Deploying RHEL 9 on Google Cloud Platform

1. Select the optimal cloud provider for your use case, based on your requirements and the current offer on the market.

   The cloud providers currently certified for running RHEL instances are:

   • Amazon Web Services (AWS)
   • Google Cloud Platform (GCP)

   • Microsoft Azure

     Note

     This document specifically talks about deploying RHEL on GCP.

2. Create a RHEL cloud instance on your chosen cloud platform. For more information, see Methods for creating RHEL cloud instances.
3. To keep your RHEL deployment up-to-date, use Red Hat Update Infrastructure (RHUI).

Procedure

1. Use a text editor to create a gcp-config.toml configuration file with the following content:

   provider = "gcp"
   
   [settings]
   bucket = "GCP_BUCKET"
   region = "GCP_STORAGE_REGION"
   object = "OBJECT_KEY"
   credentials = "GCP_CREDENTIALS"

   • GCP_BUCKET points to an existing bucket. It is used to store the intermediate storage object of the image which is being uploaded.
   • GCP_STORAGE_REGION is both a regular Google storage region and, a dual or multi region.
   • OBJECT_KEY is the name of an intermediate storage object. It must not exist before the upload, and it is deleted when the upload process is done. If the object name does not end with .tar.gz, the extension is automatically added to the object name.

   • GCP_CREDENTIALS is a Base64-encoded scheme of the credentials JSON file downloaded from GCP. The credentials determine which project the GCP uploads the image to.

     Note

     Specifying GCP_CREDENTIALS in the gcp-config.toml file is optional if you use a different mechanism to authenticate with GCP. For other authentication methods, see Authenticating with GCP.

2. Retrieve the GCP_CREDENTIALS from the JSON file downloaded from GCP.

   $ sudo base64 -w 0 cee-gcp-nasa-476a1fa485b7.json

3. Create a compose with an additional image name and cloud provider profile:

   $ sudo composer-cli compose start BLUEPRINT-NAME gce IMAGE_KEY gcp-config.toml

   The image build, upload, and cloud registration processes can take up to ten minutes to complete.

1. Credentials specified with the composer-cli command in the configuration file.
2. Credentials configured in the osbuild-composer worker configuration.

3. Application Default Credentials from the Google GCP SDK library, which tries to automatically find a way to authenticate by using the following options:

   1. If the GOOGLE_APPLICATION_CREDENTIALS environment variable is set, Application Default Credentials tries to load and use credentials from the file pointed to by the variable.

   2. Application Default Credentials tries to authenticate by using the service account attached to the resource that is running the code. For example, Google Compute Engine VM.

      Note

      You must use the GCP credentials to determine which GCP project to upload the image to. Therefore, unless you want to upload all of your images to the same GCP project, you always must specify the credentials in the gcp-config.toml configuration file with the composer-cli command.

Procedure

1. Follow the GCP instructions for downloading and extracting the Google Cloud SDK archive. See the GCP document Quickstart for Linux for details.

2. Follow the same instructions for initializing the Google Cloud SDK.

   Note

   Once you have initialized the Google Cloud SDK, you can use the gcloud CLI commands to perform tasks and obtain information about your project and instances. For example, you can display project information with the gcloud compute project-info describe --project <project-name> command.

Procedure

1. If you are not already logged in to Google Cloud Platform, log in with the following command.

   # gcloud auth login

2. Create a storage bucket.

   $ gsutil mb gs://BucketName

   Example:

   $ gsutil mb gs://rhel-ha-bucket

Procedure

1. Launch the GCP Console.
2. Select VPC networks under Networking in the left navigation pane.
3. Click Create VPC Network.
4. Enter a name for the VPC network.
5. Under the New subnet, create a Custom subnet in the region where you want to create the cluster.
6. Click Create.

