12 commits - ec2/fedora-18-i386-ec2.ks ec2/fedora-18-x86_64-ec2.ks generic/fedora-18-x86_64-cloud.ks generic/fedora-18-x86_64.ks generic/fedora-18-x86_64-minimal.ks
by Matthew Miller
ec2/fedora-18-i386-ec2.ks | 150 +++++++++++++++++++++++------------
ec2/fedora-18-x86_64-ec2.ks | 151 +++++++++++++++++++++++-------------
generic/fedora-18-x86_64-cloud.ks | 83 +------------------
generic/fedora-18-x86_64-minimal.ks | 11 +-
generic/fedora-18-x86_64.ks | 11 +-
5 files changed, 218 insertions(+), 188 deletions(-)
New commits:
commit c6c5db46b8dcade0f6e621c9efe9ec07416cb7ba
Author: Matthew Miller <mattdm(a)mattdm.org>
Date: Thu Dec 20 15:37:32 2012 -0500
copy new stuff to i386, too
diff --git a/ec2/fedora-18-i386-ec2.ks b/ec2/fedora-18-i386-ec2.ks
index 742fec6..1f0dcbb 100644
--- a/ec2/fedora-18-i386-ec2.ks
+++ b/ec2/fedora-18-i386-ec2.ks
@@ -1,81 +1,129 @@
-# Build a basic Fedora 18 AMI
+# This is a basic Fedora 18 spin designed to work in Amazon EC2.
+# It's configured with cloud-init so it will take advantage of
+# ec2-compatible metadata services for provisioning ssh keys. That also
+# currently creates an ec2-user account; we'll probably want to make that
+# something generic by default. The root password is empty by default.
+#
+# Note that unlike the standard F18 install, this image has /tmp on disk
+# rather than in tmpfs, since memory is usually at a premium.
+#
+# It additionally configures _no_ local firewall, in line with EC2
+# recommendations that security groups be used instead.
+
+
+
lang en_US.UTF-8
keyboard us
timezone --utc America/New_York
+
auth --useshadow --enablemd5
selinux --enforcing
-firewall --service=ssh
-bootloader --timeout=1 --location=mbr --driveorder=sda
-network --bootproto=dhcp --device=eth0 --onboot=on
-services --enabled=network,sshd,rsyslog
-# By default the root password is emptied
+firewall --disabled
-#
-# Define how large you want your rootfs to be
-# NOTE: S3-backed AMIs have a limit of 10G
-#
-part / --size 10000 --fstype ext4 --ondisk sda
+bootloader --timeout=0 --location=mbr --driveorder=sda
+
+network --bootproto=dhcp --device=eth0 --onboot=on
+services --enabled=network,sshd,rsyslog,iptables,cloud-init,cloud-init-local,cloud-config,cloud-final
+
+# This would let fussy grub2 install, but will break in EC2
+#part biosboot --fstype=biosboot --size=1 --ondisk sda
+part / --size 4096 --fstype ext4 --ondisk sda
-#
# Repositories
repo --name=fedora --mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=fedora-18&arch=$basearch
-#
-#
-# Add all the packages after the base packages
-#
+
+# Package list.
%packages --nobase
@core
-pciutils
kernel-PAE
-man-db
-firewalld
-
--biosdevname
-# package to setup cloudy bits for us
+# cloud-init does magical things with EC2 metadata, including provisioning
+# a user account with ssh keys.
cloud-init
-%end
+# Needed initially, but removed below.
+firewalld
-# more ec2-ify
-%post --erroronfail
+# cherry-pick a few things from @standard
+tmpwatch
+tar
+rsync
-# fstab mounting is different for x86_64 and i386
-cat <<EOL > /etc/fstab
-LABEL=_/ / ext4 defaults 1 1
-proc /proc proc defaults 0 0
-sysfs /sys sysfs defaults 0 0
-devpts /dev/pts devpts gid=5,mode=620 0 0
-tmpfs /dev/shm tmpfs defaults 0 0
-EOL
-if [ ! -d /lib64 ] ; then
+# Some things from @core we can do without in a minimal install
+-biosdevname
+-plymouth
+-NetworkManager
+-polkit
-cat <<EOL >> /etc/fstab
-/dev/xvda3 swap swap defaults 0 0
-EOL
+%end
-# workaround xen performance issue (bz 651861)
-echo "hwcap 1 nosegneg" > /etc/ld.so.conf.d/libc6-xen.conf
-fi
-# idle=nomwait is to allow xen images to boot and not try use cpu features that are not supported
-# grub tweaks
-sed -i -e 's/timeout=5/timeout=0/' \
- -e 's|root=[^ ]\+|root=LABEL=_/ idle=halt|' \
- -e '/splashimage/d' \
- /boot/grub/grub.conf
+%post --erroronfail
-# symlink grub.conf to menu.lst for use by EC2 pv-grub
-pushd /boot/grub
-ln -s grub.conf menu.lst
-popd
+echo -n "Writing fstab"
+cat <<EOF > /etc/fstab
+LABEL=_/ / ext4 defaults 1 1
+EOF
+echo .
+
+echo -n "Grub tweaks"
+echo GRUB_TIMEOUT=0 > /etc/default/grub
+sed -i '1i# This file is for use with pv-grub; legacy grub is not installed in this image' /boot/grub/grub.conf
+sed -i 's/^timeout=5/timeout=0/' /boot/grub/grub.conf
+sed -i 's/^default=1/default=0/' /boot/grub/grub.conf
+sed -i '/splashimage/d' /boot/grub/grub.conf
+# need to file a bug on this one
+sed -i 's/root=.*/root=LABEL=_\//' /boot/grub/grub.conf
+echo .
+if ! [[ -e /boot/grub/menu.lst ]]; then
+ echo -n "Linking menu.lst to old-style grub.conf for pv-grub"
+ ln /boot/grub/grub.conf /boot/grub/menu.lst
+ ln -sf /boot/grub/grub.conf /etc/grub.conf
+fi
# setup systemd to boot to the right runlevel
-rm /etc/systemd/system/default.target
+echo -n "Setting default runlevel to multiuser text mode"
+rm -f /etc/systemd/system/default.target
ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
+echo .
+
+# If you want to remove rsyslog and just use journald, also uncomment this.
+#echo -n "Enabling persistent journal"
+#mkdir /var/log/journal/
+#echo .
+
+# this is installed by default but we don't need it in virt
+echo "Removing linux-firmware package."
+yum -C -y remove linux-firmware
+
+# Remove firewalld; was supposed to be optional in F18, but is required to
+# be present for install/image building.
+echo "Removing firewalld."
+yum -C -y remove firewalld
+
+
+# Because memory is scarce resource in most cloud/virt environments,
+# and because this impedes forensics, we are differing from the Fedora
+# default of having /tmp on tmpfs.
