Chapter 4. Embedding in a RHEL for Edge image

Procedure

1. Create an Image Builder configuration file for adding the rhocp-4.16 RPM repository source required to pull MicroShift RPMs by running the following command:

   cat > rhocp-4.16.toml <<EOF
   id = "rhocp-4.16"
   name = "Red Hat OpenShift Container Platform 4.16 for RHEL 9"
   type = "yum-baseurl"
   url = "https://cdn.redhat.com/content/dist/layered/rhel9/$(uname -m)/rhocp/4.16/os"
   check_gpg = true
   check_ssl = true
   system = false
   rhsm = true
   EOF

2. Create an Image Builder configuration file for adding the fast-datapath RPM repository by running the following command:

   cat > fast-datapath.toml <<EOF
   id = "fast-datapath"
   name = "Fast Datapath for RHEL 9"
   type = "yum-baseurl"
   url = "https://cdn.redhat.com/content/dist/layered/rhel9/$(uname -m)/fast-datapath/os"
   check_gpg = true
   check_ssl = true
   system = false
   rhsm = true
   EOF

3. Add the sources to the Image Builder by running the following commands:

   $ sudo composer-cli sources add rhocp-4.16.toml

   $ sudo composer-cli sources add fast-datapath.toml

Procedure

1. Use the following example to create your own blueprint file:

   Custom Image Builder blueprint example

   cat > <microshift_blueprint.toml> <<EOF 1
   name = "<microshift_blueprint>" 2
   
   description = ""
   version = "0.0.1"
   modules = []
   groups = []
   
   [[packages]]
   name = "microshift"
   version = "*"
   
   [customizations.services]
   enabled = ["microshift"]
   EOF

   1

   <microshift_blueprint.toml> is the name of the TOML file.

   2

   <microshift_blueprint> is the name of your blueprint.

   Note

   The wildcard * in the commands uses the latest MicroShift RPMs. If you need a specific version, substitute the wildcard for the version you want. For example, insert 4.16.0 to download the MicroShift 4.16.0 RPMs.

2. Optional. Use the blueprint installed in the /usr/share/microshift/blueprint directory that is specific to your platform architecture. See the following example snippet for an explanation of the blueprint sections:

   Generated Image Builder blueprint example snippet

   name = "microshift_blueprint"
   description = "MicroShift 4.16.1 on x86_64 platform"
   version = "0.0.1"
   modules = []
   groups = []
   
   [[packages]] 1
   name = "microshift"
   version = "4.16.1"
   ...
   ...
   
   [customizations.services] 2
   enabled = ["microshift"]
   
   [customizations.firewall]
   ports = ["22:tcp", "80:tcp", "443:tcp", "5353:udp", "6443:tcp", "30000-32767:tcp", "30000-32767:udp"]
   ...
   ...
   
   [[containers]] 3
   source = "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:f41e79c17e8b41f1b0a5a32c3e2dd7cd15b8274554d3f1ba12b2598a347475f4"
   
   [[containers]]
   source = "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:dbc65f1fba7d92b36cf7514cd130fe83a9bd211005ddb23a8dc479e0eea645fd"
   ...
   …
   EOF

   1

   References for all non-optional MicroShift RPM packages using the same version compatible with the microshift-release-info RPM.

   2

   References for automatically enabling MicroShift on system startup and applying default networking settings.

   3

   References for all non-optional MicroShift container images necessary for an offline deployment.

3. Add the blueprint to the Image Builder by running the following command:

   $ sudo composer-cli blueprints push <microshift_blueprint.toml> 1

   1

   Replace <microshift_blueprint.toml> with the name of your TOML file.

Verification

1. Verify the Image Builder configuration listing only MicroShift packages by running the following command:

   $ sudo composer-cli blueprints depsolve <microshift_blueprint> | grep microshift 1

   1

   Replace <microshift_blueprint> with the name of your blueprint.