Procedure

1. Convert the file. Images uploaded to GCP must be in raw format and named disk.raw.

   $ qemu-img convert -f qcow2 ImageName.qcow2 -O raw disk.raw

2. Compress the raw file. Images uploaded to GCP must be compressed.

   $ tar -Sczf ImageName.tar.gz disk.raw

3. Import the compressed image to the bucket created earlier.

   $ gsutil cp ImageName.tar.gz gs://BucketName

Procedure

1. Create an image from the compressed file in the bucket.

   $ gcloud compute images create BaseImageName --source-uri gs://BucketName/BaseImageName.tar.gz

   Example:

   [admin@localhost ~] $ gcloud compute images create rhel-76-server --source-uri gs://user-rhelha/rhel-server-76.tar.gz
   Created [https://www.googleapis.com/compute/v1/projects/MyProject/global/images/rhel-server-76].
   NAME            PROJECT                 FAMILY  DEPRECATED  STATUS
   rhel-76-server  rhel-ha-testing-on-gcp                      READY

2. Create a template instance from the image. The minimum size required for a base RHEL instance is n1-standard-2. See gcloud compute instances create for additional configuration options.

   $ gcloud compute instances create BaseInstanceName --can-ip-forward --machine-type n1-standard-2 --image BaseImageName --service-account ServiceAccountEmail

   Example:

   [admin@localhost ~] $ gcloud compute instances create rhel-76-server-base-instance --can-ip-forward --machine-type n1-standard-2 --image rhel-76-server --service-account account@project-name-on-gcp.iam.gserviceaccount.com
   Created [https://www.googleapis.com/compute/v1/projects/rhel-ha-testing-on-gcp/zones/us-east1-b/instances/rhel-76-server-base-instance].
   NAME   ZONE   MACHINE_TYPE   PREEMPTIBLE  INTERNAL_IP  EXTERNAL_IP     STATUS
   rhel-76-server-base-instance  us-east1-bn1-standard-2          10.10.10.3   192.227.54.211  RUNNING

3. Connect to the instance with an SSH terminal session.

   $ ssh root@PublicIPaddress

4. Update the RHEL software.

   1. Register with Red Hat Subscription Manager (RHSM).
   2. Enable a Subscription Pool ID (or use the --auto-attach command).

   3. Disable all repositories.

      # subscription-manager repos --disable=*

   4. Enable the following repository.

      # subscription-manager repos --enable=rhel-9-server-rpms

   5. Run the dnf update command.

      # dnf update -y

5. Install the GCP Linux Guest Environment on the running instance (in-place installation).

   See Install the guest environment in-place for instructions.

6. Select the CentOS/RHEL option.
7. Copy the command script and paste it at the command prompt to run the script immediately.

8. Make the following configuration changes to the instance. These changes are based on GCP recommendations for custom images. See gcloudcompute images list for more information.

   1. Edit the /etc/chrony.conf file and remove all NTP servers.

   2. Add the following NTP server.

      metadata.google.internal iburst Google NTP server

   3. Remove any persistent network device rules.

      # rm -f /etc/udev/rules.d/70-persistent-net.rules
      
      # rm -f /etc/udev/rules.d/75-persistent-net-generator.rules

   4. Set the network service to start automatically.

      # chkconfig network on

   5. Set the sshd service to start automatically.

      # systemctl enable sshd
      # systemctl is-enabled sshd

   6. Set the time zone to UTC.

      # ln -sf /usr/share/zoneinfo/UTC /etc/localtime

   7. (Optional) Edit the /etc/ssh/ssh_config file and add the following lines to the end of the file. This keeps your SSH session active during longer periods of inactivity.

      # Server times out connections after several minutes of inactivity.
      # Keep alive ssh connections by sending a packet every 7 minutes.
      ServerAliveInterval 420

   8. Edit the /etc/ssh/sshd_config file and make the following changes, if necessary. The ClientAliveInterval 420 setting is optional; this keeps your SSH session active during longer periods of inactivity.

      PermitRootLogin no
      PasswordAuthentication no
      AllowTcpForwarding yes
      X11Forwarding no
      PermitTunnel no
      # Compute times out connections after 10 minutes of inactivity.
      # Keep ssh connections alive by sending a packet every 7 minutes.
      ClientAliveInterval 420

9. Disable password access.

   ssh_pwauth from 1 to 0.
   ssh_pwauth: 0

   Important

   Previously, you enabled password access to allow SSH session access to configure the instance. You must disable password access. All SSH session access must be passwordless.

