a longer installation process, but a faster start up because container references are accessed locally. Important Replace <microshift_blueprint.toml> in the following procedures with the name of the TOML file you are using. Replace <microshift_blueprint> in the following procedures with the name you want to use for your blueprint. Procedure Use the following example to create your own blueprint file: Custom image builder blueprint example cat > <microshift_blueprint.toml> <<EOF 1 name = " <microshift_blueprint> " 2 description = "" version = "0.0.1" modules = [] groups = [] [[packages]] name = "microshift" version = "4.18.1" 3 [customizations.services] enabled = ["microshift"] EOF 1 The name of the TOML file. 2 The name of the blueprint. 3 Substitute the value for the version you want. For example, insert 4.18.1 to download the MicroShift 4.18.1 RPMs. Optional. Use the blueprint installed in the /usr/share/microshift/blueprint directory that is specific to your platform architecture. See the following example snippet for an explanation of the blueprint sections: Generated image builder blueprint example snippet name = "microshift_blueprint" description = "MicroShift 4.17.1 on x86_64 platform" version = "0.0.1" modules = [] groups = [] [[packages]] 1 name = "microshift" version = "4.17.1" ... ... [customizations.services] 2 enabled = ["microshift"] [customizations.firewall] ports = ["22:tcp", "80:tcp", "443:tcp", "5353:udp", "6443:tcp", "30000-32767:tcp", "30000-32767:udp"] ... ... [[containers]] 3 source = "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:f41e79c17e8b41f1b0a5a32c3e2dd7cd15b8274554d3f1ba12b2598a347475f4" [[containers]] source = "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:dbc65f1fba7d92b36cf7514cd130fe83a9bd211005ddb23a8dc479e0eea645fd" ... ... EOF 1 References for all non-optional MicroShift RPM packages using the same version compatible with the microshift-release-info RPM. 2 References for automatically enabling MicroShift on system startup and applying default networking settings. 3 References for all non-optional MicroShift container images necessary for an offline deployment. Add the blueprint to the image builder by running the following command: USD sudo composer-cli blueprints push <microshift_blueprint.toml> 1 1 Replace <microshift_blueprint.toml> with the name of your TOML file. Verification Verify the image builder configuration listing only MicroShift packages by running the following command: USD sudo composer-cli blueprints depsolve <microshift_blueprint> | grep microshift 1 1 Replace <microshift_blueprint> with the name of your blueprint. Example output blueprint: microshift_blueprint v0.0.1 microshift-greenboot-4.17.1-202305250827.p0.g4105d3b.assembly.4.17.1.el9.noarch microshift-networking-4.17.1-202305250827.p0.g4105d3b.assembly.4.17.1.el9.x86_64 microshift-release-info-4.17.1-202305250827.p0.g4105d3b.assembly.4.17.1.el9.noarch microshift-4.17.1-202305250827.p0.g4105d3b.assembly.4.17.1.el9.x86_64 microshift-selinux-4.17.1-202305250827.p0.g4105d3b.assembly.4.17.1.el9.noarch Optional: Verify the image builder configuration listing all components to be installed by running the following command: USD sudo composer-cli blueprints depsolve <microshift_blueprint> 1 1 Replace <microshift_blueprint> with the name of your blueprint. 1.5. Adding other packages to a blueprint Add the references for optional RPM packages to your ostree blueprint to enable them. Prerequisites You created an image builder blueprint file. Procedure Edit your ostree blueprint by running the following command: USD vi <microshift_blueprint.toml> 1 1 Replace <microshift_blueprint.toml> with the name of the blueprint file used for the MicroShift service. Add the following example text to your blueprint: [[packages]] 1 name = " <microshift-additional-package-name> " 2 version = "*" 1 Include one stanza for each additional service that you want to add. 2 Replace <microshift-additional-package-name> with the name the RPM for the service you want to include. For example, microshift-olm . steps Add custom certificate authorities to the blueprint as needed. After you are done adding to your blueprint, you can apply the manifests to an active cluster by building a new ostree system and deploying it on the client: Create the ISO. Add the blueprint and build the ISO. Download the ISO and prepare it for use. Do any provisioning that is needed. Additional resources Blueprint Reference Creating a RHEL for Edge Container blueprint using image builder CLI Building OSTree image Installing Podman 1.6. Adding a certificate authority bundle MicroShift uses the host trust bundle when clients evaluate server certificates. You can also use a customized security certificate chain to improve the compatibility of your endpoint certificates with clients specific to your deployments. To do this, you can add a certificate authority (CA) bundle with root and intermediate certificates to the Red Hat Enterprise Linux for Edge (RHEL for Edge) system-wide trust store. 