Deploying RHEL 9 on Microsoft Azure

1. Select the optimal cloud provider for your use case, based on your requirements and the current offer on the market.

   The cloud providers currently certified for running RHEL instances are:

   • Amazon Web Services (AWS)
   • Google Cloud Platform (GCP)

   • Microsoft Azure

     Note

     This document specifically talks about deploying RHEL on Microsoft Azure.

2. Create a RHEL cloud instance on your chosen cloud platform. For more information, see Methods for creating RHEL cloud instances.
3. To keep your RHEL deployment up-to-date, use Red Hat Update Infrastructure (RHUI).

Procedure

1. Convert the image from qcow2 to raw format.

   $ qemu-img convert -f qcow2 -O raw <image-name>.qcow2 <image-name>.raw

   Copy to Clipboard Toggle word wrap

2. Create a shell script with the following content.

   #!/bin/bash
   MB=$((1024 * 1024))
   size=$(qemu-img info -f raw --output json "$1" | gawk 'match($0, /"virtual-size": ([0-9]+),/, val) {print val[1]}')
   rounded_size=$((($size/$MB + 1) * $MB))
   if [ $(($size % $MB)) -eq  0 ]
   then
    echo "Your image is already aligned. You do not need to resize."
    exit 1
   fi
   echo "rounded size = $rounded_size"
   export rounded_size

   Copy to Clipboard Toggle word wrap

3. Run the script. This example uses the name align.sh.

   $ sh align.sh <image-xxx>.raw

   Copy to Clipboard Toggle word wrap
   • If the message "Your image is already aligned. You do not need to resize." displays, proceed to the following step.
   • If a value displays, your image is not aligned.

4. Use the following command to convert the file to a fixed VHD format.

   The sample uses qemu-img version 2.12.0.

   $ qemu-img convert -f raw -o subformat=fixed,force_size -O vpc <image-xxx>.raw <image.xxx>.vhd

   Copy to Clipboard Toggle word wrap

   Once converted, the VHD file is ready to upload to Azure.

5. If the raw image is not aligned, complete the following steps to align it.

   1. Resize the raw file by using the rounded value displayed when you ran the verification script.

      $ qemu-img resize -f raw <image-xxx>.raw <rounded-value>

      Copy to Clipboard Toggle word wrap

   2. Convert the raw image file to a VHD format.

      The sample uses qemu-img version 2.12.0.

      $ qemu-img convert -f raw -o subformat=fixed,force_size -O vpc <image-xxx>.raw <image.xxx>.vhd

      Copy to Clipboard Toggle word wrap

      Once converted, the VHD file is ready to upload to Azure.

Procedure

1. Import the Microsoft repository key.

   $ sudo rpm --import https://packages.microsoft.com/keys/microsoft.asc

   Copy to Clipboard Toggle word wrap

2. Create a local Azure CLI repository entry.

   $ sudo sh -c 'echo -e "[azure-cli]\nname=Azure CLI\nbaseurl=https://packages.microsoft.com/yumrepos/azure-cli\nenabled=1\ngpgcheck=1\ngpgkey=https://packages.microsoft.com/keys/microsoft.asc" > /etc/yum.repos.d/azure-cli.repo'

   Copy to Clipboard Toggle word wrap

3. Update the dnf package index.

   $ dnf check-update

   Copy to Clipboard Toggle word wrap

4. Check your Python version (python --version) and install Python 3.x, if necessary.

   $ sudo dnf install python3

   Copy to Clipboard Toggle word wrap

5. Install the Azure CLI.

   $ sudo dnf install -y azure-cli

   Copy to Clipboard Toggle word wrap

6. Run the Azure CLI.

   $ az

   Copy to Clipboard Toggle word wrap

Procedure

1. Authenticate your system with Azure and log in.

   $ az login

   Copy to Clipboard Toggle word wrap
   Note

   If a browser is available in your environment, the CLI opens your browser to the Azure sign-in page. See Sign in with Azure CLI for more information and options.

2. Create a resource group in an Azure region.

   $ az group create --name <resource-group> --location <azure-region>

   Copy to Clipboard Toggle word wrap

   Example:

   [clouduser@localhost]$ az group create --name azrhelclirsgrp --location southcentralus
   {
     "id": "/subscriptions//resourceGroups/azrhelclirsgrp",
     "location": "southcentralus",
     "managedBy": null,
     "name": "azrhelclirsgrp",
     "properties": {
       "provisioningState": "Succeeded"
     },
     "tags": null
   }

   Copy to Clipboard Toggle word wrap

3. Create a storage account. See SKU Types for more information about valid SKU values.

   $ az storage account create -l <azure-region> -n <storage-account-name> -g <resource-group> --sku <sku_type>

   Copy to Clipboard Toggle word wrap

   Example:

   [clouduser@localhost]$ az storage account create -l southcentralus -n azrhelclistact -g azrhelclirsgrp --sku Standard_LRS
   {
     "accessTier": null,
     "creationTime": "2017-04-05T19:10:29.855470+00:00",
     "customDomain": null,
     "encryption": null,
     "id": "/subscriptions//resourceGroups/azrhelclirsgrp/providers/Microsoft.Storage/storageAccounts/azrhelclistact",
     "kind": "StorageV2",
     "lastGeoFailoverTime": null,
     "location": "southcentralus",
     "name": "azrhelclistact",
     "primaryEndpoints": {
       "blob": "https://azrhelclistact.blob.core.windows.net/",
       "file": "https://azrhelclistact.file.core.windows.net/",
       "queue": "https://azrhelclistact.queue.core.windows.net/",
       "table": "https://azrhelclistact.table.core.windows.net/"
   },
   "primaryLocation": "southcentralus",
   "provisioningState": "Succeeded",
   "resourceGroup": "azrhelclirsgrp",
   "secondaryEndpoints": null,
   "secondaryLocation": null,
   "sku": {
     "name": "Standard_LRS",
     "tier": "Standard"
   },
   "statusOfPrimary": "available",
   "statusOfSecondary": null,
   "tags": {},
     "type": "Microsoft.Storage/storageAccounts"
   }

   Copy to Clipboard Toggle word wrap

4. Get the storage account connection string.

   $ az storage account show-connection-string -n <storage-account-name> -g <resource-group>

   Copy to Clipboard Toggle word wrap

   Example:

   [clouduser@localhost]$ az storage account show-connection-string -n azrhelclistact -g azrhelclirsgrp
   {
     "connectionString": "DefaultEndpointsProtocol=https;EndpointSuffix=core.windows.net;AccountName=azrhelclistact;AccountKey=NreGk...=="
   }

   Copy to Clipboard Toggle word wrap

5. Export the connection string by copying the connection string and pasting it into the following command. This string connects your system to the storage account.

