Chapter 6. Building simplified installer images to provision a RHEL for Edge image You can build a RHEL for Edge Simplified Installer image, which is optimized for unattended installation to a device, and provision the image to a RHEL for Edge image. 6.1. Simplified installer image build and deployment The RHEL for Edge Simplified Installer image is optimized for unattended installation to a device and supports both network-based deployment and non-network-based deployments. However, for network-based deployment, it supports only UEFI HTTP boot. Build a RHEL for Edge Simplified Installer image by using the edge-simplified-installer image type. To build a RHEL for Edge Simplified Installer image, provide an existing OSTree commit. The resulting RHEL for Edge Simplified Installer contains a raw image that has a deployed OSTree commit. After you boot the Simplified installer ISO image, it provisions a RHEL for Edge system that you can use on a hard disk or as a boot image in a virtual machine. You can log in to the deployed system with the user name and password that you specified in the blueprint that you used to create the Simplified Installer image. Composing and deploying a simplified RHEL for Edge image involves the following high-level steps: Install and register a RHEL system Install RHEL image builder Using RHEL image builder, create a blueprint with customizations for RHEL for Edge Container image Import the RHEL for Edge blueprint in RHEL image builder Create a RHEL for Edge image embed in an OCI container with a web server ready to deploy the commit as an OSTree repository Create a blueprint for the edge-simplified-installer image Build a simplified RHEL for Edge image Download the RHEL for Edge simplified image Install the raw image with the edge-simplified-installer virt-install The following diagram represents the RHEL for Edge Simplified building and provisioning workflow: Figure 6.1. Building and provisioning RHEL for Edge in network-based environment 6.2. Creating RHEL for Edge Simplified Installer images by using the CLI 6.2.1. Setting up an UEFI HTTP Boot server Set up an UEFI HTTP Boot server so that you can start to provision a RHEL for Edge Virtual Machine over the network by connecting to this UEFI HTTP Boot server. Prerequisites You have created the ISO simplified installer image. An http server that serves the ISO content. Procedure Mount the ISO image to the directory of your choice: Replace /path_directory/installer.iso with the path to the RHEL for Edge bootable ISO image. Copy the files from the mounted image to the HTTP server root. This command creates the /var/www/html/rhel9-install/ directory with the contents of the image. Note Some copying methods can skip the .treeinfo file which is required for a valid installation source. Running the cp command for whole directories as shown in this procedure will copy .treeinfo correctly. Update the /var/www/html/EFI/BOOT/grub.cfg file, by replacing: coreos.inst.install_dev=/dev/sda with coreos.inst.install_dev=/dev/vda linux /images/pxeboot/vmlinuz with linuxefi /images/pxeboot/vmlinuz initrd /images/pxeboot/initrd.img with initrdefi /images/pxeboot/initrd.img coreos.inst.image_file=/run/media/iso/disk.img.xz with coreos.inst.image_url=http://{IP-ADDRESS}/disk.img.xz The IP-ADDRESS is the IP address of this machine, which will serve as a http boot server. Start the httpd service: As a result, after you set up an UEFI HTTP Boot server, you can install your RHEL for Edge devices by using UEFI HTTP boot. 6.2.2. Creating a blueprint for a Simplified image using RHEL image builder CLI To create a blueprint for a simplified RHEL for Edge image, you must add the following customizations to the blueprint: Customize the blueprint with the installation_device customization. Add a device file location to the blueprint to enable an unattended installation to the device. Add a URL to perform the initial device credential exchange. Customize the blueprint with the customizations.user and add with users and user groups to it. Procedure Create a plain text file in the Tom's Obvious, Minimal Language (TOML) format, with the following content: Note The FDO customization in the blueprints is optional, and you can build your RHEL for Edge Simplified Installer image with no errors. name is the name and description is the description for your blueprint. 