Chapter 8. Red Hat Cloud Access program overview

Gold images are useful when you require little customization of the operating system or you will apply your customizations to the system at runtime, using an automation tool, such as Red Hat Ansible Automation Platform.

Gold images are less useful if you require extreme customization of the operating system at build time, or if you prefer to include the customizations into the image itself. For example, many security hardening specifications, such the the DISA STIG require users to have exacting partition layouts. Gold images will generally not meet these requirements by default. It is recommended that RHEL image builder be used to create custom images for these types of stringent requirements.

To link your cloud provider account with your Red Hat account, there are two methods generally used:

Depending on the cloud provider or environment you have selected, some methods might not be available, as shown in the table below:

Options for delivering updates and patches to cloud instances deployed from gold images vary by image type and cloud provider.

There are multiple ways to search for and launch RHEL Amazon Machine Images (AMIs) in AWS. This includes the EC2 Management Console, AWS CLI, and PowerShell Cmdlet. The naming convention for the Red Hat AMIs in AWS is listed below.

Red Hat gold images are published under the Owner ID 309956199498. You can ensure that you are using official Red Hat gold images by looking for this Owner ID when you choose an image.

This example command displays all of the RHEL 8.3 AMIs in the US-East-1 region that were shared with the AWS account provided during enrollment in Cloud Access using the AWS CLI. The AWS CLI Command Reference provides additional documentation regarding available options, commands, subcommands, and parameters.

$ aws ec2 describe-images --owners 309956199498 \
> --filters "Name=is-public,Values=false" \>
"Name=name,Values=RHEL*8.3*GA*Access*" \
> --region us-east-1

When working in the EC2 Management Console, there is a menu item for AMIs under the IMAGES section within the left-side navigation pane. In this view, using the designation of Private images displays the gold images that have been shared with the AWS account provided during enrollment.

It is possible to further filter the list of displayed AMIs by adding an additional filter representing different aspects of the AMI Name that Red Hat uses, such as AMI Name : RHEL, AMI Name :.

An example AMI Name is RHEL-8.3.0_HVM-20201031-x86_64-0-Access2-GP2.

If you use the Launch Instance button from the EC2 Dashboard section of the EC2 Management Console and you select My AMIs, the filter Shared with me filters the listed AMIs to show the gold images that have been shared with the AWS account provided during enrollment.

This example command displays all of the RHEL 8.3 AMIs in the US-East-1 region that were shared with the AWS account provided during enrollment in Cloud Access using the AWS Tools for Cmdlet.

PS > Get-EC2Image -Region us-east-1 `
>> -Owner 309956199498 -Filter `
>> @{ Name="name" ; Values="RHEL*8.3*" }

There are multiple ways to search for and launch RHEL gold images in Azure. This includes the Azure Portal, Azure CLI, and PowerShell Cmdlet. The naming convention for the Red Hat gold images in Azure is RedHat:[Offering Name]:[Red Hat Product]-[OS Disk Type]-[Azure VM Generation]:[Red Hat Version].[Red Hat Release].[Image Creation Date].

An example gold image Uniform Resource Name (URN) is RedHat:rhel-byos:rhel-lvm8-gen2:8.0.20200715.

If you want to complete registration in Azure with an Ansible script, use the following steps:

You can use the Integrations configuration dashboard to view, modify, or remove any of your cloud integrations. This dashboard also provides links where you can learn more about related Red Hat services, such as Insights and the subscriptions service.

This example command displays all of the RHEL gold images in the US East region that were shared with the Azure account provided during enrollment in Cloud Access.

Get-AzVMImageSku -Location "East US" -PublisherName RedHat -Offer rhel-byos

After your Google group has been granted access to the Google Cloud gold images, you will be able to find them in the rhel-byos-cloud google project. This is a special project that limits access to the RHEL gold images for only Cloud Access customers.

The naming convention for Red Hat gold images in Google Cloud is: [Red Hat Product]-[Version]-byos-[Image Creation Date].

Examples:

Using the Google Cloud shell or gcloud CLI

Amazon Web Services (AWS), Microsoft Azure, and Google Government. Disconnected regions (such as AWS GovCloud or Microsoft Azure Government) do not support auto-registration.

Red Hat Enterprise Linux versions 7.9.z, 8.3.1, 9.0 or newer all support auto-registration.

You can confirm if your system is using auto-registration by running the subscription-manager config command, which displays the contents of /etc/rhsm/rhsm.conf

[server]

hostname = [subscription.rhsm.redhat.com]
insecure = [0]
no_proxy = []
port = [443]
prefix = [/subscription]
proxy_hostname = []
proxy_password = []
proxy_port = []
proxy_scheme = [http]
proxy_user = []
server_timeout = [180]
ssl_verify_depth = [3]

[rhsm]

auto_enable_yum_plugins = [1]
baseurl = [https://cdn.redhat.com]
ca_cert_dir = [/etc/rhsm/ca/]
consumercertdir = [/etc/pki/consumer]
entitlementcertdir = [/etc/pki/entitlement]
full_refresh_on_yum = [0]
inotify = [1]
manage_repos = 0
package_profile_on_trans = [0]
pluginconfdir = [/etc/rhsm/pluginconf.d]
plugindir = [/usr/share/rhsm-plugins]
productcertdir = [/etc/pki/product]
repo_ca_cert = /etc/rhsm/ca/redhat-uep.pem
repomd_gpg_url = []
report_package_profile = [1]

[rhsmcertd]

auto_registration = 1
auto_registration_interval = [60]
autoattachinterval = [1440]
certcheckinterval = [240]
disable = [0]
splay = [1]

[logging]
default_log_level = [INFO]

[] - Default value in use

Of note, there are four key settings:

Once a system has been registered, the system can be configured to use the Insights services by running either the insights-client -register command OR by running the rhc connect command. Depending on your version of Red Hat Enterprise Linux and the configuration of your cloud images, the redhat-cloud-client-configuration package may be installed. In this scenario, it is not necessary to run a command to configure the system to use the Insights services. This is done automatically in that case.