1.6.1. Adding a certificate authority bundle to an rpm-ostree image You can include additional trusted certificate authorities (CAs) to the Red Hat Enterprise Linux for Edge (RHEL for Edge) rpm-ostree image by adding them to the blueprint that you use to create the image. Using the following procedure sets up additional CAs to be trusted by the operating system when pulling images from an image registry. Note This procedure requires you to configure the CA bundle customizations in the blueprint, and then add steps to your Kickstart file to enable the bundle. In the following steps, data is the key, and <value> represents the PEM-encoded certificate. Prerequisites You have root user access to your build host. Your build host meets the image builder system requirements. You have installed and set up image builder and the composer-cli tool. Procedure Add the following custom values to your blueprint to add a directory. Add instructions to your blueprint on the host where the image is built to create the directory, for example, /etc/pki/ca-trust/source/anchors/ for your certificate bundles. [[customizations.directories]] path = "/etc/pki/ca-trust/source/anchors" After the image has booted, create the certificate bundles, for example, /etc/pki/ca-trust/source/anchors/cert1.pem : [[customizations.files]] path = "/etc/pki/ca-trust/source/anchors/cert1.pem" data = "<value>" To enable the certificate bundle in the system-wide trust store configuration, use the update-ca-trust command on the host where the image you are using has booted, for example: USD sudo update-ca-trust Note The update-ca-trust command might be included in the %post section of a Kickstart file used for MicroShift host installation so that all the necessary certificate trust is enabled on the first boot. You must configure the CA bundle customizations in the blueprint before adding steps to your Kickstart file to enable the bundle. %post # Update certificate trust storage in case new certificates were # installed at /etc/pki/ca-trust/source/anchors directory update-ca-trust %end Additional resources Creating the RHEL for Edge image Using Shared System Certificates (RHEL 9) Supported image customizations (RHEL 9) Creating and managing OSTree image updates Applying updates on an OSTree system 1.7. Creating the RHEL for Edge image with image builder Use the following procedure to create the ISO. The RHEL for Edge Installer image pulls the commit from the running container and creates an installable boot ISO with a Kickstart file configured to use the embedded rpm-ostree commit. Prerequisites Your build host meets the image builder system requirements. You installed and set up image builder and the composer-cli tool. You root-user access to your build host. You installed the podman tool. Procedure Start an ostree container image build by running the following command: USD BUILDID=USD(sudo composer-cli compose start-ostree --ref "rhel/{op-system-version-major}/USD(uname -m)/edge" <microshift_blueprint> edge-container | awk '/^Compose/ {print USD2}') 1 1 Replace <microshift_blueprint> with the name of your blueprint. This command also returns the identification (ID) of the build for monitoring. You can check the status of the build periodically by running the following command: USD sudo composer-cli compose status Example output of a running build ID Status Time Blueprint Version Type Size cc3377ec-4643-4483-b0e7-6b0ad0ae6332 RUNNING Wed Jun 7 12:26:23 2023 microshift_blueprint 0.0.1 edge-container Example output of a completed build ID Status Time Blueprint Version Type Size cc3377ec-4643-4483-b0e7-6b0ad0ae6332 FINISHED Wed Jun 7 12:32:37 2023 microshift_blueprint 0.0.1 edge-container Note You can use the watch