+echo "Disabling tmpfs for /tmp."
+systemctl mask tmp.mount
+
+# Uncomment this if you want to use cloud init but suppress the creation
+# of an "ec2-user" account. This will, in the absence of further config,
+# cause the ssh key from a metadata source to be put in the root account.
+#cat <<EOF > /etc/cloud/cloud.cfg.d/50_suppress_ec2-user_use_root.cfg
+#users: []
+#disable_root: 0
+#EOF
+
+echo "Zeroing out empty space."
+# This forces the filesystem to reclaim space from deleted files
+dd bs=1M if=/dev/zero of=/var/tmp/zeros || :
+rm -f /var/tmp/zeros
+echo "(Don't worry -- that out-of-space error was expected.)"
%end
commit 5fb26a988877f8682978bc1debd0fc6420f90c3f
Author: Matthew Miller <mattdm(a)mattdm.org>
Date: Thu Dec 20 13:22:52 2012 -0500
pull out cloud-init 0.7.1-1 kludge -- no longer needed
diff --git a/ec2/fedora-18-x86_64-ec2.ks b/ec2/fedora-18-x86_64-ec2.ks
index ccd8874..5cd8544 100644
--- a/ec2/fedora-18-x86_64-ec2.ks
+++ b/ec2/fedora-18-x86_64-ec2.ks
@@ -119,76 +119,6 @@ systemctl mask tmp.mount
#disable_root: 0
#EOF
-# Temporary kludge in case https://bugzilla.redhat.com/show_bug.cgi?id=887363
-# does not make F18 final release.
-if [[ $( rpm -q --qf '%{v}-%{r}' cloud-init) == "0.7.1-1.fc18" ]]; then
-echo "Detected older cloud-init; generating config file now."
-cat <<EOF > /etc/cloud/cloud.cfg
-users:
- - default
-
-disable_root: 1
-ssh_pwauth: 0
-
-locale_configfile: /etc/sysconfig/i18n
-mount_default_fields: [~, ~, 'auto', 'defaults,nofail', '0', '2']
-resize_rootfs_tmp: /dev
-ssh_deletekeys: 0
-ssh_genkeytypes: ~
-syslog_fix_perms: ~
-
-cloud_init_modules:
- - bootcmd
- - write-files
- - resizefs
- - set_hostname
- - update_hostname
- - update_etc_hosts
- - rsyslog
- - users-groups
- - ssh
-
-cloud_config_modules:
- - mounts
- - locale
- - set-passwords
- - timezone
- - puppet
- - chef
- - salt-minion
- - mcollective
- - disable-ec2-metadata
- - runcmd
-
-cloud_final_modules:
- - rightscale_userdata
- - scripts-per-once
- - scripts-per-boot
- - scripts-per-instance
- - scripts-user
- - ssh-authkey-fingerprints
- - keys-to-console
- - phone-home
- - final-message
-
-system_info:
- default_user:
- name: ec2-user
- lock_passwd: true
- gecos: EC2 user
- groups: [wheel, adm]
- sudo: ["ALL=(ALL) NOPASSWD:ALL"]
- shell: /bin/bash
- distro: fedora
- paths:
- cloud_dir: /var/lib/cloud
- templates_dir: /etc/cloud/templates
- ssh_svcname: sshd
-# vim:syntax=yaml
-EOF
-fi
-
-
echo "Zeroing out empty space."
# This forces the filesystem to reclaim space from deleted files
dd bs=1M if=/dev/zero of=/var/tmp/zeros || :
diff --git a/generic/fedora-18-x86_64-cloud.ks b/generic/fedora-18-x86_64-cloud.ks
index 3fd6531..7bc2884 100644
--- a/generic/fedora-18-x86_64-cloud.ks
+++ b/generic/fedora-18-x86_64-cloud.ks
@@ -146,76 +146,6 @@ systemctl mask tmp.mount
#disable_root: 0
#EOF
-# Temporary kludge in case https://bugzilla.redhat.com/show_bug.cgi?id=887363
-# does not make F18 final release.
-if [[ $( rpm -q --qf '%{v}-%{r}' cloud-init) == "0.7.1-1.fc18" ]]; then
-echo "Detected older cloud-init; generating config file now."
-cat <<EOF > /etc/cloud/cloud.cfg
-users:
- - default
-
-disable_root: 1
-ssh_pwauth: 0
-
-locale_configfile: /etc/sysconfig/i18n
-mount_default_fields: [~, ~, 'auto', 'defaults,nofail', '0', '2']
-resize_rootfs_tmp: /dev
-ssh_deletekeys: 0
-ssh_genkeytypes: ~
-syslog_fix_perms: ~
-
-cloud_init_modules:
- - bootcmd
- - write-files
- - resizefs
- - set_hostname
- - update_hostname
- - update_etc_hosts
- - rsyslog
- - users-groups
- - ssh
-
-cloud_config_modules:
- - mounts
- - locale
- - set-passwords
- - timezone
- - puppet
- - chef
- - salt-minion
- - mcollective
- - disable-ec2-metadata
- - runcmd
-
-cloud_final_modules:
- - rightscale_userdata
- - scripts-per-once
- - scripts-per-boot
- - scripts-per-instance
- - scripts-user
- - ssh-authkey-fingerprints
- - keys-to-console
- - phone-home
- - final-message
-
-system_info:
- default_user:
- name: ec2-user
- lock_passwd: true
- gecos: EC2 user
- groups: [wheel, adm]
- sudo: ["ALL=(ALL) NOPASSWD:ALL"]
- shell: /bin/bash
- distro: fedora
- paths:
- cloud_dir: /var/lib/cloud
- templates_dir: /etc/cloud/templates
- ssh_svcname: sshd
-# vim:syntax=yaml
-EOF
-fi
-
-
echo "Zeroing out empty space."
# This forces the filesystem to reclaim space from deleted files
dd bs=1M if=/dev/zero of=/var/tmp/zeros || :
commit d62789e6dd1df1dee2f99fb6cd5874f8d8ee0a1d
Author: Matthew Miller <mattdm(a)mattdm.org>
Date: Thu Dec 20 13:06:55 2012 -0500
make that warning stronger
diff --git a/ec2/fedora-18-x86_64-ec2.ks b/ec2/fedora-18-x86_64-ec2.ks
index 0bef4b2..ccd8874 100644
--- a/ec2/fedora-18-x86_64-ec2.ks
+++ b/ec2/fedora-18-x86_64-ec2.ks
@@ -26,7 +26,7 @@ bootloader --timeout=0 --location=mbr --driveorder=sda
network --bootproto=dhcp --device=eth0 --onboot=on
services --enabled=network,sshd,rsyslog,iptables,cloud-init,cloud-init-local,cloud-config,cloud-final
-# This would let fussy, fussy grub2 install -- but not needed for EC2.