0.0.1 is the version number according to the Semantic Versioning scheme. Modules describe the package name and matching version glob to be installed into the image, for example, the package name = "tmux" and the matching version glob is version = "2.9a". Notice that currently there are no differences between packages and modules. Groups are packages groups to be installed into the image, for example the anaconda-tools group package. If you do not know the modules and groups, leave them empty. installation-device is the customization to enable an unattended installation to your device. manufacturing_server_url is the URL to perform the initial device credential exchange. name is the user name to login to the image. password is a password of your choice. groups are any user groups, such as "widget". Push (import) the blueprint to the RHEL image builder server: Check whether the created blueprint is successfully pushed and exists. Check whether the components and versions listed in the blueprint and their dependencies are valid: Additional resources Composing a RHEL for Edge image using RHEL image builder command-line 6.2.3. Creating a RHEL for Edge Simplified Installer image by using image builder CLI Create a RHEL for Edge Simplified image by using RHEL image builder command-line interface. Prerequisites You created a blueprint for the RHEL for Edge Simplified image. You served an OSTree repository of the commit to embed in the image. For example, http://10.0.2.2:8080/repo. See ref:setting-up-a-web-server-to-install-rhel-for-edge-image_installing-rpm-ostree-images[Setting up a web server to install RHEL for Edge image]. Procedure Create the bootable ISO image. Where, blueprint-name is the RHEL for Edge blueprint name. edge-simplified-installer is the image type . --ref is the reference for where your commit is going to be created. --url is the URL to the OSTree repository of the commit to embed in the image. For example, http://10.0.2.2:8080/repo/. You can either start a RHEL for Edge Container or set up a web server. See Creating a RHEL for Edge Container image for non-network-based deployments and Setting up a web server to install RHEL for Edge image . A confirmation that the composer process has been added to the queue appears. It also shows a Universally Unique Identifier (UUID) number for the image created. Use the UUID number to track your build. Also keep the UUID number handy for further tasks. Check the image compose status. The output displays the status in the following format: Note The image creation processes can take up to ten minutes to complete. To interrupt the image creation process, run: To delete an existing image, run: Additional resources Composing a RHEL for Edge image using RHEL image builder command-line 6.3. Downloading a simplified RHEL for Edge image using the image builder command-line interface To download a RHEL for Edge image by using RHEL image builder command-line interface, ensure that you have met the following prerequisites and then follow the procedure. Prerequisites You have created a RHEL for Edge image. Procedure Review the RHEL for Edge image status. The output must display the following: Download the image. RHEL image builder downloads the image as an .iso file at the current directory path where you run the command. The UUID number and the image size is displayed alongside. As a result, you downloaded a RHEL for Edge Simplified Installer ISO image. You can use it directly as a boot ISO to install a RHEL for Edge system. 6.4. Creating RHEL for Edge Simplified Installer images by using the GUI 6.4.1. Creating a blueprint for a Simplified image RHEL using image builder GUI To create a RHEL for Edge Simplified Installer image, you must create a blueprint and ensure that you customize it with: A device node location to enable an unattended installation to your device. A URL to perform the initial device credential exchange. A user or user group. Note You can also add any other customizations that your image requires. To create a blueprint for a simplified RHEL for Edge image in the RHEL image builder GUI, complete the following steps: Prerequisites You have opened the image builder app from the web console in a browser. See Accessing the RHEL image builder GUI in the RHEL web console . Procedure Click Create Blueprint in the upper-right corner of the RHEL image builder app. A dialog wizard with fields for the blueprint name and description opens. On the Details page: Enter the name of the blueprint and, optionally, its description. Click . Optional: On the Packages page, complete the following steps: In the Available packages search, enter the package name and click the > button to move it to the Chosen