command to monitor your build if you are familiar with how to start and stop it. Download the container image using the ID and get the image ready for use by running the following command: USD sudo composer-cli compose image USD{BUILDID} Change the ownership of the downloaded container image to the current user by running the following command: USD sudo chown USD(whoami). USD{BUILDID}-container.tar Add read permissions for the current user to the image by running the following command: USD sudo chmod a+r USD{BUILDID}-container.tar Bootstrap a server on port 8085 for the ostree container image to be consumed by the ISO build by completing the following steps: Get the IMAGEID variable result by running the following command: USD IMAGEID=USD(cat < "./USD{BUILDID}-container.tar" | sudo podman load | grep -o -P '(?<=sha256[@:])[a-z0-9]*') Use the IMAGEID variable result to execute the podman command step by running the following command: USD sudo podman run -d --name=minimal-microshift-server -p 8085:8080 USD{IMAGEID} This command also returns the ID of the container saved in the IMAGEID variable for monitoring. Generate the installer blueprint file by running the following command: cat > microshift-installer.toml <<EOF name = "microshift-installer" description = "" version = "0.0.0" modules = [] groups = [] packages = [] EOF 1.8. Add the blueprint to image builder and build the ISO Add the blueprint to the image builder by running the following command: USD sudo composer-cli blueprints push microshift-installer.toml Start the ostree ISO build by running the following command: USD BUILDID=USD(sudo composer-cli compose start-ostree --url http://localhost:8085/repo/ --ref "rhel/9/USD(uname -m)/edge" microshift-installer edge-installer | awk '{print USD2}') This command also returns the identification (ID) of the build for monitoring. You can check the status of the build periodically by running the following command: USD sudo composer-cli compose status Example output for a running build ID Status Time Blueprint Version Type Size c793c24f-ca2c-4c79-b5b7-ba36f5078e8d RUNNING Wed Jun 7 13:22:20 2023 microshift-installer 0.0.0 edge-installer Example output for a completed build ID Status Time Blueprint Version Type Size c793c24f-ca2c-4c79-b5b7-ba36f5078e8d FINISHED Wed Jun 7 13:34:49 2023 microshift-installer 0.0.0 edge-installer 1.9. Download the ISO and prepare it for use Download the ISO using the ID by running the following command: USD sudo composer-cli compose image USD{BUILDID} Change the ownership of the downloaded container image to the current user by running the following command: USD sudo chown USD(whoami). USD{BUILDID}-installer.iso Add read permissions for the current user to the image by running the following command: USD sudo chmod a+r USD{BUILDID}-installer.iso steps Provision a virtual machine with a Kickstart file. 1.9.1. Embedding a Kickstart file in an ISO You can use the Kickstart file provided with MicroShift, or you can update an existing RHEL for Edge Installer (ISO) Kickstart file. When ready, embed the Kickstart file into the ISO. Your Kickstart file must include detailed instructions about how to create a user and how to fetch and deploy the RHEL for Edge image. Prerequisites You created a RHEL for Edge Installer (ISO) image containing your RHEL for Edge commit with MicroShift. You have an existing Kickstart file ready for updating. You can use the microshift-starter.ks Kickstart file provided with the MicroShift RPMs. Procedure In the main section of the Kickstart file, update the setup of the filesystem such that it contains an LVM volume group called rhel with at least 10GB system root. Leave free space for the LVMS CSI driver to use for storing the data for your workloads. Example Kickstart file snippet for configuring the filesystem # Partition disk such that it contains an LVM volume group called `rhel` with a # 10GB+ system root but leaving free space for the LVMS CSI driver for storing data. # # For example, a 20GB disk would be partitioned in the following way: # # NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT # sda 8:0 0 20G 0 disk # ├─sda1 8:1 0 200M 0 part /boot/efi # ├─sda1 8:1 0 800M 0 part /boot # └─sda2 8:2 0 19G 0 part # └─rhel-root 253:0 0 10G 0 lvm /sysroot # ostreesetup --nogpg --osname=rhel --remote=edge \ --url=file:///run/install/repo/ostree/repo --ref=rhel/<RHEL VERSION NUMBER>/x86_64/edge zerombr clearpart --all --initlabel part /boot/efi --fstype=efi --size=200 part /boot --fstype=xfs --asprimary --size=800 # Uncomment this line to add a SWAP partition of the recommended size #part swap --fstype=swap --recommended part pv.01 --grow volgroup rhel pv.01 logvol / --vgname=rhel --fstype=xfs --size=10000 --name=root # To add users, use a line such as the following user --name=<YOUR_USER_NAME> \ --password=<YOUR_HASHED_PASSWORD> \ --iscrypted --groups=<YOUR_USER_GROUPS> In the %post section of the Kickstart file, add your pull secret and the mandatory firewall rules. Example Kickstart file snippet for adding the pull secret and firewall rules %post --log=/var/log/anaconda/post-install.log --erroronfail # Add the pull secret to CRI-O and set root user-only read/write permissions cat > /etc/crio/openshift-pull-secret << EOF YOUR_OPENSHIFT_PULL_SECRET_HERE EOF chmod 600 /etc/crio/openshift-pull-secret # Configure the firewall with the mandatory rules for MicroShift firewall-offline-cmd --zone=trusted --add-source=10.42.0.0/16 firewall-offline-cmd --zone=trusted --add-source=169.254.169.1 %end Install the mkksiso tool by running the following command: USD sudo yum install -y lorax Update the ISO with your new Kickstart file by running the following command: USD sudo mkksiso <your_kickstart>.ks <your_installer>.iso <updated_installer>.iso Additional resources Composing, installing, and managing RHEL for Edge images System requirements for installing MicroShift Red Hat Hybrid Cloud Console pull secret Required firewall settings Creating Kickstart files A.1. Kickstart file format How to embed a Kickstart file into an ISO image 1.10. How to access the MicroShift cluster Use the procedures in this section to access the MicroShift cluster by using the OpenShift CLI ( oc ). You can access the cluster from either the same machine running the MicroShift service or from a remote location. You can use this access to observe and administrate workloads. When using the following steps, choose the kubeconfig file that contains the host name or IP address you want to connect to and place it in the relevant directory. 1.10.1. Accessing the MicroShift cluster locally Use the following procedure to access the MicroShift cluster locally by using a kubeconfig file. Prerequisites You have installed the oc binary. Procedure Optional: to create a ~/.kube/ folder if your Red Hat Enterprise Linux (RHEL) machine does not have one, run the following command: USD mkdir -p ~/.kube/ Copy the generated local access kubeconfig file to the ~/.kube/ directory by running the following command: USD sudo cat /var/lib/microshift/resources/kubeadmin/kubeconfig > ~/.kube/config Update the permissions on your ~/.kube/config file by running the following command: USD chmod go-r ~/.kube/config Verification Verify that MicroShift is running by entering the following command: USD oc get all -A 1.10.2. Opening the firewall for remote access to the MicroShift cluster Use the following procedure to open the firewall so that a remote user can access the MicroShift cluster. This procedure must be completed before a workstation user can access the cluster remotely. For this procedure, user@microshift is the user on the MicroShift host machine and is responsible for setting up that machine so that it can be accessed by a remote user on a separate workstation. Prerequisites You have installed the oc binary. Your account has cluster administration privileges. Procedure As user@microshift on the MicroShift host, open the firewall port for the Kubernetes API server ( 6443/tcp ) by running the following command: [user@microshift]USD sudo firewall-cmd --permanent --zone=public --add-port=6443/tcp && sudo firewall-cmd --reload Verification As user@microshift , verify that MicroShift is running by entering the following command: [user@microshift]USD oc get all -A 1.10.3. Accessing the MicroShift cluster remotely Use the following procedure to access the MicroShift cluster from a remote location by using a kubeconfig file. The user@workstation login is used to access the host machine remotely. The <user> value in the procedure is the name of the user that user@workstation logs in with to the MicroShift host. Prerequisites You have installed the oc binary. The user@microshift has opened the firewall from the local host. Procedure