   $ export AZURE_STORAGE_CONNECTION_STRING="<storage-connection-string>"

   Copy to Clipboard Toggle word wrap

   Example:

   [clouduser@localhost]$ export AZURE_STORAGE_CONNECTION_STRING="DefaultEndpointsProtocol=https;EndpointSuffix=core.windows.net;AccountName=azrhelclistact;AccountKey=NreGk...=="

   Copy to Clipboard Toggle word wrap

6. Create the storage container.

   $ az storage container create -n <container-name>

   Copy to Clipboard Toggle word wrap

   Example:

   [clouduser@localhost]$ az storage container create -n azrhelclistcont
   {
     "created": true
   }

   Copy to Clipboard Toggle word wrap

7. Create a virtual network.

   $ az network vnet create -g <resource group> --name <vnet-name> --subnet-name <subnet-name>

   Copy to Clipboard Toggle word wrap

   Example:

   [clouduser@localhost]$ az network vnet create --resource-group azrhelclirsgrp --name azrhelclivnet1 --subnet-name azrhelclisubnet1
   {
     "newVNet": {
       "addressSpace": {
         "addressPrefixes": [
         "10.0.0.0/16"
         ]
     },
     "dhcpOptions": {
       "dnsServers": []
     },
     "etag": "W/\"\"",
     "id": "/subscriptions//resourceGroups/azrhelclirsgrp/providers/Microsoft.Network/virtualNetworks/azrhelclivnet1",
     "location": "southcentralus",
     "name": "azrhelclivnet1",
     "provisioningState": "Succeeded",
     "resourceGroup": "azrhelclirsgrp",
     "resourceGuid": "0f25efee-e2a6-4abe-a4e9-817061ee1e79",
     "subnets": [
       {
         "addressPrefix": "10.0.0.0/24",
         "etag": "W/\"\"",
         "id": "/subscriptions//resourceGroups/azrhelclirsgrp/providers/Microsoft.Network/virtualNetworks/azrhelclivnet1/subnets/azrhelclisubnet1",
         "ipConfigurations": null,
         "name": "azrhelclisubnet1",
         "networkSecurityGroup": null,
         "provisioningState": "Succeeded",
         "resourceGroup": "azrhelclirsgrp",
         "resourceNavigationLinks": null,
         "routeTable": null
       }
     ],
     "tags": {},
     "type": "Microsoft.Network/virtualNetworks",
     "virtualNetworkPeerings": null
     }
   }

   Copy to Clipboard Toggle word wrap

Procedure

1. Upload the VHD file to the storage container. It may take several minutes. To get a list of storage containers, enter the az storage container list command.

   $ az storage blob upload \
       --account-name <storage-account-name> --container-name <container-name> \
       --type page --file <path-to-vhd> --name <image-name>.vhd

   Copy to Clipboard Toggle word wrap

   Example:

   [clouduser@localhost]$ az storage blob upload \
   --account-name azrhelclistact --container-name azrhelclistcont \
   --type page --file rhel-image-{ProductNumber}.vhd --name rhel-image-{ProductNumber}.vhd
   
   Percent complete: %100.0

   Copy to Clipboard Toggle word wrap

2. Get the URL for the uploaded VHD file to use in the following step.

   $ az storage blob url -c <container-name> -n <image-name>.vhd

   Copy to Clipboard Toggle word wrap

   Example:

   $ az storage blob url -c azrhelclistcont -n rhel-image-9.vhd "https://azrhelclistact.blob.core.windows.net/azrhelclistcont/rhel-image-9.vhd"

   Copy to Clipboard Toggle word wrap

3. Create the Azure custom image.

   $ az image create -n <image-name> -g <resource-group> -l <azure-region> --source <URL> --os-type linux

   Copy to Clipboard Toggle word wrap
   Note

   The default hypervisor generation of the VM is V1. You can optionally specify a V2 hypervisor generation by including the option --hyper-v-generation V2. Generation 2 VMs use a UEFI-based boot architecture. See Support for generation 2 VMs on Azure for information about generation 2 VMs.

   The command may return the error "Only blobs formatted as VHDs can be imported." This error may mean that the image was not aligned to the nearest 1 MB boundary before it was converted to VHD.

   Example:

   $ az image create -n rhel9 -g azrhelclirsgrp2 -l southcentralus --source https://azrhelclistact.blob.core.windows.net/azrhelclistcont/rhel-image-9.vhd --os-type linux

   Copy to Clipboard Toggle word wrap

Procedure

1. Enter the following command to create the VM.

   $ az vm create \
       -g <resource-group> -l <azure-region> -n <vm-name> \
       --vnet-name <vnet-name> --subnet <subnet-name> --size Standard_A2 \
       --os-disk-name <simple-name> --admin-username <administrator-name> \
       --generate-ssh-keys --image <path-to-image>

   Copy to Clipboard Toggle word wrap
   Note

   The option --generate-ssh-keys creates a private/public key pair. Private and public key files are created in ~/.ssh on your system. The public key is added to the authorized_keys file on the VM for the user specified by the --admin-username option. See Other authentication methods for additional information.

   Example:

   [clouduser@localhost]$ az vm create \
   -g azrhelclirsgrp2 -l southcentralus -n rhel-azure-vm-1 \
   --vnet-name azrhelclivnet1 --subnet azrhelclisubnet1 --size Standard_A2 \
   --os-disk-name vm-1-osdisk --admin-username clouduser \
   --generate-ssh-keys --image rhel9
   
   {
     "fqdns": "",
     "id": "/subscriptions//resourceGroups/azrhelclirsgrp/providers/Microsoft.Compute/virtualMachines/rhel-azure-vm-1",
     "location": "southcentralus",
     "macAddress": "",
     "powerState": "VM running",
     "privateIpAddress": "10.0.0.4",
     "publicIpAddress": "<public-IP-address>",
     "resourceGroup": "azrhelclirsgrp2"

   Copy to Clipboard Toggle word wrap

   Note the publicIpAddress. You need this address to log in to the VM in the following step.

2. Start an SSH session and log in to the VM.

   [clouduser@localhost]$ ssh -i /home/clouduser/.ssh/id_rsa clouduser@<public-IP-address>.
   The authenticity of host ',<public-IP-address>' can't be established.
   Are you sure you want to continue connecting (yes/no)? yes
   Warning: Permanently added '<public-IP-address>' (ECDSA) to the list of known hosts.
   
   [clouduser@rhel-azure-vm-1 ~]$

   Copy to Clipboard Toggle word wrap

Procedure

1. Register your system.

   # subscription-manager register

   Copy to Clipboard Toggle word wrap

2. Attach your subscriptions.

   • You can use an activation key to attach subscriptions. See Creating Red Hat Customer Portal Activation Keys for more information.
   • Also, you can manually attach a subscription by using the ID of subscription pool (Pool ID). See Attaching a host-based subscription to hypervisors.

3. Optional: To collect various system metrics about the instance in the Red Hat Hybrid Cloud Console, you can register the instance with Red Hat Insights.

   # insights-client register --display-name <display_name_value>

   Copy to Clipboard Toggle word wrap

   For information about further configuration of Red Hat Insights, see Client Configuration Guide for Red Hat Insights.

Procedure

1. Use the Gold Image to create a RHEL 9 VM in your Azure instance. For instructions, see Creating and starting the VM in Azure.
2. Start the created VM.

3. In the RHEL 9 VM, enable automatic registration.

   # subscription-manager config --rhsmcertd.auto_registration=1

   Copy to Clipboard Toggle word wrap

4. Enable the rhsmcertd service.

   # systemctl enable rhsmcertd.service

   Copy to Clipboard Toggle word wrap

5. Disable the redhat.repo repository.

   # subscription-manager config --rhsm.manage_repos=0

   Copy to Clipboard Toggle word wrap
6. Power off the VM, and save it as a managed image on Azure. For instructions, see How to create a managed image of a virtual machine or VHD.
7. Create VMs by using the managed image. They will be automatically subscribed to RHSM.