+# This would let fussy grub2 install, but will break in EC2
#part biosboot --fstype=biosboot --size=1 --ondisk sda
part / --size 4096 --fstype ext4 --ondisk sda
commit 01b5dbb785ffe2e206a1f4d0522502e470cd4c6b
Author: Matthew Miller <mattdm(a)mattdm.org>
Date: Thu Dec 20 12:31:19 2012 -0500
delete the splashimage from the legacy grub config file
diff --git a/ec2/fedora-18-x86_64-ec2.ks b/ec2/fedora-18-x86_64-ec2.ks
index 2c86096..0bef4b2 100644
--- a/ec2/fedora-18-x86_64-ec2.ks
+++ b/ec2/fedora-18-x86_64-ec2.ks
@@ -74,6 +74,7 @@ echo GRUB_TIMEOUT=0 > /etc/default/grub
sed -i '1i# This file is for use with pv-grub; legacy grub is not installed in this image' /boot/grub/grub.conf
sed -i 's/^timeout=5/timeout=0/' /boot/grub/grub.conf
sed -i 's/^default=1/default=0/' /boot/grub/grub.conf
+sed -i '/splashimage/d' /boot/grub/grub.conf
# need to file a bug on this one
sed -i 's/root=.*/root=LABEL=_\//' /boot/grub/grub.conf
echo .
diff --git a/generic/fedora-18-x86_64-cloud.ks b/generic/fedora-18-x86_64-cloud.ks
index 249a801..3fd6531 100644
--- a/generic/fedora-18-x86_64-cloud.ks
+++ b/generic/fedora-18-x86_64-cloud.ks
@@ -80,6 +80,7 @@ sed -i 's/^set timeout=5/set timeout=0/' /boot/grub2/grub.cfg
sed -i '1i# This file is for use with pv-grub; legacy grub is not installed in this image' /boot/grub/grub.conf
sed -i 's/^timeout=5/timeout=0/' /boot/grub/grub.conf
sed -i 's/^default=1/default=0/' /boot/grub/grub.conf
+sed -i '/splashimage/d' /boot/grub/grub.conf
# need to file a bug on this one
sed -i 's/root=.*/root=LABEL=_\//' /boot/grub/grub.conf
echo .
diff --git a/generic/fedora-18-x86_64-minimal.ks b/generic/fedora-18-x86_64-minimal.ks
index 348a446..71339a5 100644
--- a/generic/fedora-18-x86_64-minimal.ks
+++ b/generic/fedora-18-x86_64-minimal.ks
@@ -85,6 +85,7 @@ echo GRUB_TIMEOUT=0 > /etc/default/grub
sed -i 's/^set timeout=5/set timeout=0/' /boot/grub2/grub.cfg
sed -i '1i# This file is for use with pv-grub; legacy grub is not installed in this image' /boot/grub/grub.conf
sed -i 's/^timeout=5/timeout=0/' /boot/grub/grub.conf
+sed -i '/splashimage/d' /boot/grub/grub.conf
# need to file a bug on this one
sed -i 's/root=.*/root=LABEL=_\//' /boot/grub/grub.conf
echo .
diff --git a/generic/fedora-18-x86_64.ks b/generic/fedora-18-x86_64.ks
index 12b7116..877f4ae 100644
--- a/generic/fedora-18-x86_64.ks
+++ b/generic/fedora-18-x86_64.ks
@@ -73,6 +73,7 @@ echo GRUB_TIMEOUT=0 > /etc/default/grub
sed -i 's/^set timeout=5/set timeout=0/' /boot/grub2/grub.cfg
sed -i '1i# This file is for use with pv-grub; legacy grub is not installed in this image' /boot/grub/grub.conf
sed -i 's/^timeout=5/timeout=0/' /boot/grub/grub.conf
+sed -i '/splashimage/d' /boot/grub/grub.conf
# need to file a bug on this one
sed -i 's/root=.*/root=LABEL=_\//' /boot/grub/grub.conf
echo .
commit 4acdc22d991765ca72e2efaacb14a7d9c193f0e3
Author: Matthew Miller <mattdm(a)mattdm.org>
Date: Thu Dec 20 12:25:41 2012 -0500
remove biosboot from ec2 image (not needed since we're not booting that way)
diff --git a/ec2/fedora-18-x86_64-ec2.ks b/ec2/fedora-18-x86_64-ec2.ks
index 2b5bebb..2c86096 100644
--- a/ec2/fedora-18-x86_64-ec2.ks
+++ b/ec2/fedora-18-x86_64-ec2.ks
@@ -26,7 +26,8 @@ bootloader --timeout=0 --location=mbr --driveorder=sda
network --bootproto=dhcp --device=eth0 --onboot=on
services --enabled=network,sshd,rsyslog,iptables,cloud-init,cloud-init-local,cloud-config,cloud-final
-part biosboot --fstype=biosboot --size=1 --ondisk sda
+# This would let fussy, fussy grub2 install -- but not needed for EC2.
+#part biosboot --fstype=biosboot --size=1 --ondisk sda
part / --size 4096 --fstype ext4 --ondisk sda
# Repositories
commit 4744ec0f119243707497dd49042d6dafa01db64c
Author: Matthew Miller <mattdm(a)mattdm.org>
Date: Wed Dec 19 15:10:11 2012 -0500
Why is this getting set to "1" in the first place? Odd.
diff --git a/ec2/fedora-18-x86_64-ec2.ks b/ec2/fedora-18-x86_64-ec2.ks
index d91a4c6..2b5bebb 100644
--- a/ec2/fedora-18-x86_64-ec2.ks
+++ b/ec2/fedora-18-x86_64-ec2.ks
@@ -72,6 +72,7 @@ echo -n "Grub tweaks"
echo GRUB_TIMEOUT=0 > /etc/default/grub
sed -i '1i# This file is for use with pv-grub; legacy grub is not installed in this image' /boot/grub/grub.conf
sed -i 's/^timeout=5/timeout=0/' /boot/grub/grub.conf
+sed -i 's/^default=1/default=0/' /boot/grub/grub.conf
# need to file a bug on this one
sed -i 's/root=.*/root=LABEL=_\//' /boot/grub/grub.conf
echo .
commit 202bc343ee2569c44dad17d71169dc7902000345
Author: Matthew Miller <mattdm(a)mattdm.org>
Date: Wed Dec 19 14:47:30 2012 -0500
idle=halt not needed on x86_64, and maybe not at all anymore
diff --git a/ec2/fedora-18-x86_64-ec2.ks b/ec2/fedora-18-x86_64-ec2.ks
index c19cc15..d91a4c6 100644
--- a/ec2/fedora-18-x86_64-ec2.ks
+++ b/ec2/fedora-18-x86_64-ec2.ks
@@ -73,7 +73,7 @@ echo GRUB_TIMEOUT=0 > /etc/default/grub
sed -i '1i# This file is for use with pv-grub; legacy grub is not installed in this image' /boot/grub/grub.conf
sed -i 's/^timeout=5/timeout=0/' /boot/grub/grub.conf
# need to file a bug on this one
-sed -i 's/root=.*/root=LABEL=_\/ idle=halt/' /boot/grub/grub.conf
+sed -i 's/root=.*/root=LABEL=_\//' /boot/grub/grub.conf
echo .