packages field. Search and include as many packages as you want. Click . Note The customizations are all optional unless otherwise specified. Optional: On the Kernel page, enter a kernel name and the command-line arguments. Optional: On the File system page, select Use automatic partitioning .The filesystem customization is not supported for OSTree systems, because OSTree images have their own mount rule, such as read-only. Click . Optional: On the Services page, you can enable or disable services: Enter the service names you want to enable or disable, separating them by a comma, by space, or by pressing the Enter key. Click . Optional: On the Firewall page, set up your firewall setting: Enter the Ports , and the firewall services you want to enable or disable. Click the Add zone button to manage your firewall rules for each zone independently. Click . On the Users page, add a users by following the steps: Click Add user . Enter a Username , a password , and a SSH key . You can also mark the user as a privileged user, by clicking the Server administrator checkbox. Note When you specify the user in the blueprint customization and then create an image from that blueprint, the blueprint creates the user under the /usr/lib/passwd directory and the password under the /usr/etc/shadow during installation time. You can log in to the device with the username and password you created for the blueprint. After you access the system, you must create users, for example, using the useradd command. Click . Optional: On the Groups page, add groups by completing the following steps: Click the Add groups button: Enter a Group name and a Group ID . You can add more groups. Click . Optional: On the SSH keys page, add a key: Click the Add key button. Enter the SSH key. Enter a User . Click . Optional: On the Timezone page, set your timezone settings: On the Timezone field, enter the timezone you want to add to your system image. For example, add the following timezone format: "US/Eastern". If you do not set a timezone, the system uses Universal Time, Coordinated (UTC) as default. Enter the NTP servers. Click . Optional: On the Locale page, complete the following steps: On the Keyboard search field, enter the package name you want to add to your system image. For example: ["en_US.UTF-8"]. On the Languages search field, enter the package name you want to add to your system image. For example: "us". Click . Mandatory: On the Others page, complete the following steps: In the Hostname field, enter the hostname you want to add to your system image. If you do not add a hostname, the operating system determines the hostname. Mandatory: In the Installation Devices field, enter a valid node for your system image to enable an unattended installation to your device. For example: dev/sda1 . Click . Optional: On the FIDO device onboarding page, complete the following steps: On the Manufacturing server URL field, enter the manufacturing server URL to perform the initial device credential exchange, for example: "http://10.0.0.2:8080". The FDO customization in the blueprints is optional, and you can build your RHEL for Edge Simplified Installer image with no errors. On the DIUN public key insecure field, enter the certification public key hash to perform the initial device credential exchange. This field accepts "true" as value, which means this is an insecure connection to the manufacturing server. For example: manufacturing_server_url="http://USD{FDO_SERVER}:8080" diun_pub_key_insecure="true" . You must use only one of these three options: "key insecure", "key hash" and "key root certs". On the DIUN public key hash field, enter the hashed version of your public key. For example: 17BD05952222C421D6F1BB1256E0C925310CED4CE1C4FFD6E5CB968F4B73BF73 . You can get the key hash by generating it based on the certificate of the manufacturing server. To generate the key hash, run the command: The /etc/fdo/aio/keys/diun_cert.pem is the certificate that is stored in the manufacturing server. On the DIUN public key root certs field, enter the public key root certs. This field accepts the content of the certification file that is stored in the manufacturing server. To get the content of certificate file, run the command: Click . On the Review page, review the details about the blueprint. Click Create . The RHEL image builder view opens, listing existing blueprints. 