Procedure

1. Ensure that kdump and other necessary packages are installed on your system.

   # dnf install kexec-tools

   Copy to Clipboard Toggle word wrap

2. Verify that the default location for crash dump files is set in the kdump configuration file and that the /var/crash file is available.

   # grep -v "#" /etc/kdump.conf
   
   path /var/crash
   core_collector makedumpfile -l --message-level 7 -d 31

   Copy to Clipboard Toggle word wrap

3. Based on the size and version of your RHEL virtual machine (VM) instance, decide whether you need a vmcore target with more free space, such as /mnt/crash. To do so, use the following table.

   Expand

   Table 3.4. Virtual machine sizes that have been tested with GEN2 VM on Azure

   RHEL Version	Standard DS1 v2 (1 vCPU, 3.5GiB)	Standard NV16as v4 (16 vCPUs, 56 GiB)	Standard M416-208s v2 (208 vCPUs, 5700 GiB)	Standard M416ms v2 (416 vCPUs, 11400 GiB)
   RHEL 9.0 - RHEL 9.3	Default	Default	Target	Target

   Show more
   • Default indicates that kdump works as expected with the default memory and the default kdump target. The default kdump target is /var/crash.
   • Target indicates that kdump works as expected with the default memory. However, you might need to assign a target with more free space.

4. If your instance requires it, assign a target with more free space, such as /mnt/crash. To do so, edit the /etc/kdump.conf file and replace the default path.

   $ sed s/"path /var/crash"/"path /mnt/crash"

   Copy to Clipboard Toggle word wrap

   The option path /mnt/crash represents the path to the file system in which kdump saves the crash dump file.

   For more options, such as writing the crash dump file to a different partition, directly to a device or storing it to a remote machine, see Configuring the kdump target.

5. If your instance requires it, increase the crash kernel size to the sufficient size for kdump to capture the vmcore by adding the respective boot parameter.

   For example, for a Standard M416-208s v2 VM, the sufficient size is 512 MB, so the boot parameter would be crashkernel=512M.

   1. Open the GRUB configuration file and add crashkernel=512M to the boot parameter line.

      # vi /etc/default/grub
      
      GRUB_CMDLINE_LINUX="console=tty1 console=ttyS0 earlyprintk=ttyS0 rootdelay=300 crashkernel=512M"

      Copy to Clipboard Toggle word wrap

   2. Update the GRUB configuration file.

      • In RHEL 9.2 and earlier:

        # grub2-mkconfig -o /boot/grub2/grub.cfg

        Copy to Clipboard Toggle word wrap

      • In RHEL 9.3 and later:

        # grub2-mkconfig -o /boot/grub2/grub.cfg --update-bls-cmdline

        Copy to Clipboard Toggle word wrap
6. Reboot the VM to allocate separate kernel crash memory to the VM.

Procedure

1. Authenticate your system with Azure and log in.

   $ az login

   Copy to Clipboard Toggle word wrap
   Note

   If a browser is available in your environment, the CLI opens your browser to the Azure sign-in page.

   Example:

   [clouduser@localhost]$ az login
   
   To sign in, use a web browser to open the page https://aka.ms/devicelogin and enter the code FDMSCMETZ to authenticate.
     [
       {
         "cloudName": "AzureCloud",
         "id": "Subscription ID",
         "isDefault": true,
         "name": "MySubscriptionName",
         "state": "Enabled",
         "tenantId": "Tenant ID",
         "user": {
           "name": "clouduser@company.com",
           "type": "user"
         }
       }
     ]

   Copy to Clipboard Toggle word wrap

2. Create a resource group in an Azure region.

   $ az group create --name resource-group --location azure-region

   Copy to Clipboard Toggle word wrap

   Example:

   [clouduser@localhost]$ az group create --name azrhelclirsgrp --location southcentralus
   
   {
     "id": "/subscriptions//resourceGroups/azrhelclirsgrp",
     "location": "southcentralus",
     "managedBy": null,
     "name": "azrhelclirsgrp",
     "properties": {
       "provisioningState": "Succeeded"
     },
     "tags": null
   }

   Copy to Clipboard Toggle word wrap

3. Create a storage account.

   $ az storage account create -l azure-region -n storage-account-name -g resource-group --sku sku_type --kind StorageV2

   Copy to Clipboard Toggle word wrap

   Example:

   [clouduser@localhost]$ az storage account create -l southcentralus -n azrhelclistact -g azrhelclirsgrp --sku Standard_LRS --kind StorageV2
   
   {
     "accessTier": null,
     "creationTime": "2017-04-05T19:10:29.855470+00:00",
     "customDomain": null,
     "encryption": null,
     "id": "/subscriptions//resourceGroups/azrhelclirsgrp/providers/Microsoft.Storage/storageAccounts/azrhelclistact",
     "kind": "StorageV2",
     "lastGeoFailoverTime": null,
     "location": "southcentralus",
     "name": "azrhelclistact",
     "primaryEndpoints": {
       "blob": "https://azrhelclistact.blob.core.windows.net/",
       "file": "https://azrhelclistact.file.core.windows.net/",
       "queue": "https://azrhelclistact.queue.core.windows.net/",
       "table": "https://azrhelclistact.table.core.windows.net/"
   },
   "primaryLocation": "southcentralus",
   "provisioningState": "Succeeded",
   "resourceGroup": "azrhelclirsgrp",
   "secondaryEndpoints": null,
   "secondaryLocation": null,
   "sku": {
     "name": "Standard_LRS",
     "tier": "Standard"
   },
   "statusOfPrimary": "available",
   "statusOfSecondary": null,
   "tags": {},
     "type": "Microsoft.Storage/storageAccounts"
   }

   Copy to Clipboard Toggle word wrap

4. Get the storage account connection string.

   $ az storage account show-connection-string -n storage-account-name -g resource-group

   Copy to Clipboard Toggle word wrap

   Example:

   [clouduser@localhost]$ az storage account show-connection-string -n azrhelclistact -g azrhelclirsgrp
   {
     "connectionString": "DefaultEndpointsProtocol=https;EndpointSuffix=core.windows.net;AccountName=azrhelclistact;AccountKey=NreGk...=="
   }

   Copy to Clipboard Toggle word wrap

5. Export the connection string by copying the connection string and pasting it into the following command. This string connects your system to the storage account.