if ! [[ -e /boot/grub/menu.lst ]]; then
echo -n "Linking menu.lst to old-style grub.conf for pv-grub"
commit 4b2acf9646bcb5bf09b9c5e6fdfc7643e38660fd
Merge: 3b3df1a 30b961a
Author: Matthew Miller <mattdm(a)mattdm.org>
Date: Wed Dec 19 14:35:42 2012 -0500
Merge branch 'master' of ssh://git.fedorahosted.org/git/cloud-kickstarts
Conflicts:
ec2/fedora-18-x86_64-ec2.ks
diff --cc ec2/fedora-18-x86_64-ec2.ks
index c63af4e,ccfa11e..c19cc15
--- a/ec2/fedora-18-x86_64-ec2.ks
+++ b/ec2/fedora-18-x86_64-ec2.ks
@@@ -32,166 -25,62 +32,165 @@@ part / --size 4096 --fstype ext4 --ondi
# Repositories
repo --name=fedora --mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=fedora-18&arch=$basearch
-#
-#
-# Add all the packages after the base packages
-#
+
+# Package list.
%packages --nobase
@core
-pciutils
kernel
-man-db
-firewalld
--biosdevname
-
-# package to setup cloudy bits for us
+# cloud-init does magical things with EC2 metadata, including provisioning
+# a user account with ssh keys.
cloud-init
-%end
+# Needed initially, but removed below.
+firewalld
-# more ec2-ify
-%post --erroronfail
+# cherry-pick a few things from @standard
+tmpwatch
+tar
+rsync
-# fstab mounting is different for x86_64 and i386
-cat <<EOL > /etc/fstab
-LABEL=_/ / ext4 defaults 1 1
-proc /proc proc defaults 0 0
-sysfs /sys sysfs defaults 0 0
-devpts /dev/pts devpts gid=5,mode=620 0 0
-tmpfs /dev/shm tmpfs defaults 0 0
-EOL
-if [ ! -d /lib64 ] ; then
+# Some things from @core we can do without in a minimal install
+-biosdevname
+-plymouth
+-NetworkManager
+-polkit
-cat <<EOL >> /etc/fstab
-/dev/xvda3 swap swap defaults 0 0
-EOL
+%end
-# workaround xen performance issue (bz 651861)
-echo "hwcap 1 nosegneg" > /etc/ld.so.conf.d/libc6-xen.conf
-fi
-# idle=nomwait is to allow xen images to boot and not try use cpu features that are not supported
-# grub tweaks
-sed -i -e 's/timeout=5/timeout=0/' \
- -e 's|root=[^ ]\+|root=LABEL=_/ idle=halt|' \
- -e '/splashimage/d' \
- /boot/grub/grub.conf
+%post --erroronfail
-# symlink grub.conf to menu.lst for use by EC2 pv-grub
-pushd /boot/grub
-ln -s grub.conf menu.lst
-popd
+echo -n "Writing fstab"
+cat <<EOF > /etc/fstab
+LABEL=_/ / ext4 defaults 1 1
+EOF
+echo .
+
+echo -n "Grub tweaks"
+echo GRUB_TIMEOUT=0 > /etc/default/grub
+sed -i '1i# This file is for use with pv-grub; legacy grub is not installed in this image' /boot/grub/grub.conf
+sed -i 's/^timeout=5/timeout=0/' /boot/grub/grub.conf
+# need to file a bug on this one
- sed -i 's/root=.*/root=LABEL=_\//' /boot/grub/grub.conf
++sed -i 's/root=.*/root=LABEL=_\/ idle=halt/' /boot/grub/grub.conf
+echo .
+if ! [[ -e /boot/grub/menu.lst ]]; then
+ echo -n "Linking menu.lst to old-style grub.conf for pv-grub"
+ ln /boot/grub/grub.conf /boot/grub/menu.lst
+ ln -sf /boot/grub/grub.conf /etc/grub.conf
+fi
-
# setup systemd to boot to the right runlevel
-rm /etc/systemd/system/default.target
+echo -n "Setting default runlevel to multiuser text mode"
+rm -f /etc/systemd/system/default.target
ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
+echo .
+
+# If you want to remove rsyslog and just use journald, also uncomment this.
+#echo -n "Enabling persistent journal"
+#mkdir /var/log/journal/
+#echo .
+
+# this is installed by default but we don't need it in virt
+echo "Removing linux-firmware package."
+yum -C -y remove linux-firmware
+
+# Remove firewalld; was supposed to be optional in F18, but is required to
+# be present for install/image building.
+echo "Removing firewalld."
+yum -C -y remove firewalld
+
+
+# Because memory is scarce resource in most cloud/virt environments,
+# and because this impedes forensics, we are differing from the Fedora
+# default of having /tmp on tmpfs.
+echo "Disabling tmpfs for /tmp."
+systemctl mask tmp.mount
+
+# Uncomment this if you want to use cloud init but suppress the creation
+# of an "ec2-user" account. This will, in the absence of further config,
+# cause the ssh key from a metadata source to be put in the root account.
+#cat <<EOF > /etc/cloud/cloud.cfg.d/50_suppress_ec2-user_use_root.cfg
+#users: []
+#disable_root: 0
+#EOF
+
+# Temporary kludge in case https://bugzilla.redhat.com/show_bug.cgi?id=887363
+# does not make F18 final release.
+if [[ $( rpm -q --qf '%{v}-%{r}' cloud-init) == "0.7.1-1.fc18" ]]; then
+echo "Detected older cloud-init; generating config file now."