As user@workstation , create a ~/.kube/ folder if your Red Hat Enterprise Linux (RHEL) machine does not have one by running the following command: [user@workstation]USD mkdir -p ~/.kube/ As user@workstation , set a variable for the hostname of your MicroShift host by running the following command: [user@workstation]USD MICROSHIFT_MACHINE=<name or IP address of MicroShift machine> As user@workstation , copy the generated kubeconfig file that contains the host name or IP address you want to connect with from the RHEL machine running MicroShift to your local machine by running the following command: [user@workstation]USD ssh <user>@USDMICROSHIFT_MACHINE "sudo cat /var/lib/microshift/resources/kubeadmin/USDMICROSHIFT_MACHINE/kubeconfig" > ~/.kube/config Note To generate the kubeconfig files for this step, see Generating additional kubeconfig files for remote access . As user@workstation , update the permissions on your ~/.kube/config file by running the following command: USD chmod go-r ~/.kube/config Verification As user@workstation , verify that MicroShift is running by entering the following command: [user@workstation]USD oc get all -A Additional resources Generating additional kubeconfig files for remote access

Commands:
sudo mkdir -p /etc/osbuild-composer/repositories
sudo cp /usr/share/osbuild-composer/repositories/rhel-9.4.json /etc/osbuild-composer/repositories/rhel-9.4.json
"baseurl": "https://cdn.redhat.com/content/eus/rhel<9>/<9.4>//baseos/os", 1
sudo sed -i "s,dist/rhel<9>/<9.4>/USD(uname -m)/baseos/,eus/rhel<9>/<9.4>/USD(uname -m)/baseos/,g" /etc/osbuild-composer/repositories/rhel-<9.4>.json 1
"baseurl": "https://cdn.redhat.com/content/eus/rhel<9>/<9.4>//appstream/os", 1
sudo sed -i "s,dist/rhel<9>/<9.4>/USD(uname -m)/appstream/,eus/rhel<9>/<9.4>/USD(uname -m)/appstream/,g" /etc/osbuild-composer/repositories/rhel-<9.4>.json 1
sudo composer-cli sources info baseos | grep 'url ='
url = "https://cdn.redhat.com/content/eus/rhel9/9.4/x86_64/baseos/os"
sudo composer-cli sources info appstream | grep 'url ='
url = "https://cdn.redhat.com/content/eus/rhel9/9.4/x86_64/appstream/os"
cat > rhocp-4.18.toml <<EOF id = "rhocp-4.18" name = "Red Hat OpenShift Container Platform 4.18 for RHEL 9" type = "yum-baseurl" url = "https://cdn.redhat.com/content/dist/layered/rhel9/USD(uname -m)/rhocp/4.18/os" check_gpg = true check_ssl = true system = false rhsm = true EOF
cat > fast-datapath.toml <<EOF id = "fast-datapath" name = "Fast Datapath for RHEL 9" type = "yum-baseurl" url = "https://cdn.redhat.com/content/dist/layered/rhel9/USD(uname -m)/fast-datapath/os" check_gpg = true check_ssl = true system = false rhsm = true EOF
sudo composer-cli sources add rhocp-4.18.toml
sudo composer-cli sources add fast-datapath.toml
sudo composer-cli sources list
appstream baseos fast-datapath rhocp-4.18
cat > <microshift_blueprint.toml> <<EOF 1 name = " <microshift_blueprint> " 2 description = "" version = "0.0.1" modules = [] groups = [] [[packages]] name = "microshift" version = "4.18.1" 3 [customizations.services] enabled = ["microshift"] EOF
name = "microshift_blueprint" description = "MicroShift 4.17.1 on x86_64 platform" version = "0.0.1" modules = [] groups = [] [[packages]] 1 name = "microshift" version = "4.17.1" [customizations.services] 2 enabled = ["microshift"] [customizations.firewall] ports = ["22:tcp", "80:tcp", "443:tcp", "5353:udp", "6443:tcp", "30000-32767:tcp", "30000-32767:udp"] [[containers]] 3 source = "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:f41e79c17e8b41f1b0a5a32c3e2dd7cd15b8274554d3f1ba12b2598a347475f4" [[containers]] source = "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:dbc65f1fba7d92b36cf7514cd130fe83a9bd211005ddb23a8dc479e0eea645fd" ... EOF
sudo composer-cli blueprints push <microshift_blueprint.toml> 1
sudo composer-cli blueprints depsolve <microshift_blueprint> | grep microshift 1
blueprint: microshift_blueprint v0.0.1 microshift-greenboot-4.17.1-202305250827.p0.g4105d3b.assembly.4.17.1.el9.noarch microshift-networking-4.17.1-202305250827.p0.g4105d3b.assembly.4.17.1.el9.x86_64 microshift-release-info-4.17.1-202305250827.p0.g4105d3b.assembly.4.17.1.el9.noarch microshift-4.17.1-202305250827.p0.g4105d3b.assembly.4.17.1.el9.x86_64 microshift-selinux-4.17.1-202305250827.p0.g4105d3b.assembly.4.17.1.el9.noarch
sudo composer-cli blueprints depsolve <microshift_blueprint> 1
