Chapter 3. Deploying a RHEL image as a compute instance on Azure

Procedure

1. Configure the Red Hat Enterprise Linux (RHEL) VM. See the Additional resources section for details:

   1. To install from CLI, ensure that you set the default memory, network interfaces, and CPUs according to your requirement for the VM.
   2. You can also install RHEL from the web console.

2. When the installation starts:

   1. Create a root password.
   2. Create an administrative user account.
3. After the installation completes, reboot the VM and log in to the root account.
4. After logging in as root, you can configure the image.

5. Register the VM and enable the RHEL repository:

   # subscription-manager register

6. Install the cloud-init package:

   # dnf install cloud-init

7. Enable and start the cloud-init service:

   # systemctl enable --now cloud-init.service

8. Reboot the VM to apply the changes.

Procedure

1. Import the Microsoft repository key:

   $ sudo rpm --import https://packages.microsoft.com/keys/microsoft.asc

2. Create a local Azure CLI repository entry:

   $ sudo sh -c 'echo -e "[azure-cli]\nname=Azure CLI\nbaseurl=https://packages.microsoft.com/yumrepos/azure-cli\nenabled=1\ngpgcheck=1\ngpgkey=https://packages.microsoft.com/keys/microsoft.asc" > /etc/yum.repos.d/azure-cli.repo'

3. Update the dnf package index:

   $ sudo dnf update

4. Install the Azure CLI:

   $ sudo dnf install -y azure-cli

5. Run the Azure CLI:

   $ az login

Procedure

1. Verify if the system has Hyper-V device drivers:

   # lsinitrd | grep hv
   
   drwxr-xr-x   2 root     root            0 Aug 12 14:21 usr/lib/modules/3.10.0-932.el10.x86_64/kernel/drivers/hv
   -rw-r--r--   1 root     root        31272 Aug 11 08:45 usr/lib/modules/3.10.0-932.el10.x86_64/kernel/drivers/hv/hv_vmbus.ko.xz
   -rw-r--r--   1 root     root        25132 Aug 11 08:46 usr/lib/modules/3.10.0-932.el10.x86_64/kernel/drivers/net/hyperv/hv_netvsc.ko.xz
   -rw-r--r--   1 root     root         9796 Aug 11 08:45 usr/lib/modules/3.10.0-932.el10.x86_64/kernel/drivers/scsi/hv_storvsc.ko.xz

   In case, all the drivers are not installed or even the hv_vmbus driver is listed, complete the remaining steps.

2. Create the hv.conf file in the /etc/dracut.conf.d directory and add the following driver parameters:

   # vi hv.conf
   
   add_drivers+=" hv_vmbus "
   add_drivers+=" hv_netvsc "
   add_drivers+=" hv_storvsc "
   add_drivers+=" nvme "

   Ensure that you have added spaces after and before the double quotes add_drivers+=" hv_vmbus " to load unique drivers, in case other Hyper-V drivers already exist in the environment.

3. Regenerate the initramfs image:

   # dracut -f -v --regenerate-all

Verification

1. Reboot the machine.

2. Verify installation of drivers:

   # lsinitrd | grep hv

Procedure

1. Log in to the VM.

2. Create and edit the /etc/cloud/cloud.cfg.d/00-azure-swap.cfg configuration file and add the following cloud-init configuration to the file:

   # vi /etc/cloud/cloud.cfg.d/00-azure-swap.cfg

   #cloud-config
   disk_setup:
     ephemeral0:
       table_type: gpt
       layout: [66, [33,82]]
       overwrite: true
   fs_setup:
     - device: ephemeral0.1
       filesystem: ext4
     - device: ephemeral0.2
       filesystem: swap
   mounts:
     - ["ephemeral0.1", "/mnt"]
     - ["ephemeral0.2", "none", "swap", "sw,nofail,x-systemd.requires=cloud-init.service", "0", "0"]

   This configuration:

   • Partitions the ephemeral disk (ephemeral0) with a GPT partition table.
   • Creates two partitions: 66% for a file system (mounted at /mnt) and 33% for swap space.
   • Formats the first partition as ext4 and the second partition as swap.

   • Configures automatic mounting of both partitions at boot time.

     Note

     The partition layout [66, [33,82]] allocates 66% of the disk to the first partition and 33% to the second partition. The 82 in the second partition specification indicates a Linux swap partition type. You can adjust these percentages based on your requirements.