   $ export AZURE_STORAGE_CONNECTION_STRING="storage-connection-string"

   Copy to Clipboard Toggle word wrap

   Example:

   [clouduser@localhost]$ export AZURE_STORAGE_CONNECTION_STRING="DefaultEndpointsProtocol=https;EndpointSuffix=core.windows.net;AccountName=azrhelclistact;AccountKey=NreGk...=="

   Copy to Clipboard Toggle word wrap

6. Create the storage container.

   $ az storage container create -n container-name

   Copy to Clipboard Toggle word wrap

   Example:

   [clouduser@localhost]$ az storage container create -n azrhelclistcont
   
   {
     "created": true
   }

   Copy to Clipboard Toggle word wrap

7. Create a virtual network. All cluster nodes must be in the same virtual network.

   $ az network vnet create -g resource group --name vnet-name --subnet-name subnet-name

   Copy to Clipboard Toggle word wrap

   Example:

   [clouduser@localhost]$ az network vnet create --resource-group azrhelclirsgrp --name azrhelclivnet1 --subnet-name azrhelclisubnet1
   {
     "newVNet": {
       "addressSpace": {
         "addressPrefixes": [
         "10.0.0.0/16"
         ]
     },
     "dhcpOptions": {
       "dnsServers": []
     },
     "etag": "W/\"\"",
     "id": "/subscriptions//resourceGroups/azrhelclirsgrp/providers/Microsoft.Network/virtualNetworks/azrhelclivnet1",
     "location": "southcentralus",
     "name": "azrhelclivnet1",
     "provisioningState": "Succeeded",
     "resourceGroup": "azrhelclirsgrp",
     "resourceGuid": "0f25efee-e2a6-4abe-a4e9-817061ee1e79",
     "subnets": [
       {
         "addressPrefix": "10.0.0.0/24",
         "etag": "W/\"\"",
         "id": "/subscriptions//resourceGroups/azrhelclirsgrp/providers/Microsoft.Network/virtualNetworks/azrhelclivnet1/subnets/azrhelclisubnet1",
         "ipConfigurations": null,
         "name": "azrhelclisubnet1",
         "networkSecurityGroup": null,
         "provisioningState": "Succeeded",
         "resourceGroup": "azrhelclirsgrp",
         "resourceNavigationLinks": null,
         "routeTable": null
       }
     ],
     "tags": {},
     "type": "Microsoft.Network/virtualNetworks",
     "virtualNetworkPeerings": null
     }
   }

   Copy to Clipboard Toggle word wrap

8. Create an availability set. All cluster nodes must be in the same availability set.

   $ az vm availability-set create --name MyAvailabilitySet --resource-group MyResourceGroup

   Copy to Clipboard Toggle word wrap

   Example:

   [clouduser@localhost]$ az vm availability-set create --name rhelha-avset1 --resource-group azrhelclirsgrp
   {
     "additionalProperties": {},
       "id": "/subscriptions/.../resourceGroups/azrhelclirsgrp/providers/Microsoft.Compute/availabilitySets/rhelha-avset1",
       "location": "southcentralus",
       "name": “rhelha-avset1",
       "platformFaultDomainCount": 2,
       "platformUpdateDomainCount": 5,
   
   [omitted]

   Copy to Clipboard Toggle word wrap

Procedure

1. Enter the following grep command to determine if the required Hyper-V device drivers are installed.

   # lsinitrd | grep hv

   Copy to Clipboard Toggle word wrap

   In the example below, all required drivers are installed.

   # lsinitrd | grep hv
   drwxr-xr-x   2 root     root            0 Aug 12 14:21 usr/lib/modules/3.10.0-932.el9.x86_64/kernel/drivers/hv
   -rw-r--r--   1 root     root        31272 Aug 11 08:45 usr/lib/modules/3.10.0-932.el9.x86_64/kernel/drivers/hv/hv_vmbus.ko.xz
   -rw-r--r--   1 root     root        25132 Aug 11 08:46 usr/lib/modules/3.10.0-932.el9.x86_64/kernel/drivers/net/hyperv/hv_netvsc.ko.xz
   -rw-r--r--   1 root     root         9796 Aug 11 08:45 usr/lib/modules/3.10.0-932.el9.x86_64/kernel/drivers/scsi/hv_storvsc.ko.xz

   Copy to Clipboard Toggle word wrap

   If all the drivers are not installed, complete the remaining steps.

   Note

   An hv_vmbus driver may exist in the environment. Even if this driver is present, complete the following steps.

2. Create a file named hv.conf in /etc/dracut.conf.d.

3. Add the following driver parameters to the hv.conf file.

   add_drivers+=" hv_vmbus "
   add_drivers+=" hv_netvsc "
   add_drivers+=" hv_storvsc "
   add_drivers+=" nvme "

   Copy to Clipboard Toggle word wrap
   Note

   Note the spaces before and after the quotes, for example, add_drivers+=" hv_vmbus ". This ensures that unique drivers are loaded in the event that other Hyper-V drivers already exist in the environment.

4. Regenerate the initramfs image.

   # dracut -f -v --regenerate-all

   Copy to Clipboard Toggle word wrap

Verification

1. Reboot the machine.
2. Run the lsinitrd | grep hv command to verify that the drivers are installed.

Procedure

1. Log in to the VM.

2. Register the VM, and enable the Red Hat Enterprise Linux 9 repository.

   # subscription-manager register
   Installed Product Current Status:
   Product Name: Red Hat Enterprise Linux for x86_64
   Status: Subscribed

   Copy to Clipboard Toggle word wrap

3. Ensure that the cloud-init and hyperv-daemons packages are installed.

   # dnf install cloud-init hyperv-daemons -y

   Copy to Clipboard Toggle word wrap

4. Create cloud-init configuration files that are needed for integration with Azure services:

   1. To enable logging to the Hyper-V Data Exchange Service (KVP), create the /etc/cloud/cloud.cfg.d/10-azure-kvp.cfg configuration file and add the following lines to that file.

      reporting:
          logging:
              type: log
          telemetry:
              type: hyperv

      Copy to Clipboard Toggle word wrap

   2. To add Azure as a datasource, create the /etc/cloud/cloud.cfg.d/91-azure_datasource.cfg configuration file, and add the following lines to that file.

      datasource_list: [ Azure ]
      datasource:
          Azure:
              apply_network_config: False

      Copy to Clipboard Toggle word wrap

5. To ensure that specific kernel modules are blocked from loading automatically, edit or create the /etc/modprobe.d/blocklist.conf file and add the following lines to that file.

   blacklist nouveau
   blacklist lbm-nouveau
   blacklist floppy
   blacklist amdgpu
   blacklist skx_edac
   blacklist intel_cstate

   Copy to Clipboard Toggle word wrap

6. Modify udev network device rules:

   1. Remove the following persistent network device rules if present.

      # rm -f /etc/udev/rules.d/70-persistent-net.rules
      # rm -f /etc/udev/rules.d/75-persistent-net-generator.rules
      # rm -f /etc/udev/rules.d/80-net-name-slot-rules

      Copy to Clipboard Toggle word wrap

   2. To ensure that Accelerated Networking on Azure works as intended, create a new network device rule /etc/udev/rules.d/68-azure-sriov-nm-unmanaged.rules and add the following line to it.

      SUBSYSTEM=="net", DRIVERS=="hv_pci", ACTION=="add", ENV{NM_UNMANAGED}="1"

      Copy to Clipboard Toggle word wrap

7. Set the sshd service to start automatically.

   # systemctl enable sshd
   # systemctl is-enabled sshd

   Copy to Clipboard Toggle word wrap

8. Modify kernel boot parameters:

   1. Open the /etc/default/grub file, and ensure the GRUB_TIMEOUT line has the following value.

      GRUB_TIMEOUT=10

      Copy to Clipboard Toggle word wrap

   2. Remove the following options from the end of the GRUB_CMDLINE_LINUX line if present.

      rhgb quiet

      Copy to Clipboard Toggle word wrap

   3. Ensure the /etc/default/grub file contains the following lines with all the specified options.

      GRUB_CMDLINE_LINUX="loglevel=3 crashkernel=auto console=tty1 console=ttyS0 earlyprintk=ttyS0 rootdelay=300"
      GRUB_TIMEOUT_STYLE=countdown
      GRUB_TERMINAL="serial console"
      GRUB_SERIAL_COMMAND="serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1"

      Copy to Clipboard Toggle word wrap
      Note

      If you do not plan to run your workloads on HDDs, add elevator=none to the end of the GRUB_CMDLINE_LINUX line.