+cat <<EOF > /etc/cloud/cloud.cfg
+users:
+ - default
+
+disable_root: 1
+ssh_pwauth: 0
+
+locale_configfile: /etc/sysconfig/i18n
+mount_default_fields: [~, ~, 'auto', 'defaults,nofail', '0', '2']
+resize_rootfs_tmp: /dev
+ssh_deletekeys: 0
+ssh_genkeytypes: ~
+syslog_fix_perms: ~
+
+cloud_init_modules:
+ - bootcmd
+ - write-files
+ - resizefs
+ - set_hostname
+ - update_hostname
+ - update_etc_hosts
+ - rsyslog
+ - users-groups
+ - ssh
+
+cloud_config_modules:
+ - mounts
+ - locale
+ - set-passwords
+ - timezone
+ - puppet
+ - chef
+ - salt-minion
+ - mcollective
+ - disable-ec2-metadata
+ - runcmd
+
+cloud_final_modules:
+ - rightscale_userdata
+ - scripts-per-once
+ - scripts-per-boot
+ - scripts-per-instance
+ - scripts-user
+ - ssh-authkey-fingerprints
+ - keys-to-console
+ - phone-home
+ - final-message
+
+system_info:
+ default_user:
+ name: ec2-user
+ lock_passwd: true
+ gecos: EC2 user
+ groups: [wheel, adm]
+ sudo: ["ALL=(ALL) NOPASSWD:ALL"]
+ shell: /bin/bash
+ distro: fedora
+ paths:
+ cloud_dir: /var/lib/cloud
+ templates_dir: /etc/cloud/templates
+ ssh_svcname: sshd
+# vim:syntax=yaml
+EOF
+fi
+
+
+echo "Zeroing out empty space."
+# This forces the filesystem to reclaim space from deleted files
+dd bs=1M if=/dev/zero of=/var/tmp/zeros || :
+rm -f /var/tmp/zeros
+echo "(Don't worry -- that out-of-space error was expected.)"
%end
diff --cc generic/fedora-18-x86_64-cloud.ks
index ef3b3fa,db04391..249a801
--- a/generic/fedora-18-x86_64-cloud.ks
+++ b/generic/fedora-18-x86_64-cloud.ks
@@@ -77,8 -77,8 +77,9 @@@ echo
echo -n "Grub tweaks"
echo GRUB_TIMEOUT=0 > /etc/default/grub
sed -i 's/^set timeout=5/set timeout=0/' /boot/grub2/grub.cfg
-sed -i '1i# This file is for use with pv-grub; legacy grub is not installed in this image' /boot/grub2/grub.cfg
+sed -i '1i# This file is for use with pv-grub; legacy grub is not installed in this image' /boot/grub/grub.conf
sed -i 's/^timeout=5/timeout=0/' /boot/grub/grub.conf
++sed -i 's/^default=1/default=0/' /boot/grub/grub.conf
# need to file a bug on this one
sed -i 's/root=.*/root=LABEL=_\//' /boot/grub/grub.conf
echo .
commit 3b3df1af0695f2996c7aa158be3f963ae288df13
Author: Matthew Miller <mattdm(a)mattdm.org>
Date: Mon Dec 17 11:45:21 2012 -0500
ami-creator does the menu.lst linking automatically, so don't step on that.
When we migrate away from appliance-tools in the future, this hack can be
removed completely.
diff --git a/ec2/fedora-18-x86_64-ec2.ks b/ec2/fedora-18-x86_64-ec2.ks
index b3ee27b..c63af4e 100644
--- a/ec2/fedora-18-x86_64-ec2.ks
+++ b/ec2/fedora-18-x86_64-ec2.ks
@@ -75,9 +75,11 @@ sed -i 's/^timeout=5/timeout=0/' /boot/grub/grub.conf
# need to file a bug on this one
sed -i 's/root=.*/root=LABEL=_\//' /boot/grub/grub.conf
echo .
-echo -n "Linking menu.lst to old-style grub.conf for pv-grub"
-mv /boot/grub/grub.conf /boot/grub/menu.lst
-ln -s /boot/grub/menu.lst /etc/grub.conf
+if ! [[ -e /boot/grub/menu.lst ]]; then
+ echo -n "Linking menu.lst to old-style grub.conf for pv-grub"
+ ln /boot/grub/grub.conf /boot/grub/menu.lst
+ ln -sf /boot/grub/grub.conf /etc/grub.conf
+fi
# setup systemd to boot to the right runlevel
diff --git a/generic/fedora-18-x86_64-cloud.ks b/generic/fedora-18-x86_64-cloud.ks
index f21e710..ef3b3fa 100644
--- a/generic/fedora-18-x86_64-cloud.ks
+++ b/generic/fedora-18-x86_64-cloud.ks
@@ -82,10 +82,11 @@ sed -i 's/^timeout=5/timeout=0/' /boot/grub/grub.conf
# need to file a bug on this one
sed -i 's/root=.*/root=LABEL=_\//' /boot/grub/grub.conf
echo .
-echo -n "Linking menu.lst to old-style grub.conf for pv-grub"
-mv /boot/grub/grub.conf /boot/grub/menu.lst
-ln -s /boot/grub/menu.lst /etc/grub.conf
-
+if ! [[ -e /boot/grub/menu.lst ]]; then
+ echo -n "Linking menu.lst to old-style grub.conf for pv-grub"
+ ln /boot/grub/grub.conf /boot/grub/menu.lst
+ ln -sf /boot/grub/grub.conf /etc/grub.conf
+fi
# setup systemd to boot to the right runlevel
echo -n "Setting default runlevel to multiuser text mode"
diff --git a/generic/fedora-18-x86_64-minimal.ks b/generic/fedora-18-x86_64-minimal.ks
index e651dd9..348a446 100644
--- a/generic/fedora-18-x86_64-minimal.ks
+++ b/generic/fedora-18-x86_64-minimal.ks
@@ -88,9 +88,11 @@ sed -i 's/^timeout=5/timeout=0/' /boot/grub/grub.conf
# need to file a bug on this one
sed -i 's/root=.*/root=LABEL=_\//' /boot/grub/grub.conf
echo .
-echo -n "Linking menu.lst to old-style grub.conf for pv-grub"
-mv /boot/grub/grub.conf /boot/grub/menu.lst
-ln -s /boot/grub/menu.lst /etc/grub.conf
+if ! [[ -e /boot/grub/menu.lst ]]; then
+ echo -n "Linking menu.lst to old-style grub.conf for pv-grub"
+ ln /boot/grub/grub.conf /boot/grub/menu.lst
+ ln -sf /boot/grub/grub.conf /etc/grub.conf
+fi
# setup systemd to boot to the right runlevel
diff --git a/generic/fedora-18-x86_64.ks b/generic/fedora-18-x86_64.ks
index eb742cf..12b7116 100644
--- a/generic/fedora-18-x86_64.ks
+++ b/generic/fedora-18-x86_64.ks
@@ -76,9 +76,11 @@ sed -i 's/^timeout=5/timeout=0/' /boot/grub/grub.conf
# need to file a bug on this one
sed -i 's/root=.*/root=LABEL=_\//' /boot/grub/grub.conf
echo .