   Example output

   blueprint: microshift_blueprint v0.0.1
       microshift-greenboot-4.16.1-202305250827.p0.g4105d3b.assembly.4.16.1.el9.noarch
       microshift-networking-4.16.1-202305250827.p0.g4105d3b.assembly.4.16.1.el9.x86_64
       microshift-release-info-4.16.1-202305250827.p0.g4105d3b.assembly.4.16.1.el9.noarch
       microshift-4.16.1-202305250827.p0.g4105d3b.assembly.4.16.1.el9.x86_64
       microshift-selinux-4.16.1-202305250827.p0.g4105d3b.assembly.4.16.1.el9.noarch

2. Optional: Verify the Image Builder configuration listing all components to be installed by running the following command:

   $ sudo composer-cli blueprints depsolve <microshift_blueprint> 1

   1

   Replace <microshift_blueprint> with the name of your blueprint.

Procedure

1. Edit your OSTree blueprint by running the following command:

   $ vi <microshift_blueprint.toml> 1

   1

   Replace <microshift_blueprint.toml> with the name of the blueprint file used for the MicroShift service.

2. Add the following example text to your blueprint:

   [[packages]] 1
   name = "<microshift-additional-package-name>" 2
   version = "*"

   1

   Include one stanza for each additional service that you want to add.

   2

   Replace <microshift-additional-package-name> with the name the RPM for the service you want to include. For example, microshift-olm.

Next steps

1. Add custom certificate authorities to the blueprint as needed.

2. After you are done adding to your blueprint, you can apply the manifests to an active cluster by building a new OSTree system and deploying it on the client:

   • Create the ISO.
   • Add the blueprint and build the ISO.
   • Download the ISO and prepare it for use.
   • Do any provisioning that is needed.

Procedure

1. Start an ostree container image build by running the following command:

   $ BUILDID=$(sudo composer-cli compose start-ostree --ref "rhel/{op-system-version-major}/$(uname -m)/edge" <microshift_blueprint> edge-container | awk '/^Compose/ {print $2}') 1

   1

   Replace <microshift_blueprint> with the name of your blueprint.

   This command also returns the identification (ID) of the build for monitoring.

2. You can check the status of the build periodically by running the following command:

   $ sudo composer-cli compose status

   Example output of a running build

   ID                                     Status     Time                     Blueprint                 Version   Type               Size
   cc3377ec-4643-4483-b0e7-6b0ad0ae6332   RUNNING    Wed Jun 7 12:26:23 2023  microshift_blueprint      0.0.1     edge-container

   Example output of a completed build

   ID                                     Status     Time                      Blueprint              Version   Type               Size
   cc3377ec-4643-4483-b0e7-6b0ad0ae6332   FINISHED   Wed Jun 7 12:32:37 2023   microshift_blueprint   0.0.1     edge-container

   Note

   You can use the watch command to monitor your build if you are familiar with how to start and stop it.

3. Download the container image using the ID and get the image ready for use by running the following command:

   $ sudo composer-cli compose image ${BUILDID}

4. Change the ownership of the downloaded container image to the current user by running the following command:

   $ sudo chown $(whoami). ${BUILDID}-container.tar

5. Add read permissions for the current user to the image by running the following command:

   $ sudo chmod a+r ${BUILDID}-container.tar

6. Bootstrap a server on port 8085 for the ostree container image to be consumed by the ISO build by completing the following steps:

   1. Get the IMAGEID variable result by running the following command:

      $ IMAGEID=$(cat < "./${BUILDID}-container.tar" | sudo podman load | grep -o -P '(?<=sha256[@:])[a-z0-9]*')

   2. Use the IMAGEID variable result to execute the podman command step by running the following command:

      $ sudo podman run -d --name=minimal-microshift-server -p 8085:8080 ${IMAGEID}

      This command also returns the ID of the container saved in the IMAGEID variable for monitoring.

7. Generate the installer blueprint file by running the following command:

   cat > microshift-installer.toml <<EOF
   name = "microshift-installer"
   
   description = ""
   version = "0.0.0"
   modules = []
   groups = []
   packages = []
   EOF

1. Add the blueprint to the Image Builder by running the following command:

   $ sudo composer-cli blueprints push microshift-installer.toml

2. Start the ostree ISO build by running the following command:

   $ BUILDID=$(sudo composer-cli compose start-ostree --url http://localhost:8085/repo/ --ref "rhel/9/$(uname -m)/edge" microshift-installer edge-installer | awk '{print $2}')

   This command also returns the identification (ID) of the build for monitoring.