vi <microshift_blueprint.toml> 1
[[packages]] 1 name = " <microshift-additional-package-name> " 2 version = "*"
[[customizations.directories]] path = "/etc/pki/ca-trust/source/anchors"
[[customizations.files]] path = "/etc/pki/ca-trust/source/anchors/cert1.pem" data = "<value>"
sudo update-ca-trust
%post Update certificate trust storage in case new certificates were installed at /etc/pki/ca-trust/source/anchors directory update-ca-trust %end
BUILDID=USD(sudo composer-cli compose start-ostree --ref "rhel/{op-system-version-major}/USD(uname -m)/edge" <microshift_blueprint> edge-container | awk '/^Compose/ {print USD2}') 1
sudo composer-cli compose status
ID Status Time Blueprint Version Type Size cc3377ec-4643-4483-b0e7-6b0ad0ae6332 RUNNING Wed Jun 7 12:26:23 2023 microshift_blueprint 0.0.1 edge-container
ID Status Time Blueprint Version Type Size cc3377ec-4643-4483-b0e7-6b0ad0ae6332 FINISHED Wed Jun 7 12:32:37 2023 microshift_blueprint 0.0.1 edge-container
sudo composer-cli compose image USD{BUILDID}
sudo chown USD(whoami). USD{BUILDID}-container.tar
sudo chmod a+r USD{BUILDID}-container.tar
IMAGEID=USD(cat < "./USD{BUILDID}-container.tar" | sudo podman load | grep -o -P '(?<=sha256[@:])[a-z0-9]*')
sudo podman run -d --name=minimal-microshift-server -p 8085:8080 USD{IMAGEID}
cat > microshift-installer.toml <<EOF name = "microshift-installer" description = "" version = "0.0.0" modules = [] groups = [] packages = [] EOF
sudo composer-cli blueprints push microshift-installer.toml
BUILDID=USD(sudo composer-cli compose start-ostree --url http://localhost:8085/repo/ --ref "rhel/9/USD(uname -m)/edge" microshift-installer edge-installer | awk '{print USD2}')
sudo composer-cli compose status
ID Status Time Blueprint Version Type Size c793c24f-ca2c-4c79-b5b7-ba36f5078e8d RUNNING Wed Jun 7 13:22:20 2023 microshift-installer 0.0.0 edge-installer
ID Status Time Blueprint Version Type Size c793c24f-ca2c-4c79-b5b7-ba36f5078e8d FINISHED Wed Jun 7 13:34:49 2023 microshift-installer 0.0.0 edge-installer
sudo composer-cli compose image USD{BUILDID}
sudo chown USD(whoami). USD{BUILDID}-installer.iso
sudo chmod a+r USD{BUILDID}-installer.iso
Partition disk such that it contains an LVM volume group called `rhel` with a 10GB+ system root but leaving free space for the LVMS CSI driver for storing data. # For example, a 20GB disk would be partitioned in the following way: # NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT sda 8:0 0 20G 0 disk ├─sda1 8:1 0 200M 0 part /boot/efi ├─sda1 8:1 0 800M 0 part /boot └─sda2 8:2 0 19G 0 part └─rhel-root 253:0 0 10G 0 lvm /sysroot # ostreesetup --nogpg --osname=rhel --remote=edge --url=file:///run/install/repo/ostree/repo --ref=rhel/<RHEL VERSION NUMBER>/x86_64/edge zerombr clearpart --all --initlabel part /boot/efi --fstype=efi --size=200 part /boot --fstype=xfs --asprimary --size=800 Uncomment this line to add a SWAP partition of the recommended size #part swap --fstype=swap --recommended part pv.01 --grow volgroup rhel pv.01 logvol / --vgname=rhel --fstype=xfs --size=10000 --name=root To add users, use a line such as the following user --name=<YOUR_USER_NAME> --password=<YOUR_HASHED_PASSWORD> --iscrypted --groups=<YOUR_USER_GROUPS>
%post --log=/var/log/anaconda/post-install.log --erroronfail Add the pull secret to CRI-O and set root user-only read/write permissions cat > /etc/crio/openshift-pull-secret << EOF YOUR_OPENSHIFT_PULL_SECRET_HERE EOF chmod 600 /etc/crio/openshift-pull-secret Configure the firewall with the mandatory rules for MicroShift firewall-offline-cmd --zone=trusted --add-source=10.42.0.0/16 firewall-offline-cmd --zone=trusted --add-source=169.254.169.1 %end
sudo yum install -y lorax
sudo mkksiso <your_kickstart>.ks <your_installer>.iso <updated_installer>.iso
mkdir -p ~/.kube/
sudo cat /var/lib/microshift/resources/kubeadmin/kubeconfig > ~/.kube/config
chmod go-r ~/.kube/config
oc get all -A
[user@microshift]USD sudo firewall-cmd --permanent --zone=public --add-port=6443/tcp && sudo firewall-cmd --reload
[user@microshift]USD oc get all -A
[user@workstation]USD mkdir -p ~/.kube/
[user@workstation]USD MICROSHIFT_MACHINE=<name or IP address of MicroShift machine>
[user@workstation]USD ssh <user>@USDMICROSHIFT_MACHINE "sudo cat /var/lib/microshift/resources/kubeadmin/USDMICROSHIFT_MACHINE/kubeconfig" > ~/.kube/config
chmod go-r ~/.kube/config
[user@workstation]USD oc get all -A