-echo -n "Linking menu.lst to old-style grub.conf for pv-grub"
-mv /boot/grub/grub.conf /boot/grub/menu.lst
-ln -s /boot/grub/menu.lst /etc/grub.conf
+if ! [[ -e /boot/grub/menu.lst ]]; then
+ echo -n "Linking menu.lst to old-style grub.conf for pv-grub"
+ ln /boot/grub/grub.conf /boot/grub/menu.lst
+ ln -sf /boot/grub/grub.conf /etc/grub.conf
+fi
# setup systemd to boot to the right runlevel
commit 5f670d1dc86f902db1eaa01ba4b6a6623aec9d15
Author: Matthew Miller <mattdm(a)mattdm.org>
Date: Sun Dec 16 14:24:58 2012 -0500
ec2-specific changes
diff --git a/ec2/fedora-18-x86_64-ec2.ks b/ec2/fedora-18-x86_64-ec2.ks
index db04391..b3ee27b 100644
--- a/ec2/fedora-18-x86_64-ec2.ks
+++ b/ec2/fedora-18-x86_64-ec2.ks
@@ -1,12 +1,16 @@
-# This is a basic Fedora 18 spin designed to work in OpenStack and other
-# private cloud environments. It's configured with cloud-init so it will
-# take advantage of ec2-compatible metadata services for provisioning
-# ssh keys. That also currently creates an ec2-user account; we'll probably
-# want to make that something generic by default. The root password is empty
-# by default.
+# This is a basic Fedora 18 spin designed to work in Amazon EC2.
+# It's configured with cloud-init so it will take advantage of
+# ec2-compatible metadata services for provisioning ssh keys. That also
+# currently creates an ec2-user account; we'll probably want to make that
+# something generic by default. The root password is empty by default.
#
# Note that unlike the standard F18 install, this image has /tmp on disk
# rather than in tmpfs, since memory is usually at a premium.
+#
+# It additionally configures _no_ local firewall, in line with EC2
+# recommendations that security groups be used instead.
+
+
lang en_US.UTF-8
keyboard us
@@ -15,9 +19,7 @@ timezone --utc America/New_York
auth --useshadow --enablemd5
selinux --enforcing
-# this is actually not used, but a static firewall
-# matching these rules is generated below.
-firewall --service=ssh --service=http --service=https
+firewall --disabled
bootloader --timeout=0 --location=mbr --driveorder=sda
@@ -40,17 +42,9 @@ kernel
# a user account with ssh keys.
cloud-init
-# Not needed with pv-grub (as in EC2). Would be nice to have
-# something smaller for F19 (syslinux?), but this is what we have now.
-grub2
-
# Needed initially, but removed below.
firewalld
-# Basic firewall. If you're going to rely on your cloud service's
-# security groups you can remove this.
-iptables-services
-
# cherry-pick a few things from @standard
tmpwatch
tar
@@ -76,8 +70,7 @@ echo .
echo -n "Grub tweaks"
echo GRUB_TIMEOUT=0 > /etc/default/grub
-sed -i 's/^set timeout=5/set timeout=0/' /boot/grub2/grub.cfg
-sed -i '1i# This file is for use with pv-grub; legacy grub is not installed in this image' /boot/grub2/grub.cfg
+sed -i '1i# This file is for use with pv-grub; legacy grub is not installed in this image' /boot/grub/grub.conf
sed -i 's/^timeout=5/timeout=0/' /boot/grub/grub.conf
# need to file a bug on this one
sed -i 's/root=.*/root=LABEL=_\//' /boot/grub/grub.conf
@@ -107,27 +100,6 @@ yum -C -y remove linux-firmware
echo "Removing firewalld."
yum -C -y remove firewalld
-# Non-firewalld-firewall
-echo -n "Writing static firewall"
-cat <<EOF > /etc/sysconfig/iptables
-# Simple static firewall loaded by iptables.service. Replace
-# this with your own custom rules, run lokkit, or switch to
-# shorewall or firewalld as your needs dictate.
-*filter
-:INPUT ACCEPT [0:0]
-:FORWARD ACCEPT [0:0]
-:OUTPUT ACCEPT [0:0]
--A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
--A INPUT -p icmp -j ACCEPT
--A INPUT -i lo -j ACCEPT
--A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 22 -j ACCEPT
--A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 80 -j ACCEPT
--A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 443 -j ACCEPT
--A INPUT -j REJECT --reject-with icmp-host-prohibited
--A FORWARD -j REJECT --reject-with icmp-host-prohibited
-COMMIT
-EOF
-echo .
# Because memory is scarce resource in most cloud/virt environments,
# and because this impedes forensics, we are differing from the Fedora
commit 11469890e4ecbe9d027aad2301e3c7e218f92a53
Author: Matthew Miller <mattdm(a)mattdm.org>
Date: Sun Dec 16 14:22:47 2012 -0500
Comment was supposed to be inserted in legacy grub config file, not grub2
diff --git a/generic/fedora-18-x86_64-cloud.ks b/generic/fedora-18-x86_64-cloud.ks
index db04391..f21e710 100644
--- a/generic/fedora-18-x86_64-cloud.ks
+++ b/generic/fedora-18-x86_64-cloud.ks
@@ -77,7 +77,7 @@ echo .
echo -n "Grub tweaks"
echo GRUB_TIMEOUT=0 > /etc/default/grub
sed -i 's/^set timeout=5/set timeout=0/' /boot/grub2/grub.cfg
-sed -i '1i# This file is for use with pv-grub; legacy grub is not installed in this image' /boot/grub2/grub.cfg
+sed -i '1i# This file is for use with pv-grub; legacy grub is not installed in this image' /boot/grub/grub.conf
sed -i 's/^timeout=5/timeout=0/' /boot/grub/grub.conf
# need to file a bug on this one
sed -i 's/root=.*/root=LABEL=_\//' /boot/grub/grub.conf
diff --git a/generic/fedora-18-x86_64-minimal.ks b/generic/fedora-18-x86_64-minimal.ks
index 044335d..e651dd9 100644
--- a/generic/fedora-18-x86_64-minimal.ks
+++ b/generic/fedora-18-x86_64-minimal.ks
@@ -83,7 +83,7 @@ echo .
echo -n "Grub tweaks"
echo GRUB_TIMEOUT=0 > /etc/default/grub
sed -i 's/^set timeout=5/set timeout=0/' /boot/grub2/grub.cfg
-sed -i '1i# This file is for use with pv-grub; legacy grub is not installed in this image' /boot/grub2/grub.cfg
+sed -i '1i# This file is for use with pv-grub; legacy grub is not installed in this image' /boot/grub/grub.conf
sed -i 's/^timeout=5/timeout=0/' /boot/grub/grub.conf
# need to file a bug on this one
sed -i 's/root=.*/root=LABEL=_\//' /boot/grub/grub.conf
diff --git a/generic/fedora-18-x86_64.ks b/generic/fedora-18-x86_64.ks
index 92a84f0..eb742cf 100644
--- a/generic/fedora-18-x86_64.ks
+++ b/generic/fedora-18-x86_64.ks
@@ -71,7 +71,7 @@ echo .