6.4.2. Creating a RHEL for Edge Simplified Installer image using image builder GUI To create a RHEL for Edge Simplified image by using RHEL image builder GUI, ensure that you have met the following prerequisites and then follow the procedure. Prerequisites You opened the RHEL image builder app from the web console in a browser. You created a blueprint for the RHEL for Edge Simplified image. You served an OSTree repository of the commit to embed in the image, for example, http://10.0.2.2:8080/repo . See Setting up a web server to install RHEL for Edge image . The FDO manufacturing server is up and running. Procedure Access mage builder dashboard. On the blueprint table, find the blueprint you want to build an image for. Navigate to the Images tab and click Create Image . The Create image wizard opens. On the Image output page, complete the following steps: From the Select a blueprint list, select the blueprint you created for the RHEL for Edge Simplified image. From the Image output type list, select RHEL for Edge Simplified Installer (.iso) . In the Image Size field, enter the image size. Minimum image size required for Simplified Installer image is: Click . In the OSTree settings page, complete the following steps: In the Repository URL field, enter the repository URL to where the parent OSTree commit will be pulled from. In the Ref field, enter the ref branch name path. If you do not enter a ref , the default ref for the distro is used. On the Review page, review the image customization and click Create . The image build starts and takes up to 20 minutes to complete. To stop the building, click Stop build . 6.4.3. Downloading a simplified RHEL for Edge image using the image builder GUI To download a RHEL for Edge image by using RHEL image builder GUI, ensure that you have met the following prerequisites and then follow the procedure. Prerequisites You have successfully created a RHEL for Edge image. See link. Procedure Access the RHEL image builder dashboard. The blueprint list dashboard opens. In the blueprint table, find the blueprint you built your RHEL for Edge Simplified Installer image for. Navigate to the Images tab. Choose one of the options: Download the image. Download the logs of the image to inspect the elements and verify if any issue is found. Note You can use the RHEL for Edge Simplified Installer ISO image that you downloaded directly as a boot ISO to install a RHEL for Edge system. 6.5. Provisioning the RHEL for Edge Simplified Installer image 6.5.1. Deploying the Simplified ISO image in a Virtual Machine Deploy the RHEL for Edge ISO image you generated by creating a RHEL for Edge Simplified image by using any the following installation sources: UEFI HTTP Boot virt-install This example shows how to create a virt-install installation source from your ISO image for a network-based installation . Prerequisites You have created an ISO image. You set up a network configuration to support UEFI HTTP boot. Procedure Set up a network configuration to support UEFI HTTP boot. See Setting up UEFI HTTP boot with libvirt . Use the virt-install command to create a RHEL for Edge Virtual Machine from the UEFI HTTP Boot. After you run the command, the Virtual Machine installation starts. Verification Log in to the created Virtual Machine. 6.5.2. Deploying the Simplified ISO image from a USB flash drive Deploy the RHEL for Edge ISO image you generated by creating a RHEL for Edge Simplified image by using an USB installation . This example shows how to create a USB installation source from your ISO image. Prerequisites You have created a simplified installer image, which is an ISO image. You have a 8 GB USB flash drive. Procedure Copy the ISO image file to a USB flash drive. Connect the USB flash drive to the port of the computer you want to boot. Boot the ISO image from the USB flash drive.The boot menu shows you the following options: Choose Install Red Hat Enterprise Linux 9. This starts the system installation. Additional resources Booting the installation 6.6. Creating and booting a RHEL for Edge image in FIPS mode You can create and boot a FIPS-enabled RHEL for Edge image. Before you compose the image, you must change the value of the fips directive in your blueprint. You can build the following image types in FIPS mode: edge-installer edge-simplified-installer edge-raw-image edge-ami edge-vsphere Important You can enable FIPS mode only during the image provisioning process. You cannot change to FIPS mode after the non-FIPS image build starts. If the host that builds the FIPS-enabled image is not FIPS-enabled, any keys generated by this host are not FIPS-compliant, but the resulting image is FIPS-compliant. Prerequisites