3. Verify the configuration file for any errors:

   # cloud-init devel schema --config-file /etc/cloud/cloud.cfg.d/00-azure-swap.cfg

   If the configuration is valid, the command returns no errors.

Procedure

1. Log in and register the VM to enable the Red Hat Enterprise Linux (RHEL) repository:

   # subscription-manager register

2. Install the cloud-init and hyperv-daemons packages:

   # dnf install cloud-init hyperv-daemons -y

3. Create the cloud-init configuration files and edit them to offer integration with Azure services:

   1. To enable logging to the Hyper-V Data Exchange Service, also known as Key Value Pair (KVP), edit the /etc/cloud/cloud.cfg.d/10-azure-kvp.cfg file and append the following lines:

      reporting:
          logging:
              type: log
          telemetry:
              type: hyperv

   2. To add the Azure datasource, edit the /etc/cloud/cloud.cfg.d/91-azure_datasource.cfg file and append the following lines:

      datasource_list: [ Azure ]
      datasource:
          Azure:
              apply_network_config: False

   3. To configure swap space on the ephemeral disk, create the /etc/cloud/cloud.cfg.d/00-azure-swap.cfg configuration file and add the following lines to that file.

      Important

      The ephemeral disk is temporary storage. Therefore, data stored on it, including swap space, is lost when the VM is deallocated or moved. Use the ephemeral disk only for temporary data such as swap space.

      #cloud-config
      disk_setup:
        ephemeral0:
          table_type: gpt
          layout: [66, [33,82]]
          overwrite: true
      fs_setup:
        - device: ephemeral0.1
          filesystem: ext4
        - device: ephemeral0.2
          filesystem: swap
      mounts:
        - ["ephemeral0.1", "/mnt"]
        - ["ephemeral0.2", "none", "swap", "sw,nofail,x-systemd.requires=cloud-init.service", "0", "0"]

4. To block automatic loading of specific kernel modules, edit the /etc/modprobe.d/blocklist.conf file and append the following lines:

   blacklist nouveau
   blacklist lbm-nouveau
   blacklist floppy
   blacklist amdgpu
   blacklist skx_edac
   blacklist intel_cstate

5. Modify udev network device rules:

   1. If present, remove the following persistent network device rules:

      # rm -f /etc/udev/rules.d/70-persistent-net.rules

      # rm -f /etc/udev/rules.d/75-persistent-net-generator.rules

      # rm -f /etc/udev/rules.d/80-net-name-slot-rules

   2. To ensure working of accelerated networking on Azure, edit the /etc/udev/rules.d/68-azure-sriov-nm-unmanaged.rules new network device rule and append:

      SUBSYSTEM=="net", DRIVERS=="hv_pci", ACTION=="add", ENV{NM_UNMANAGED}="1"

6. Set the sshd service to start automatically:

   # systemctl enable --now sshd

7. Modify kernel boot parameters:

   1. Update the GRUB_TIMEOUT parameter value in the /etc/default/grub file:

      GRUB_TIMEOUT=10

   2. Remove the following option from the end of the GRUB_CMDLINE_LINUX line, if present:

      rhgb quiet

   3. Update the /etc/default/grub file with the following configuration details:

      GRUB_CMDLINE_LINUX="loglevel=3 crashkernel=auto console=tty1 console=ttyS0 earlyprintk=ttyS0 rootdelay=300"
      GRUB_TIMEOUT_STYLE=countdown
      GRUB_TERMINAL="serial console"
      GRUB_SERIAL_COMMAND="serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1"

      Note

      By adding the elevator=none option to the end of the GRUB_CMDLINE_LINUX line. This instructs the I/O scheduler to process I/O requests in the order of execution, without optimizing disk performance.

      With elevator=none on:

      • Hard disk drive (HDD): Performance and throughput decreases, therefore not suitable for running workloads.
      • Solid state drive (SSD): High performance and low latency, therefore suitable for running workloads.

   4. Regenerate the grub.cfg file:

      • On a BIOS-based machine:

        # grub2-mkconfig -o /boot/grub2/grub.cfg --update-bls-cmdline

      • On a UEFI-based machine:

        # grub2-mkconfig -o /boot/grub2/grub.cfg --update-bls-cmdline

        Note

        The path to rebuild grub.cfg is same for both BIOS and UEFI based machines. Original grub.cfg is present at BIOS path only. The UEFI path has a stub file that must not be modified or recreated using grub2-mkconfig command.

        If your system uses a non-default location for grub.cfg, change the command.