echo -n "Grub tweaks"
echo GRUB_TIMEOUT=0 > /etc/default/grub
sed -i 's/^set timeout=5/set timeout=0/' /boot/grub2/grub.cfg
-sed -i '1i# This file is for use with pv-grub; legacy grub is not installed in this image' /boot/grub2/grub.cfg
+sed -i '1i# This file is for use with pv-grub; legacy grub is not installed in this image' /boot/grub/grub.conf
sed -i 's/^timeout=5/timeout=0/' /boot/grub/grub.conf
# need to file a bug on this one
sed -i 's/root=.*/root=LABEL=_\//' /boot/grub/grub.conf
commit c561239c2f65b63b0ba5eeae42d340778be329f2
Author: Matthew Miller <mattdm(a)mattdm.org>
Date: Sun Dec 16 14:20:35 2012 -0500
copy in changes from 'generic' cloud image
diff --git a/ec2/fedora-18-x86_64-ec2.ks b/ec2/fedora-18-x86_64-ec2.ks
index 090e1bf..db04391 100644
--- a/ec2/fedora-18-x86_64-ec2.ks
+++ b/ec2/fedora-18-x86_64-ec2.ks
@@ -1,90 +1,223 @@
-# Build a basic Fedora 18 AMI
+# This is a basic Fedora 18 spin designed to work in OpenStack and other
+# private cloud environments. It's configured with cloud-init so it will
+# take advantage of ec2-compatible metadata services for provisioning
+# ssh keys. That also currently creates an ec2-user account; we'll probably
+# want to make that something generic by default. The root password is empty
+# by default.
+#
+# Note that unlike the standard F18 install, this image has /tmp on disk
+# rather than in tmpfs, since memory is usually at a premium.
+
lang en_US.UTF-8
keyboard us
timezone --utc America/New_York
+
auth --useshadow --enablemd5
selinux --enforcing
-firewall --service=ssh
-bootloader --timeout=1 --location=mbr --driveorder=sda
-network --bootproto=dhcp --device=eth0 --onboot=on
-services --enabled=network,sshd,rsyslog
-# By default the root password is emptied
+# this is actually not used, but a static firewall
+# matching these rules is generated below.
+firewall --service=ssh --service=http --service=https
-#
-# Define how large you want your rootfs to be
-# NOTE: S3-backed AMIs have a limit of 10G
-#
-part / --size 10000 --fstype ext4 --ondisk sda
+bootloader --timeout=0 --location=mbr --driveorder=sda
-# This will let fussy, fussy grub2 install, if we
-# decide we want that.
-#part biosboot --fstype=biosboot --size=1 --ondisk sda
+network --bootproto=dhcp --device=eth0 --onboot=on
+services --enabled=network,sshd,rsyslog,iptables,cloud-init,cloud-init-local,cloud-config,cloud-final
+part biosboot --fstype=biosboot --size=1 --ondisk sda
+part / --size 4096 --fstype ext4 --ondisk sda
-#
# Repositories
repo --name=fedora --mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=fedora-18&arch=$basearch
-#
-#
-# Add all the packages after the base packages
-#
+
+# Package list.
%packages --nobase
@core
-pciutils
kernel
-man-db
-
--biosdevname
-# package to setup cloudy bits for us
+# cloud-init does magical things with EC2 metadata, including provisioning
+# a user account with ssh keys.
cloud-init
-%end
+# Not needed with pv-grub (as in EC2). Would be nice to have
+# something smaller for F19 (syslinux?), but this is what we have now.
+grub2
-# more ec2-ify
-%post --erroronfail
+# Needed initially, but removed below.
+firewalld
-# fstab mounting is different for x86_64 and i386
-cat <<EOL > /etc/fstab
-LABEL=_/ / ext4 defaults 1 1
-proc /proc proc defaults 0 0
-sysfs /sys sysfs defaults 0 0
-devpts /dev/pts devpts gid=5,mode=620 0 0
-tmpfs /dev/shm tmpfs defaults 0 0
-EOL
-if [ ! -d /lib64 ] ; then
+# Basic firewall. If you're going to rely on your cloud service's
+# security groups you can remove this.
+iptables-services
-cat <<EOL >> /etc/fstab
-/dev/xvda3 swap swap defaults 0 0
-EOL
+# cherry-pick a few things from @standard
+tmpwatch
+tar
+rsync
-# workaround xen performance issue (bz 651861)
-echo "hwcap 1 nosegneg" > /etc/ld.so.conf.d/libc6-xen.conf
+# Some things from @core we can do without in a minimal install
+-biosdevname
+-plymouth
+-NetworkManager
+-polkit
-fi
+%end
-# idle=nomwait is to allow xen images to boot and not try use cpu features that are not supported
-# grub tweaks
-sed -i -e 's/timeout=5/timeout=0/' \
- -e 's|root=[^ ]\+|root=LABEL=_/ idle=halt|' \
- -e '/splashimage/d' \
- /boot/grub/grub.conf
-# the firewall rules get saved as .old without this we end up not being able
-# ssh in as iptables blocks access
-rename -v .old "" /etc/sysconfig/*old
+%post --erroronfail
+
+echo -n "Writing fstab"
+cat <<EOF > /etc/fstab
+LABEL=_/ / ext4 defaults 1 1
+EOF
+echo .
+
+echo -n "Grub tweaks"
+echo GRUB_TIMEOUT=0 > /etc/default/grub
+sed -i 's/^set timeout=5/set timeout=0/' /boot/grub2/grub.cfg
+sed -i '1i# This file is for use with pv-grub; legacy grub is not installed in this image' /boot/grub2/grub.cfg
+sed -i 's/^timeout=5/timeout=0/' /boot/grub/grub.conf
+# need to file a bug on this one
+sed -i 's/root=.*/root=LABEL=_\//' /boot/grub/grub.conf
+echo .
+echo -n "Linking menu.lst to old-style grub.conf for pv-grub"
+mv /boot/grub/grub.conf /boot/grub/menu.lst
+ln -s /boot/grub/menu.lst /etc/grub.conf
-# symlink grub.conf to menu.lst for use by EC2 pv-grub
-pushd /boot/grub
-ln -s grub.conf menu.lst
-popd
# setup systemd to boot to the right runlevel
-rm /etc/systemd/system/default.target
+echo -n "Setting default runlevel to multiuser text mode"
+rm -f /etc/systemd/system/default.target
ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
+echo .
+
+# If you want to remove rsyslog and just use journald, also uncomment this.
+#echo -n "Enabling persistent journal"
+#mkdir /var/log/journal/
+#echo .
+
+# this is installed by default but we don't need it in virt
+echo "Removing linux-firmware package."
+yum -C -y remove linux-firmware
+
+# Remove firewalld; was supposed to be optional in F18, but is required to
+# be present for install/image building.
+echo "Removing firewalld."