      This sets the I/O scheduler to none, which improves I/O performance when running workloads on SSDs.

   4. Regenerate the grub.cfg file.

      • On a BIOS-based machine:

        • In RHEL 9.2 and earlier:

          # grub2-mkconfig -o /boot/grub2/grub.cfg

          Copy to Clipboard Toggle word wrap

        • In RHEL 9.3 and later:

          # grub2-mkconfig -o /boot/grub2/grub.cfg --update-bls-cmdline

          Copy to Clipboard Toggle word wrap

      • On a UEFI-based machine:

        • In RHEL 9.2 and earlier:

          # grub2-mkconfig -o /boot/grub2/grub.cfg

          Copy to Clipboard Toggle word wrap

        • In RHEL 9.3 and later:

          # grub2-mkconfig -o /boot/grub2/grub.cfg --update-bls-cmdline

          Copy to Clipboard Toggle word wrap
          Warning

          The path to rebuild grub.cfg is same for both BIOS and UEFI based machines. Actual grub.cfg is present at BIOS path only. The UEFI path has a stub file that must not be modified or recreated using grub2-mkconfig command.

          If your system uses a non-default location for grub.cfg, adjust the command accordingly.

9. Configure the Windows Azure Linux Agent (WALinuxAgent):

   1. Install and enable the WALinuxAgent package.

      # dnf install WALinuxAgent -y
      # systemctl enable waagent

      Copy to Clipboard Toggle word wrap

   2. To ensure that a swap partition is not used in provisioned VMs, edit the following lines in the /etc/waagent.conf file.

      Provisioning.DeleteRootPassword=y
      ResourceDisk.Format=n
      ResourceDisk.EnableSwap=n

      Copy to Clipboard Toggle word wrap

10. Prepare the VM for Azure provisioning:

    1. Unregister the VM from Red Hat Subscription Manager.

       # subscription-manager unregister

       Copy to Clipboard Toggle word wrap

    2. Clean up the existing provisioning details.

       # waagent -force -deprovision

       Copy to Clipboard Toggle word wrap
       Note

       This command generates warnings, which are expected because Azure handles the provisioning of VMs automatically.

    3. Clean the shell history and shut down the VM.

       # export HISTSIZE=0
       # poweroff

       Copy to Clipboard Toggle word wrap

Procedure

1. On any node in the HA cluster, log in to your Azure account.

   $ az login

   Copy to Clipboard Toggle word wrap

2. Create a json configuration file for a custom role for the Azure fence agent. Use the following configuration, but replace <subscription-id> with your subscription IDs.

   {
         "Name": "Linux Fence Agent Role",
         "description": "Allows to power-off and start virtual machines",
         "assignableScopes": [
                 "/subscriptions/<subscription-id>"
         ],
         "actions": [
                 "Microsoft.Compute/*/read",
                 "Microsoft.Compute/virtualMachines/powerOff/action",
                 "Microsoft.Compute/virtualMachines/start/action"
         ],
         "notActions": [],
         "dataActions": [],
         "notDataActions": []
   }

   Copy to Clipboard Toggle word wrap

3. Define the custom role for the Azure fence agent. Use the json file created in the previous step to do this.

   $ az role definition create --role-definition azure-fence-role.json
   
   {
     "assignableScopes": [
       "/subscriptions/<my-subscription-id>"
     ],
     "description": "Allows to power-off and start virtual machines",
     "id": "/subscriptions/<my-subscription-id>/providers/Microsoft.Authorization/roleDefinitions/<role-id>",
     "name": "<role-id>",
     "permissions": [
       {
         "actions": [
           "Microsoft.Compute/*/read",
           "Microsoft.Compute/virtualMachines/powerOff/action",
           "Microsoft.Compute/virtualMachines/start/action"
         ],
         "dataActions": [],
         "notActions": [],
         "notDataActions": []
       }
     ],
     "roleName": "Linux Fence Agent Role",
     "roleType": "CustomRole",
     "type": "Microsoft.Authorization/roleDefinitions"
   }

   Copy to Clipboard Toggle word wrap
4. In the Azure web console interface, select Virtual Machine → Click Identity in the left-side menu.
5. Select On → Click Save → click Yes to confirm.
6. Click Azure role assignments → Add role assignment.
7. Select the Scope required for the role, for example Resource Group.
8. Select the required Resource Group.
9. Optional: Change the Subscription if necessary.
10. Select the Linux Fence Agent Role role.
11. Click Save.

Procedure

1. Convert the image from qcow2 to raw format.

   $ qemu-img convert -f qcow2 -O raw <image-name>.qcow2 <image-name>.raw

   Copy to Clipboard Toggle word wrap

2. Create a shell script with the following content.

   #!/bin/bash
   MB=$((1024 * 1024))
   size=$(qemu-img info -f raw --output json "$1" | gawk 'match($0, /"virtual-size": ([0-9]+),/, val) {print val[1]}')
   rounded_size=$((($size/$MB + 1) * $MB))
   if [ $(($size % $MB)) -eq  0 ]
   then
    echo "Your image is already aligned. You do not need to resize."
    exit 1
   fi
   echo "rounded size = $rounded_size"
   export rounded_size

   Copy to Clipboard Toggle word wrap

3. Run the script. This example uses the name align.sh.

   $ sh align.sh <image-xxx>.raw

   Copy to Clipboard Toggle word wrap
   • If the message "Your image is already aligned. You do not need to resize." displays, proceed to the following step.
   • If a value displays, your image is not aligned.

4. Use the following command to convert the file to a fixed VHD format.

   The sample uses qemu-img version 2.12.0.

   $ qemu-img convert -f raw -o subformat=fixed,force_size -O vpc <image-xxx>.raw <image.xxx>.vhd

   Copy to Clipboard Toggle word wrap

   Once converted, the VHD file is ready to upload to Azure.

5. If the raw image is not aligned, complete the following steps to align it.

   1. Resize the raw file by using the rounded value displayed when you ran the verification script.

      $ qemu-img resize -f raw <image-xxx>.raw <rounded-value>

      Copy to Clipboard Toggle word wrap

   2. Convert the raw image file to a VHD format.

      The sample uses qemu-img version 2.12.0.

      $ qemu-img convert -f raw -o subformat=fixed,force_size -O vpc <image-xxx>.raw <image.xxx>.vhd

      Copy to Clipboard Toggle word wrap

      Once converted, the VHD file is ready to upload to Azure.

Procedure

1. Upload the VHD file to the storage container. It may take several minutes. To get a list of storage containers, enter the az storage container list command.