8. Configure the Windows Azure Linux Agent (WALinuxAgent):

   1. Install and enable the WALinuxAgent package:

      # dnf install WALinuxAgent -y

      # systemctl enable waagent

   2. To disable swap configuration in WALinuxAgent (required when using cloud-init to manage swap), edit the following lines in the /etc/waagent.conf file:

      Provisioning.DeleteRootPassword=y
      ResourceDisk.Format=n
      ResourceDisk.EnableSwap=n
      ResourceDisk.SwapSizeMB=0

      Note

      By disabling swap in WALinuxAgent, you enable cloud-init to manage the swap configuration on the ephemeral disk.

Procedure

1. Convert the image from qcow2 to raw format.

   $ qemu-img convert -f qcow2 -O raw <example_image_name>.qcow2 <output_image_name>.raw

2. Edit the align.sh shell script:

   $ vi align.sh

   #!/bin/bash
   MB=$((1024 * 1024))
   size=$(qemu-img info -f raw --output json "$1" | gawk 'match($0, /"virtual-size": ([0-9]+),/, val) {print val[1]}')
   rounded_size=$((($size/$MB + 1) * $MB))
   if [ $(($size % $MB)) -eq  0 ]
   then
    echo "Your image is already aligned. You do not need to resize."
    exit 1
   fi
   echo "rounded size = $rounded_size"
   export rounded_size

3. Run the script:

   $ sh align.sh <example_image_name>.raw

4. If the message displays as Your image is already aligned. You do not need to resize.:

   1. Convert the file to a fixed VHD format:

      $ qemu-img convert -f raw -o subformat=fixed,force_size -O vpc <example_image_name>.raw <output_image_name>.vhd

      Once converted, the VHD file is ready to upload to Azure.

5. If a value displays mean the raw image is not aligned:

   1. Resize the raw file by using the rounded value as displayed above:

      $ qemu-img resize -f raw <example_image_name>.raw +1G

   2. Convert the raw image file to a VHD format.

      $ qemu-img convert -f raw -o subformat=fixed,force_size -O vpc <example_image_name>.raw <output_image_name>.vhd

      Once converted, the VHD file is ready to upload to Azure.

Procedure

1. Authenticate your host with Azure credentials and log in:

   $ az login

   To login from a browser, open the Azure sign-in page from the Azure CLI. For details, see sign in with a browser.

2. Create a resource group in an Azure region:

   $ az group create --name <example_resource_group> \
   --location <example_azure_region>

   Example:

   [clouduser@localhost]$ az group create --name azrhelclirsgrp \
   --location southcentralus

   {
     "id": "/subscriptions//resourceGroups/azrhelclirsgrp",
     "location": "southcentralus",
     "managedBy": null,
     "name": "azrhelclirsgrp",
     "properties": {
       "provisioningState": "Succeeded"
     },
     "tags": null
   }

3. Create a storage account with a valid stock keeping units (SKU) types:

   $ az storage account create -l <example_azure_region> \
   --name <example_storage_account_name> \
   --resource-group <example_resource_group> \
   --sku <example_sku_type>

   Example:

   $ az storage account create -l southcentralus \
   --name azrhelclistact \
   --resource-group azrhelclirsgrp \
   --sku Standard_LRS

   {
     "accessTier": null,
     "creationTime": "2017-04-05T19:10:29.855470+00:00",
     "customDomain": null,
     "encryption": null,
     "id": "/subscriptions//resourceGroups/azrhelclirsgrp/providers/Microsoft.Storage/storageAccounts/azrhelclistact",
     "kind": "StorageV2",
     "lastGeoFailoverTime": null,
     "location": "southcentralus",
     "name": "azrhelclistact",
     "primaryEndpoints": {
       "blob": "https://azrhelclistact.blob.core.windows.net/",
       "file": "https://azrhelclistact.file.core.windows.net/",
       "queue": "https://azrhelclistact.queue.core.windows.net/",
       "table": "https://azrhelclistact.table.core.windows.net/"
   },
   "primaryLocation": "southcentralus",
   "provisioningState": "Succeeded",
   "resourceGroup": "azrhelclirsgrp",
   "secondaryEndpoints": null,
   "secondaryLocation": null,
   "sku": {
     "name": "Standard_LRS",
     "tier": "Standard"
   },
   "statusOfPrimary": "available",
   "statusOfSecondary": null,
   "tags": {},
     "type": "Microsoft.Storage/storageAccounts"
   }

4. Display the storage account details:

   $ az storage account show-connection-string \
   -n <example_storage_account_name> \
   --resource-group <example_resource_group>