3. You can check the status of the build periodically by running the following command:

   $ sudo composer-cli compose status

   Example output for a running build

   ID                                     Status     Time                      Blueprint              Version   Type               Size
   c793c24f-ca2c-4c79-b5b7-ba36f5078e8d   RUNNING    Wed Jun 7 13:22:20 2023   microshift-installer   0.0.0     edge-installer

   Example output for a completed build

   ID                                     Status     Time                      Blueprint              Version   Type               Size
   c793c24f-ca2c-4c79-b5b7-ba36f5078e8d   FINISHED   Wed Jun 7 13:34:49 2023   microshift-installer   0.0.0     edge-installer

1. Download the ISO using the ID by running the following command:

   $ sudo composer-cli compose image ${BUILDID}

2. Change the ownership of the downloaded container image to the current user by running the following command:

   $ sudo chown $(whoami). ${BUILDID}-installer.iso

3. Add read permissions for the current user to the image by running the following command:

   $ sudo chmod a+r ${BUILDID}-installer.iso

Prerequisites

1. You have created a RHEL for Edge Installer (ISO) image containing your RHEL for Edge commit with MicroShift.

   1. This requirement includes the steps of composing an RFE Container image, creating the RFE Installer blueprint, starting the RFE container, and composing the RFE Installer image.

2. Create a Kickstart file or use an existing one. In the Kickstart file, you must include:

   1. Detailed instructions about how to create a user.
   2. How to fetch and deploy the RHEL for Edge image.

Procedure

1. In the main section of the Kickstart file, update the setup of the filesystem such that it contains an LVM volume group called rhel with at least 10GB system root. Leave free space for the LVMS CSI driver to use for storing the data for your workloads.

   Example kickstart snippet for configuring the filesystem

   # Partition disk such that it contains an LVM volume group called `rhel` with a
   # 10GB+ system root but leaving free space for the LVMS CSI driver for storing data.
   #
   # For example, a 20GB disk would be partitioned in the following way:
   #
   # NAME          MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
   # sda             8:0    0  20G  0 disk
   # ├─sda1          8:1    0 200M  0 part /boot/efi
   # ├─sda1          8:1    0 800M  0 part /boot
   # └─sda2          8:2    0  19G  0 part
   #  └─rhel-root  253:0    0  10G  0 lvm  /sysroot
   #
   ostreesetup --nogpg --osname=rhel --remote=edge \
   --url=file:///run/install/repo/ostree/repo --ref=rhel/<RHEL VERSION NUMBER>/x86_64/edge
   zerombr
   clearpart --all --initlabel
   part /boot/efi --fstype=efi --size=200
   part /boot --fstype=xfs --asprimary --size=800
   # Uncomment this line to add a SWAP partition of the recommended size
   #part swap --fstype=swap --recommended
   part pv.01 --grow
   volgroup rhel pv.01
   logvol / --vgname=rhel --fstype=xfs --size=10000 --name=root
   # To add users, use a line such as the following
   user --name=<YOUR_USER_NAME> \
   --password=<YOUR_HASHED_PASSWORD> \
   --iscrypted --groups=<YOUR_USER_GROUPS>

2. In the %post section of the Kickstart file, add your pull secret and the mandatory firewall rules.

   Example Kickstart snippet for adding the pull secret and firewall rules

   %post --log=/var/log/anaconda/post-install.log --erroronfail
   
   # Add the pull secret to CRI-O and set root user-only read/write permissions
   cat > /etc/crio/openshift-pull-secret << EOF
   YOUR_OPENSHIFT_PULL_SECRET_HERE
   EOF
   chmod 600 /etc/crio/openshift-pull-secret
   
   # Configure the firewall with the mandatory rules for MicroShift
   firewall-offline-cmd --zone=trusted --add-source=10.42.0.0/16
   firewall-offline-cmd --zone=trusted --add-source=169.254.169.1
   
   %end

3. Install the mkksiso tool by running the following command:

   $ sudo yum install -y lorax

4. Update the Kickstart file in the ISO with your new Kickstart file by running the following command:

   $ sudo mkksiso <your_kickstart>.ks <your_installer>.iso <updated_installer>.iso