10. Unregister the instance from the subscription manager.

    # subscription-manager unregister

11. Clean the shell history. Keep the instance running for the next procedure.

    # export HISTSIZE=0

Procedure

1. On the running instance, synchronize data to disk.

   # sync

2. On your host system, create the snapshot.

   $ gcloud compute disks snapshot InstanceName --snapshot-names SnapshotName

3. On your host system, create the configured image from the snapshot.

   $ gcloud compute images create ConfiguredImageFromSnapshot --source-snapshot SnapshotName

Procedure

1. Create an instance template.

   $ gcloud compute instance-templates create InstanceTemplateName --can-ip-forward --machine-type n1-standard-2 --image ConfiguredImageFromSnapshot --service-account ServiceAccountEmailAddress

   Example:

   [admin@localhost ~] $ gcloud compute instance-templates create rhel-91-instance-template --can-ip-forward --machine-type n1-standard-2 --image rhel-91-gcp-image --service-account account@project-name-on-gcp.iam.gserviceaccount.com
   Created [https://www.googleapis.com/compute/v1/projects/project-name-on-gcp/global/instanceTemplates/rhel-91-instance-template].
   NAME  MACHINE_TYPE   PREEMPTIBLE  CREATION_TIMESTAMP
   rhel-91-instance-template   n1-standard-2          2018-07-25T11:09:30.506-07:00

2. Create multiple nodes in one zone.

   # gcloud compute instances create NodeName01 NodeName02 --source-instance-template InstanceTemplateName --zone RegionZone --network=NetworkName --subnet=SubnetName

   Example:

   [admin@localhost ~] $ gcloud compute instances create rhel81-node-01 rhel81-node-02 rhel81-node-03 --source-instance-template rhel-91-instance-template --zone us-west1-b --network=projectVPC --subnet=range0
   Created [https://www.googleapis.com/compute/v1/projects/project-name-on-gcp/zones/us-west1-b/instances/rhel81-node-01].
   Created [https://www.googleapis.com/compute/v1/projects/project-name-on-gcp/zones/us-west1-b/instances/rhel81-node-02].
   Created [https://www.googleapis.com/compute/v1/projects/project-name-on-gcp/zones/us-west1-b/instances/rhel81-node-03].
   NAME            ZONE        MACHINE_TYPE   PREEMPTIBLE  INTERNAL_IP  EXTERNAL_IP    STATUS
   rhel81-node-01  us-west1-b  n1-standard-2               10.10.10.4   192.230.25.81   RUNNING
   rhel81-node-02  us-west1-b  n1-standard-2               10.10.10.5   192.230.81.253  RUNNING
   rhel81-node-03  us-east1-b  n1-standard-2               10.10.10.6   192.230.102.15  RUNNING

Procedure

1. In the Google Cloud Console, select Compute Engine and then select VM instances.
2. Select the instance, click the arrow next to SSH, and select the View gcloud command option.
3. Paste this command at a command prompt for passwordless access to the instance.
4. Enable sudo account access and register with Red Hat Subscription Manager.
5. Enable a Subscription Pool ID (or use the --auto-attach command).

6. Disable all repositories.

   # subscription-manager repos --disable=*

7. Enable the following repositories.

   # subscription-manager repos --enable=rhel-9-server-rpms
   # subscription-manager repos --enable=rhel-9-for-x86_64-highavailability-rpms

8. Install pcs pacemaker, the fence agents, and the resource agents.

   # dnf install -y pcs pacemaker fence-agents-gce resource-agents-gcp

9. Update all packages.

   # dnf update -y

Procedure

1. The user hacluster was created during the pcs and pacemaker installation in the previous step. Create a password for the user hacluster on all cluster nodes. Use the same password for all nodes.

   # passwd hacluster

2. If the firewalld service is installed, add the HA service.

   # firewall-cmd --permanent --add-service=high-availability
   
   # firewall-cmd --reload

3. Start the pcs service and enable it to start on boot.

   # systemctl start pcsd.service
   
   # systemctl enable pcsd.service
   
   Created symlink from /etc/systemd/system/multi-user.target.wants/pcsd.service to /usr/lib/systemd/system/pcsd.service.