   $ az storage blob upload \
       --account-name <storage-account-name> --container-name <container-name> \
       --type page --file <path-to-vhd> --name <image-name>.vhd

   Copy to Clipboard Toggle word wrap

   Example:

   [clouduser@localhost]$ az storage blob upload \
   --account-name azrhelclistact --container-name azrhelclistcont \
   --type page --file rhel-image-{ProductNumber}.vhd --name rhel-image-{ProductNumber}.vhd
   
   Percent complete: %100.0

   Copy to Clipboard Toggle word wrap

2. Get the URL for the uploaded VHD file to use in the following step.

   $ az storage blob url -c <container-name> -n <image-name>.vhd

   Copy to Clipboard Toggle word wrap

   Example:

   $ az storage blob url -c azrhelclistcont -n rhel-image-9.vhd "https://azrhelclistact.blob.core.windows.net/azrhelclistcont/rhel-image-9.vhd"

   Copy to Clipboard Toggle word wrap

3. Create the Azure custom image.

   $ az image create -n <image-name> -g <resource-group> -l <azure-region> --source <URL> --os-type linux

   Copy to Clipboard Toggle word wrap
   Note

   The default hypervisor generation of the VM is V1. You can optionally specify a V2 hypervisor generation by including the option --hyper-v-generation V2. Generation 2 VMs use a UEFI-based boot architecture. See Support for generation 2 VMs on Azure for information about generation 2 VMs.

   The command may return the error "Only blobs formatted as VHDs can be imported." This error may mean that the image was not aligned to the nearest 1 MB boundary before it was converted to VHD.

   Example:

   $ az image create -n rhel9 -g azrhelclirsgrp2 -l southcentralus --source https://azrhelclistact.blob.core.windows.net/azrhelclistcont/rhel-image-9.vhd --os-type linux

   Copy to Clipboard Toggle word wrap

Procedure

1. Launch an SSH terminal session and connect to the VM by using the administrator name and public IP address.

   $ ssh administrator@PublicIP

   Copy to Clipboard Toggle word wrap

   To get the public IP address for an Azure VM, open the VM properties in the Azure Portal or enter the following Azure CLI command.

   $ az vm list -g <resource_group> -d --output table

   Copy to Clipboard Toggle word wrap

   Example:

   [clouduser@localhost ~] $ az vm list -g azrhelclirsgrp -d --output table
   Name    ResourceGroup           PowerState      PublicIps        Location
   ------  ----------------------  --------------  -------------    --------------
   node01  azrhelclirsgrp          VM running      192.98.152.251    southcentralus

   Copy to Clipboard Toggle word wrap

2. Register the VM with Red Hat.

   $ sudo -i
   # subscription-manager register

   Copy to Clipboard Toggle word wrap

3. Disable all repositories.

   # subscription-manager repos --disable=*

   Copy to Clipboard Toggle word wrap

4. Enable the RHEL 9 Server HA repositories.

   # subscription-manager repos --enable=rhel-9-for-x86_64-highavailability-rpms

   Copy to Clipboard Toggle word wrap

5. Update all packages.

   # dnf update -y

   Copy to Clipboard Toggle word wrap

6. Install the Red Hat High Availability Add-On software packages, along with the Azure fencing agent from the High Availability channel.

   # dnf install pcs pacemaker fence-agents-azure-arm

   Copy to Clipboard Toggle word wrap

7. The user hacluster was created during the pcs and pacemaker installation in the last step. Create a password for hacluster on all cluster nodes. Use the same password for all nodes.

   # passwd hacluster

   Copy to Clipboard Toggle word wrap

8. Add the high availability service to the RHEL Firewall if firewalld.service is installed.

   # firewall-cmd --permanent --add-service=high-availability
   # firewall-cmd --reload

   Copy to Clipboard Toggle word wrap

9. Start the pcs service and enable it to start on boot.

   # systemctl start pcsd.service
   # systemctl enable pcsd.service
   
   Created symlink from /etc/systemd/system/multi-user.target.wants/pcsd.service to /usr/lib/systemd/system/pcsd.service.

   Copy to Clipboard Toggle word wrap

Procedure

1. On one of the nodes, enter the following command to authenticate the pcs user hacluster. In the command, specify the name of each node in the cluster.

   # pcs host auth <hostname1> <hostname2> <hostname3>

   Copy to Clipboard Toggle word wrap

   Example:

   [root@node01 clouduser]# pcs host auth node01 node02 node03
   Username: hacluster
   Password:
   node01: Authorized
   node02: Authorized
   node03: Authorized

   Copy to Clipboard Toggle word wrap

2. Create the cluster.

   # pcs cluster setup <cluster_name> <hostname1> <hostname2> <hostname3>

   Copy to Clipboard Toggle word wrap

   Example:

   [root@node01 clouduser]# pcs cluster setup new_cluster node01 node02 node03
   
   [...]
   
   Synchronizing pcsd certificates on nodes node01, node02, node03...
   node02: Success
   node03: Success
   node01: Success
   Restarting pcsd on the nodes in order to reload the certificates...
   node02: Success
   node03: Success
   node01: Success

   Copy to Clipboard Toggle word wrap

Verification

1. Enable the cluster.

   [root@node01 clouduser]# pcs cluster enable --all
   node02: Cluster Enabled
   node03: Cluster Enabled
   node01: Cluster Enabled

   Copy to Clipboard Toggle word wrap

2. Start the cluster.

   [root@node01 clouduser]# pcs cluster start --all
   node02: Starting Cluster...
   node03: Starting Cluster...
   node01: Starting Cluster...

   Copy to Clipboard Toggle word wrap

Procedure

1. Identify the Azure node name for each RHEL VM. You use the Azure node names to configure the fence device.

   # fence_azure_arm \
       -l <AD-Application-ID> -p <AD-Password> \
       --resourceGroup <MyResourceGroup> --tenantId <Tenant-ID> \
       --subscriptionId <Subscription-ID> -o list

   Copy to Clipboard Toggle word wrap

   Example:

   [root@node01 clouduser]# fence_azure_arm \
   -l e04a6a49-9f00-xxxx-xxxx-a8bdda4af447 -p z/a05AwCN0IzAjVwXXXXXXXEWIoeVp0xg7QT//JE=
   --resourceGroup azrhelclirsgrp --tenantId 77ecefb6-cff0-XXXX-XXXX-757XXXX9485
   --subscriptionId XXXXXXXX-38b4-4527-XXXX-012d49dfc02c -o list
   
   node01,
   node02,
   node03,

   Copy to Clipboard Toggle word wrap

2. View the options for the Azure ARM STONITH agent.

   # pcs stonith describe fence_azure_arm

   Copy to Clipboard Toggle word wrap

   Example:

   # pcs stonith describe fence_apc
   Stonith options:
   password: Authentication key
   password_script: Script to run to retrieve password

   Copy to Clipboard Toggle word wrap
   Warning

   For fence agents that provide a method option, do not specify a value of cycle as it is not supported and can cause data corruption.

   Some fence devices can fence only a single node, while other devices can fence multiple nodes. The parameters you specify when you create a fencing device depend on what your fencing device supports and requires.

   You can use the pcmk_host_list parameter when creating a fencing device to specify all of the machines that are controlled by that fencing device.

   You can use pcmk_host_map parameter when creating a fencing device to map host names to the specifications that comprehends the fence device.