You created and downloaded a RHEL for Edge Container OSTree commit. You have installed Podman on your system. See the Red Hat Knowledgebase solution How to install Podman in RHEL . You are logged in as the root user or a user who is a member of the weldr group. Procedure Create a plain text file in the Tom's Obvious, Minimal Language (TOML) format with the following content: Import the blueprint to the RHEL image builder server: List the existing blueprints to check whether the created blueprint is successfully imported and exists: Check whether the components and versions listed in the blueprint and their dependencies are valid: Serve an OSTree repository of the commit to embed in the image, for example, http://10.0.2.2:8080/repo . For more information, see Setting up an UEFI HTTP Boot server . Create the bootable ISO image: Review the RHEL for Edge image status: Download the image: RHEL image builder downloads the image as an .iso file to the current directory path. The UUID number and the image size are displayed alongside: Create a RHEL for Edge virtual machine from the UEFI HTTP Boot server, for example: After you enter the command, the virtual machine installation starts. Verification Log in to the created virtual machine with the username and password that you configured in your blueprint. Check if FIPS mode is enabled:

Commands:
mkdir /mnt/rhel9-install/ mount -o loop,ro -t iso9660 /path_directory/installer.iso /mnt/rhel9-install/
mkdir /var/www/html/httpboot/ cp -R /mnt/rhel9-install/* /var/www/html/httpboot/ chmod -R +r /var/www/html/httpboot/*
systemctl start httpd.service
name = "simplified-installer-blueprint" description = "blueprint for the simplified installer image" version = "0.0.1" packages = [] modules = [] groups = [] distro = "" [customizations] installation_device = "/dev/vda" [[customizations.user]] name = "admin" password = "admin" groups = ["users", "wheel"] [customizations.fdo] manufacturing_server_url = "http://10.0.0.2:8080" diun_pub_key_insecure = "true"
composer-cli blueprints push blueprint-name.toml
composer-cli blueprints show blueprint-name
composer-cli blueprints depsolve blueprint-name
composer-cli compose start-ostree blueprint-name edge-simplified-installer --ref rhel/9/x86_64/edge --url URL-OSTree-repository \
composer-cli compose status
<UUID> RUNNING date blueprint-name blueprint-version image-type
composer-cli compose cancel <UUID>
composer-cli compose delete <UUID>
composer-cli compose status
<UUID> FINISHED date blueprint-name blueprint-version image-type
composer-cli compose image <UUID>
<UUID> -simplified-installer.iso: size MB
openssl x509 -fingerprint -sha256 -noout -in /etc/fdo/aio/keys/diun_cert.pem | cut -d"=" -f2 | sed 's/://g'
cat /etc/fdo/aio/keys/diun_cert.pem.
virt-install --name edge-install-image --disk path=" ", ,format=qcow2 --ram 3072 --memory 4096 --vcpus 2 --network network=integration,mac=mac_address --os-type linux --os-variant rhel9 --cdrom "/var/lib/libvirt/images/"ISO_FILENAME" --boot uefi,loader_ro=yes,loader_type=pflash,nvram_template=/usr/share/edk2/ovmf/OVMF_VARS.fd,loader_secure=no --virt-type kvm --graphics none --wait=-1 --noreboot
Install Red Hat Enterprise Linux 9 Test this media & install Red Hat Enterprise Linux 9
name = "system-fips-mode-enabled" description = "blueprint with FIPS enabled " version = "0.0.1" [ostree] ref= "example/edge" url= "http://example.com/repo" [customizations] installation_device = "/dev/vda" fips = true [[customizations.user]] name = "admin" password = "admin" groups = ["users", "wheel"] [customizations.fdo] manufacturing_server_url = "https://fdo.example.com" diun_pub_key_insecure = true
composer-cli blueprints push <blueprint-name> .toml
composer-cli blueprints show <blueprint-name>
composer-cli blueprints depsolve <blueprint-name>
composer-cli compose start-ostree \ <blueprint-name> \ edge-simplified-installer \ --ref rhel/8/x86_64/edge \ --url <URL-OSTree-repository> \
composer-cli compose status ... <UUID> FINISHED <date> <blueprint-name> <blueprint-version> <image-type> ...
composer-cli compose image <UUID>
<UUID> -simplified-installer.iso: <size> MB
virt-install \ --name edge-device --disk path="/var/lib/libvirt/images/edge-device.qcow2",size=5,format=qcow2 \ --memory 4096 \ --vcpus 2 \ --network network=default \ --os-type linux \ --os-variant rhel8.9 \ --cdrom /var/lib/libvirt/images/ <UUID> -simplified-installer.iso \ --boot uefi,loader.secure=false \ --virt-type kvm \ --graphics none \ --wait=-1 \ --noreboot
fips-mode-setup --check FIPS mode is enabled.