Verification

1. Ensure the pcsd service is running.

   # systemctl status pcsd.service
   
   pcsd.service - PCS GUI and remote configuration interface
   Loaded: loaded (/usr/lib/systemd/system/pcsd.service; enabled; vendor preset: disabled)
   Active: active (running) since Mon 2018-06-25 19:21:42 UTC; 15s ago
   Docs: man:pcsd(8)
   man:pcs(8)
   Main PID: 5901 (pcsd)
   CGroup: /system.slice/pcsd.service
   └─5901 /usr/bin/ruby /usr/lib/pcsd/pcsd > /dev/null &

2. Edit the /etc/hosts file. Add RHEL host names and internal IP addresses for all nodes.

Procedure

1. On one of the nodes, authenticate the pcs user. Specify the name of each node in the cluster in the command.

   # pcs host auth hostname1 hostname2 hostname3
   Username: hacluster
   Password:
   hostname1: Authorized
   hostname2: Authorized
   hostname3: Authorized

2. Create the cluster.

   # pcs cluster setup cluster-name hostname1 hostname2 hostname3

Verification

1. Run the following command to enable nodes to join the cluster automatically when started.

   # pcs cluster enable --all

2. Start the cluster.

   # pcs cluster start --all

Procedure

1. Obtain GCP instance names. Note that the output of the following command also shows the internal ID for the instance.

   # fence_gce --zone us-west1-b --project=rhel-ha-on-gcp -o list

   Example:

   [root@rhel81-node-01 ~]# fence_gce --zone us-west1-b --project=rhel-ha-testing-on-gcp -o list
   
   4435801234567893181,InstanceName-3
   4081901234567896811,InstanceName-1
   7173601234567893341,InstanceName-2

2. Create a fence device.

   # pcs stonith create FenceDeviceName fence_gce zone=Region-Zone project=MyProject

Procedure

1. Create the aliasip resource. Include an unused internal IP address. Include the CIDR block in the command.

   # pcs resource create aliasip gcp-vpc-move-vip alias_ip=UnusedIPaddress/CIDRblock

   Example:

   [root@rhel81-node-01 ~]# pcs resource create aliasip gcp-vpc-move-vip alias_ip=10.10.10.200/32

2. Create an IPaddr2 resource for managing the IP on the node.

   # pcs resource create vip IPaddr2 nic=interface ip=AliasIPaddress cidr_netmask=32

   Example:

   [root@rhel81-node-01 ~]# pcs resource create vip IPaddr2 nic=eth0 ip=10.10.10.200 cidr_netmask=32

3. Group the network resources under vipgrp.

   # pcs resource group add vipgrp aliasip vip

Verification

1. Verify that the resources have started and are grouped under vipgrp.

   # pcs status

2. Verify that the resource can move to a different node.

   # pcs resource move vip Node

   Example:

   [root@rhel81-node-01 ~]# pcs resource move vip rhel81-node-03

3. Verify that the vip successfully started on a different node.

   # pcs status

Procedure

1. Create a secondary subnet address range.

   # gcloud compute networks subnets update SubnetName --region RegionName --add-secondary-ranges SecondarySubnetName=SecondarySubnetRange

   Example:

   # gcloud compute networks subnets update range0 --region us-west1 --add-secondary-ranges range1=10.10.20.0/24

2. Create the aliasip resource. Create an unused internal IP address in the secondary subnet address range. Include the CIDR block in the command.

   # pcs resource create aliasip gcp-vpc-move-vip alias_ip=UnusedIPaddress/CIDRblock

   Example:

   [root@rhel81-node-01 ~]# pcs resource create aliasip gcp-vpc-move-vip alias_ip=10.10.20.200/32

3. Create an IPaddr2 resource for managing the IP on the node.

   # pcs resource create vip IPaddr2 nic=interface ip=AliasIPaddress cidr_netmask=32

   Example:

   [root@rhel81-node-01 ~]# pcs resource create vip IPaddr2 nic=eth0 ip=10.10.20.200 cidr_netmask=32

4. Group the network resources under vipgrp.

   # pcs resource group add vipgrp aliasip vip

Verification

1. Verify that the resources have started and are grouped under vipgrp.

   # pcs status

2. Verify that the resource can move to a different node.

   # pcs resource move vip Node

   Example:

   [root@rhel81-node-01 ~]# pcs resource move vip rhel81-node-03

3. Verify that the vip successfully started on a different node.

   # pcs status