3. Create a fence device.

   # pcs stonith create clusterfence fence_azure_arm

   Copy to Clipboard Toggle word wrap
4. To ensure immediate and complete fencing, disable ACPI Soft-Off on all cluster nodes. For information about disabling ACPI Soft-Off, see Disabling ACPI for use with integrated fence device.

Verification

1. Test the fencing agent for one of the other nodes.

   # pcs stonith fence azurenodename

   Copy to Clipboard Toggle word wrap

   Example:

   [root@node01 clouduser]# pcs status
   Cluster name: newcluster
   Stack: corosync
   Current DC: node01 (version 1.1.18-11.el7-2b07d5c5a9) - partition with quorum
   Last updated: Fri Feb 23 11:44:35 2018
   Last change: Fri Feb 23 11:21:01 2018 by root via cibadmin on node01
   
   3 nodes configured
   1 resource configured
   
   Online: [ node01 node03 ]
   OFFLINE: [ node02 ]
   
   Full list of resources:
   
     clusterfence  (stonith:fence_azure_arm):  Started node01
   
   Daemon Status:
     corosync: active/disabled
     pacemaker: active/disabled
     pcsd: active/enabled

   Copy to Clipboard Toggle word wrap

2. Start the node that was fenced in the previous step.

   # pcs cluster start <hostname>

   Copy to Clipboard Toggle word wrap

3. Check the status to verify the node started.

   # pcs status

   Copy to Clipboard Toggle word wrap

   Example:

   [root@node01 clouduser]# pcs status
   Cluster name: newcluster
   Stack: corosync
   Current DC: node01 (version 1.1.18-11.el7-2b07d5c5a9) - partition with quorum
   Last updated: Fri Feb 23 11:34:59 2018
   Last change: Fri Feb 23 11:21:01 2018 by root via cibadmin on node01
   
   3 nodes configured
   1 resource configured
   
   Online: [ node01 node02 node03 ]
   
   Full list of resources:
   
   clusterfence    (stonith:fence_azure_arm):  Started node01
   
   Daemon Status:
     corosync: active/disabled
     pacemaker: active/disabled
     pcsd: active/enabled

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a Basic load balancer. Select Internal load balancer, the Basic SKU, and Dynamic for the type of IP address assignment.
2. Create a back-end address pool. Associate the backend pool to the availability set created while creating Azure resources in HA. Do not set any target network IP configurations.
3. Create a health probe. For the health probe, select TCP and enter port 61000. You can use TCP port number that does not interfere with another service. For certain HA product applications (for example, SAP HANA and SQL Server), you may need to work with Microsoft to identify the correct port to use.
4. Create a load balancer rule. To create the load balancing rule, the default values are prepopulated. Ensure to set Floating IP (direct server return) to Enabled.

Procedure

1. Install the nmap-ncat resource agents on all nodes.

   # dnf install nmap-ncat resource-agents-cloud

   Copy to Clipboard Toggle word wrap

   Perform the following steps on a single node.

2. Create the pcs resources and group. Use your load balancer FrontendIP for the IPaddr2 address.

   # pcs resource create resource-name IPaddr2 ip="10.0.0.7" --group cluster-resources-group

   Copy to Clipboard Toggle word wrap

3. Configure the load balancer resource agent.

   # pcs resource create resource-loadbalancer-name azure-lb port=port-number --group cluster-resources-group

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a shared block volume by using the Azure command az disk create.

   $ az disk create -g <resource_group> -n <shared_block_volume_name> --size-gb <disk_size> --max-shares <number_vms> -l <location>

   Copy to Clipboard Toggle word wrap

   For example, the following command creates a shared block volume named shared-block-volume.vhd in the resource group sharedblock within the Azure Availability Zone westcentralus.

   $ az disk create -g sharedblock-rg -n shared-block-volume.vhd --size-gb 1024 --max-shares 3 -l westcentralus
   
   {
     "creationData": {
       "createOption": "Empty",
       "galleryImageReference": null,
       "imageReference": null,
       "sourceResourceId": null,
       "sourceUniqueId": null,
       "sourceUri": null,
       "storageAccountId": null,
       "uploadSizeBytes": null
     },
     "diskAccessId": null,
     "diskIopsReadOnly": null,
     "diskIopsReadWrite": 5000,
     "diskMbpsReadOnly": null,
     "diskMbpsReadWrite": 200,
     "diskSizeBytes": 1099511627776,
     "diskSizeGb": 1024,
     "diskState": "Unattached",
     "encryption": {
       "diskEncryptionSetId": null,
       "type": "EncryptionAtRestWithPlatformKey"
     },
     "encryptionSettingsCollection": null,
     "hyperVgeneration": "V1",
     "id": "/subscriptions/12345678910-12345678910/resourceGroups/sharedblock-rg/providers/Microsoft.Compute/disks/shared-block-volume.vhd",
     "location": "westcentralus",
     "managedBy": null,
     "managedByExtended": null,
     "maxShares": 3,
     "name": "shared-block-volume.vhd",
     "networkAccessPolicy": "AllowAll",
     "osType": null,
     "provisioningState": "Succeeded",
     "resourceGroup": "sharedblock-rg",
     "shareInfo": null,
     "sku": {
       "name": "Premium_LRS",
       "tier": "Premium"
     },
     "tags": {},
     "timeCreated": "2020-08-27T15:36:56.263382+00:00",
     "type": "Microsoft.Compute/disks",
     "uniqueId": "cd8b0a25-6fbe-4779-9312-8d9cbb89b6f2",
     "zones": null
   }

   Copy to Clipboard Toggle word wrap

2. Verify that you have created the shared block volume by using the Azure command az disk show.

   $ az disk show -g <resource_group> -n <shared_block_volume_name>

   Copy to Clipboard Toggle word wrap

   For example, the following command shows details for the shared block volume shared-block-volume.vhd within the resource group sharedblock-rg.

   $ az disk show -g sharedblock-rg -n shared-block-volume.vhd
   
   {
     "creationData": {
       "createOption": "Empty",
       "galleryImageReference": null,
       "imageReference": null,
       "sourceResourceId": null,
       "sourceUniqueId": null,
       "sourceUri": null,
       "storageAccountId": null,
       "uploadSizeBytes": null
     },
     "diskAccessId": null,
     "diskIopsReadOnly": null,
     "diskIopsReadWrite": 5000,
     "diskMbpsReadOnly": null,
     "diskMbpsReadWrite": 200,
     "diskSizeBytes": 1099511627776,
     "diskSizeGb": 1024,
     "diskState": "Unattached",
     "encryption": {
       "diskEncryptionSetId": null,
       "type": "EncryptionAtRestWithPlatformKey"
     },
     "encryptionSettingsCollection": null,
     "hyperVgeneration": "V1",
     "id": "/subscriptions/12345678910-12345678910/resourceGroups/sharedblock-rg/providers/Microsoft.Compute/disks/shared-block-volume.vhd",
     "location": "westcentralus",
     "managedBy": null,
     "managedByExtended": null,
     "maxShares": 3,
     "name": "shared-block-volume.vhd",
     "networkAccessPolicy": "AllowAll",
     "osType": null,
     "provisioningState": "Succeeded",
     "resourceGroup": "sharedblock-rg",
     "shareInfo": null,
     "sku": {
       "name": "Premium_LRS",
       "tier": "Premium"
     },
     "tags": {},
     "timeCreated": "2020-08-27T15:36:56.263382+00:00",
     "type": "Microsoft.Compute/disks",
     "uniqueId": "cd8b0a25-6fbe-4779-9312-8d9cbb89b6f2",
     "zones": null
   }

   Copy to Clipboard Toggle word wrap

3. Create three network interfaces by using the Azure command az network nic create. Run the following command three times by using a different <nic_name> for each.