   Example:

   $ az storage account show-connection-string \
   -n azrhelclistact \
   --resource-group azrhelclirsgrp

   {
     "connectionString": "DefaultEndpointsProtocol=https;EndpointSuffix=core.windows.net;AccountName=azrhelclistact;AccountKey=NreGk...=="
   }

5. Set the environment variable by exporting the existing connection string to connect system to the storage account:

   $ export AZURE_STORAGE_CONNECTION_STRING="<storage_connection_string>"

   Example:

   $ export AZURE_STORAGE_CONNECTION_STRING="DefaultEndpointsProtocol=https;EndpointSuffix=core.windows.net;AccountName=azrhelclistact;AccountKey=NreGk...=="

6. Create a storage container:

   $ az storage container create -n <example_container_name>

   Example:

   $ az storage container create -n azrhelclistcont

   {
     "created": true
   }

7. Create a virtual network:

   $ az network vnet create -g <example_resource_group> \
   --name <example_vnet_name> \
   --subnet-name <example_subnet_name>

   Example:

   $ az network vnet create --resource-group azrhelclirsgrp \
   --name azrhelclivnet1 \
   --subnet-name azrhelclisubnet1

   {
     "newVNet": {
       "addressSpace": {
         "addressPrefixes": [
         "10.0.0.0/16"
         ]
     },
     "dhcpOptions": {
       "dnsServers": []
     },
     "etag": "W/\"\"",
     "id": "/subscriptions//resourceGroups/azrhelclirsgrp/providers/Microsoft.Network/virtualNetworks/azrhelclivnet1",
     "location": "southcentralus",
     "name": "azrhelclivnet1",
     "provisioningState": "Succeeded",
     "resourceGroup": "azrhelclirsgrp",
     "resourceGuid": "0f25efee-e2a6-4abe-a4e9-817061ee1e79",
     "subnets": [
       {
         "addressPrefix": "10.0.0.0/24",
         "etag": "W/\"\"",
         "id": "/subscriptions//resourceGroups/azrhelclirsgrp/providers/Microsoft.Network/virtualNetworks/azrhelclivnet1/subnets/azrhelclisubnet1",
         "ipConfigurations": null,
         "name": "azrhelclisubnet1",
         "networkSecurityGroup": null,
         "provisioningState": "Succeeded",
         "resourceGroup": "azrhelclirsgrp",
         "resourceNavigationLinks": null,
         "routeTable": null
       }
     ],
     "tags": {},
     "type": "Microsoft.Network/virtualNetworks",
     "virtualNetworkPeerings": null
     }
   }

Procedure

1. Upload the VHD file to the storage container:

   $ az storage blob upload \
   --account-name <storage_account_name> \
   --container-name <container_name> \
   --type page \
   --file <path_to_vhd> \
   --name <image_name>.vhd

   Example:

   $ az storage blob upload \
   --account-name azrhelclistact \
   --container-name azrhelclistcont \
   --type page \
   --file ~/Downloads/rhel-image-10.vhd \
   --name rhel-10-image.vhd

   Percent complete: 100.0%

2. List the storage containers:

   • To display in the tabular format, enter:

     $ az storage container list --output table

   • To display in the YAML format, enter:

     $ az storage container list --output yaml

3. Use the URL for the uploaded VHD file from the 1st step:

   $ az storage blob url \
   -c <container_name> \
   -n <image_name>.vhd \
   <url_of_vhd_file>

   Example:

   $ az storage blob url \
   -c azrhelclistcont \
   -n rhel-image-10.vhd 'https://azrhelclistact.blob.core.windows.net/azrhelclistcont/rhel-image-10.vhd'

4. Create the Azure custom image:

   $ az image create -n <image_name> \
   -g <resource_group> \
   -l <azure_region> \
   --source <URL> \
   --os-type linux

   Note

   By default, Azure creates the VM with a Generation 1 hypervisor. If you want to use a Generation 2 VM, which provides UEFI-based boot architecture, add the --hyper-v-generation V2 option to the command.