   $ az network nic create \
       -g <resource_group> -n <nic_name> --subnet <subnet_name> \
       --vnet-name <virtual_network> --location <location> \
       --network-security-group <network_security_group> --private-ip-address-version IPv4

   Copy to Clipboard Toggle word wrap

   For example, the following command creates a network interface with the name shareblock-nodea-vm-nic-protected.

   $ az network nic create \
       -g sharedblock-rg -n sharedblock-nodea-vm-nic-protected --subnet sharedblock-subnet-protected \
       --vnet-name sharedblock-vn --location westcentralus \
       --network-security-group sharedblock-nsg --private-ip-address-version IPv4

   Copy to Clipboard Toggle word wrap

4. Create three VMs and attach the shared block volume by using the Azure command az vm create. Option values are the same for each VM except that each VM has its own <vm_name>, <new_vm_disk_name>, and <nic_name>.

   $ az vm create \
       -n <vm_name> -g <resource_group> --attach-data-disks <shared_block_volume_name> \
       --data-disk-caching None --os-disk-caching ReadWrite --os-disk-name <new-vm-disk-name> \
       --os-disk-size-gb <disk_size> --location <location> --size <virtual_machine_size> \
       --image <image_name> --admin-username <vm_username> --authentication-type ssh \
       --ssh-key-values <ssh_key> --nics <nic_name> --availability-set <availability_set> --ppg <proximity_placement_group>

   Copy to Clipboard Toggle word wrap

   For example, the following command creates a VM named sharedblock-nodea-vm.

   $ az vm create \
   -n sharedblock-nodea-vm -g sharedblock-rg --attach-data-disks shared-block-volume.vhd \
   --data-disk-caching None --os-disk-caching ReadWrite --os-disk-name sharedblock-nodea-vm.vhd \
   --os-disk-size-gb 64 --location westcentralus --size Standard_D2s_v3 \
   --image /subscriptions/12345678910-12345678910/resourceGroups/sample-azureimagesgroupwestcentralus/providers/Microsoft.Compute/images/sample-azure-rhel-9.3.0-20200713.n.0.x86_64 --admin-username sharedblock-user --authentication-type ssh \
   --ssh-key-values @sharedblock-key.pub --nics sharedblock-nodea-vm-nic-protected --availability-set sharedblock-as --ppg sharedblock-ppg
   
   {
     "fqdns": "",
     "id": "/subscriptions/12345678910-12345678910/resourceGroups/sharedblock-rg/providers/Microsoft.Compute/virtualMachines/sharedblock-nodea-vm",
     "location": "westcentralus",
     "macAddress": "00-22-48-5D-EE-FB",
     "powerState": "VM running",
     "privateIpAddress": "198.51.100.3",
     "publicIpAddress": "",
     "resourceGroup": "sharedblock-rg",
     "zones": ""
   }

   Copy to Clipboard Toggle word wrap

Verification

1. For each VM in your cluster, verify that the block device is available by using the ssh command with your VM’s IP address.

   # ssh <ip_address> "hostname ; lsblk -d | grep ' 1T '"

   Copy to Clipboard Toggle word wrap

   For example, the following command lists details including the host name and block device for the VM IP 198.51.100.3.

   # ssh 198.51.100.3 "hostname ; lsblk -d | grep ' 1T '"
   
   nodea
   sdb    8:16   0    1T  0 disk

   Copy to Clipboard Toggle word wrap

2. Use the ssh command to verify that each VM in your cluster uses the same shared disk.

   # ssh <ip_address> "hostname ; lsblk -d | grep ' 1T ' | awk '{print \$1}' | xargs -i udevadm info --query=all --name=/dev/{} | grep '^E: ID_SERIAL='"

   Copy to Clipboard Toggle word wrap

   For example, the following command lists details including the host name and shared disk volume ID for the instance IP address 198.51.100.3.

   # ssh 198.51.100.3 "hostname ; lsblk -d | grep ' 1T ' | awk '{print \$1}' | xargs -i udevadm info --query=all --name=/dev/{} | grep '^E: ID_SERIAL='"
   
   nodea
   E: ID_SERIAL=3600224808dd8eb102f6ffc5822c41d89

   Copy to Clipboard Toggle word wrap

Procedure

1. Generate a custom certificate custom_db.cer by using the openssl utility:

   $ openssl req -quiet \
   -newkey rsa:4096 \
   -nodes -keyout custom_db.key \
   -new -x509 \
   -sha256 -days 3650 \
   -subj "/CN=Signature Database key/" \
   --outform DER \
   -out custom_db.cer

   Copy to Clipboard Toggle word wrap

2. Convert the certificate into base64-encoded format:

   $ echo base64 -w0 custom_db.cer
   
   MIIFIjCCAwqgAwIBAgITNf23J4k0d8c0NR ....

   Copy to Clipboard Toggle word wrap

3. Create and edit an azure-example-template.json Azure Resource Manager (ARM) file for registering a new Azure Compute Gallery image version:

   $ vi azure-example-template.json
   
   {
       "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
       "contentVersion": "1.0.0.0",
       "resources": [
           {
               "type": "Microsoft.Compute/galleries/images/versions",
               "apiVersion": "2023-07-03",
               "name": "<your compute gallery/your image definition/version>",
               "location": "<location of the VHD>",
               "properties": {
                   "storageProfile": {
                       "osDiskImage": {
                           "source": {
                               "id": "<your-storage-account-id>",
                               "uri": "<url-with-the-vhd>"
                           },
                           "hostCaching": "ReadOnly"
                       }
                   },
                   "securityProfile": {
                       "uefiSettings": {
                           "signatureTemplateNames": [
                               "MicrosoftUefiCertificateAuthorityTemplate"
                           ],
                           "additionalSignatures": {
                               "db": [
                                   {
                                       "type": "x509",
                                       "value": [
                                           "<base64 of custom_db.cer>"
                                       ]
                                   }
                               ]
                           }
                       }
                   }
               }
           }
       ]
   }

   Copy to Clipboard Toggle word wrap

4. Use the azure-cli utility to register the image version:

   $ az deployment group create --name <example-deployment> \
   --resource-group <example-resource-group> \
   --template-file <example-template.json>

   Copy to Clipboard Toggle word wrap
5. Reboot the instance from the Azure Portal.

Verification

1. Check if the newly created RHEL instance has Secure Boot enabled:

   $ mokutil --sb-state
   SecureBoot enabled

   Copy to Clipboard Toggle word wrap

2. Use the keyctl utility to verify the kernel keyring for the custom certificate:

   $ sudo keyctl list %:.platform
   
   keys in keyring:
   ...
   586621657: ---lswrv   0   0
   asymmetric: Signature Database key: f064979641c24e1b935e402bdbc3d5c4672a1acc
   ...

   Copy to Clipboard Toggle word wrap