   Example:

   $ az image create -n rhel10 \
   -g azrhelclirsgrp2 \
   -l southcentralus \
   --source https://azrhelclistact.blob.core.windows.net/azrhelclistcont/rhel-image-10.vhd \
   --os-type linux

Procedure

1. Create the VM:

   $ az vm create \
   --resource-group <resource_group> \
   --location <azure_region> \
   --name <vm_name> \
   --vnet-name <vnet_name> \
   --subnet <subnet_name> \
   --size Standard_A2 \
   --os-disk-name <simple_name> \
   --admin-username <administrator_name> \
   --generate-ssh-keys \
   --image <path_to_image>

   Example:

   $ az vm create \
   --resource-group azrhelclirsgrp2 \
   --location southcentralus \
   --name rhel-azure-vm-1 \
   --vnet-name azrhelclivnet1 \
   --subnet azrhelclisubnet1 \
   --size Standard_A2 \
   --os-disk-name vm-1-osdisk \
   --admin-username clouduser \
   --generate-ssh-keys \
   --image rhel10

   {
     "fqdns": "",
     "id": "/subscriptions//resourceGroups/azrhelclirsgrp/providers/Microsoft.Compute/virtualMachines/rhel-azure-vm-1",
     "location": "southcentralus",
     "macAddress": "",
     "powerState": "VM running",
     "privateIpAddress": "10.0.0.4",
     "publicIpAddress": "__<public_ip_address>__",
     "resourceGroup": "azrhelclirsgrp2"
   }

   • --generate-ssh-keys option creates a private and public key pair files in the ~/.ssh directory.

   • The public key is added to the authorized_keys file on the VM for the user specified by the --admin-username option.

     For details, see Types of SSH authentication methods. Note the publicIpAddress, which is required for logging in to the VM in the following step.

2. Start an SSH session and log in to the Azure VM:

   [clouduser@localhost]$ ssh -i /home/clouduser/.ssh/id_rsa clouduser@<public_ip_address>

   The authenticity of host '__<public_ip_address>__' can't be established.
   Are you sure you want to continue connecting (yes/no)? yes
   Warning: Permanently added '__<public_ip_address>__' (ECDSA) to the list of known hosts.

Procedure

1. Register your system:

   # subscription-manager register

2. Attach your subscriptions:

   • You can use an activation key to attach subscriptions. For details, see creating Red Hat Customer Portal Activation Keys.
   • Otherwise, you can manually attach a subscription by using the subscription Pool ID attaching a host-based subscription by using Pool ID to hypervisors.

3. Optional: To collect various system metrics about the instance in the Red Hat Hybrid Cloud Console, you can register the instance with Red Hat Lightspeed.

   # insights-client register --display-name <display_name_value>

Procedure

1. Install kdump and other necessary packages:

   # dnf install kexec-tools kdump-utils makedumpfile

2. Verify that the default location for crash dump files is set in the kdump configuration file and that the /var/crash file is available:

   # grep -v "#" /etc/kdump.conf

   path /var/crash
   core_collector makedumpfile -l --message-level 7 -d 31

3. Based on the RHEL VM size and version, check if you need a vmcore target with more free space, such as /mnt/crash:

   Expand

   Table 3.3. Virtual machine sizes that have been tested with GEN2 VM on Azure

   RHEL Version	Standard DS1 v2 (1 vCPU, 3.5GiB)	Standard NV16as v4 (16 vCPUs, 56 GiB)	Standard M416-208s v2 (208 vCPUs, 5700 GiB)	Standard M416ms v2 (416 vCPUs, 11400 GiB)
   RHEL 9.4 - RHEL 10	Default	Default	Target	Target

   Show more
   • Default indicates that kdump works as expected with the default memory and the default kdump target. The default kdump target is the /var/crash file.
   • Target indicates that kdump works as expected with the default memory. However, you might need to assign a target with more free space.

4. To assign a target with free space, such as /mnt/crash, edit the /etc/kdump.conf file and replace the default path:

   $ sed s/"path /var/crash"/"path /mnt/crash"

   The option path /mnt/crash represents the path to the file system where kdump saves the crash dump file.

   For details, such as writing the crash dump file to a different partition, directly to a device or storing it to a remote machine, see Configuring the kdump target.

5. If required, increase the crash kernel size by adding a boot parameter to ensure kdump can capture the vmcore:

   For example, for a Standard M416-208s v2 VM, the sufficient size is 512 MB, so the boot parameter would be crashkernel=512M.

   1. Open the GRUB configuration file and add crashkernel=512M to the boot parameter line:

      # vi /etc/default/grub

      GRUB_CMDLINE_LINUX="console=tty1 console=ttyS0 earlyprintk=ttyS0 rootdelay=300 crashkernel=512M"

   2. Update the GRUB configuration file:

      # grub2-mkconfig -o /boot/grub2/grub.cfg --update-bls-cmdline

6. Reboot the VM to allocate separate kernel crash memory to the VM.