+yum -C -y remove firewalld
+
+# Non-firewalld-firewall
+echo -n "Writing static firewall"
+cat <<EOF > /etc/sysconfig/iptables
+# Simple static firewall loaded by iptables.service. Replace
+# this with your own custom rules, run lokkit, or switch to
+# shorewall or firewalld as your needs dictate.
+*filter
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+-A INPUT -p icmp -j ACCEPT
+-A INPUT -i lo -j ACCEPT
+-A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 22 -j ACCEPT
+-A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 80 -j ACCEPT
+-A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 443 -j ACCEPT
+-A INPUT -j REJECT --reject-with icmp-host-prohibited
+-A FORWARD -j REJECT --reject-with icmp-host-prohibited
+COMMIT
+EOF
+echo .
+
+# Because memory is scarce resource in most cloud/virt environments,
+# and because this impedes forensics, we are differing from the Fedora
+# default of having /tmp on tmpfs.
+echo "Disabling tmpfs for /tmp."
+systemctl mask tmp.mount
+
+# Uncomment this if you want to use cloud init but suppress the creation
+# of an "ec2-user" account. This will, in the absence of further config,
+# cause the ssh key from a metadata source to be put in the root account.
+#cat <<EOF > /etc/cloud/cloud.cfg.d/50_suppress_ec2-user_use_root.cfg
+#users: []
+#disable_root: 0
+#EOF
+
+# Temporary kludge in case https://bugzilla.redhat.com/show_bug.cgi?id=887363
+# does not make F18 final release.
+if [[ $( rpm -q --qf '%{v}-%{r}' cloud-init) == "0.7.1-1.fc18" ]]; then
+echo "Detected older cloud-init; generating config file now."
+cat <<EOF > /etc/cloud/cloud.cfg
+users:
+ - default
+
+disable_root: 1
+ssh_pwauth: 0
+
+locale_configfile: /etc/sysconfig/i18n
+mount_default_fields: [~, ~, 'auto', 'defaults,nofail', '0', '2']
+resize_rootfs_tmp: /dev
+ssh_deletekeys: 0
+ssh_genkeytypes: ~
+syslog_fix_perms: ~
+
+cloud_init_modules:
+ - bootcmd
+ - write-files
+ - resizefs
+ - set_hostname
+ - update_hostname
+ - update_etc_hosts
+ - rsyslog
+ - users-groups
+ - ssh
+
+cloud_config_modules:
+ - mounts
+ - locale
+ - set-passwords
+ - timezone
+ - puppet
+ - chef
+ - salt-minion
+ - mcollective
+ - disable-ec2-metadata
+ - runcmd
+
+cloud_final_modules:
+ - rightscale_userdata
+ - scripts-per-once
+ - scripts-per-boot
+ - scripts-per-instance
+ - scripts-user
+ - ssh-authkey-fingerprints
+ - keys-to-console
+ - phone-home
+ - final-message
+
+system_info:
+ default_user:
+ name: ec2-user
+ lock_passwd: true
+ gecos: EC2 user
+ groups: [wheel, adm]
+ sudo: ["ALL=(ALL) NOPASSWD:ALL"]
+ shell: /bin/bash
+ distro: fedora
+ paths:
+ cloud_dir: /var/lib/cloud
+ templates_dir: /etc/cloud/templates
+ ssh_svcname: sshd
+# vim:syntax=yaml
+EOF
+fi
+
+
+echo "Zeroing out empty space."
+# This forces the filesystem to reclaim space from deleted files
+dd bs=1M if=/dev/zero of=/var/tmp/zeros || :
+rm -f /var/tmp/zeros
+echo "(Don't worry -- that out-of-space error was expected.)"
%end
11 years, 4 months
yum-cron in the cloud images?
by Matthew Miller
Should we apply updates automatically in the cloud images? I like the idea
of keeping people protected against security vulnerabilities. Because of
how updates in Fedora work right now, it's also possible that an update will
break things. (We'd certainly need a large amount of testing of things like
updates to cloud-init, which apparently can make huge incompatible changes
going from 0.7.0 to 0.7.1.)
Amazon Linux does automatic updates (both at first boot and periodically).
--
Matthew Miller ☁☁☁ Fedora Cloud Architect ☁☁☁ <mattdm(a)fedoraproject.org>
11 years, 4 months
Re: cloud Digest, Vol 36, Issue 24
by Steve Loranz
Russ,
Apologies if I'm misinterpreting what you're saying here, but I think that imagefactory can do what you are looking for. The core of imagefactory supplies the REST interface, CLI, provides some storage for built images, and manages dispatching work to the plugins. The plugins do the heavy lifting and these are separated as OS and Cloud plugins. We currently have one OS plugin that started off as Fedora/RHEL specific and uses Oz to create a base JEOS image. All of the customization that creates a target image from a base image is done by a cloud plugin.
So, you could have a very minimal TDL that creates a minimal base JEOS image. You could then supply your own Cloud plugin for your virt service that does the customization you want.
The imagefactory project is packaged separately from Aeolus and can be used without any other component from Aeolus. Oz is used by the current OS plugin, but that plugin can be replaced by another that uses some other method of provisioning.
-steve
On Dec 18, 2012, at 11:39 AM, cloud-request(a)lists.fedoraproject.org wrote:
> Message: 7
> Date: Tue, 18 Dec 2012 12:38:43 -0500 (EST)
> From: R P Herrold <herrold(a)owlriver.com>
> To: Fedora Cloud SIG <cloud(a)lists.fedoraproject.org>
> Cc: boxgrinder-dev(a)boxgrinder.org
> Subject: future of Boxgrinder ... building cloud images
> Message-ID: <alpine.LRH.2.02.1212181230030.6319(a)puneyrf.bjyevire.pbz>
> Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
>
> On Tue, 18 Dec 2012, David Busby wrote:
>
>> I think you'll find it hard to get any traction here kickstarts especially
>> in the "cloud front" are used increasingly less in favour of bootstrapping
>> an instance with puppet / chef for provisioning above and beyond the base
>> os.
>
> well known, but the non-idempotent, and 'successive
> approximation' nature of such solutions converging to a
> configuration makes such tools less compelling than a
> using kickstart against a 'repoclosed' universe of packages.
>
> I am interested in the building of 'base JEOS' images to our
> virtualization service, that are then handed off as 'gold
> masters' for clinets who THEN inject their certificates, keys
> and credentials. There are of course security and liability
> implications in releasing images keyed to masters not known to
> the end user, and kickstart solves them well, and the devops
> tools less well
>
>> The tdl format is somewhat of a stop gap between kickstarts and fully
>> fledged provisioning I have found, and a good project providing many
>> example tdls is the Aeolus project: http://www.aeolusproject.org/
>
> I am generally aware of it as a project, and I think follow a
> blog on the matter, but not a mailing list. I'll remedy that
> and read for a bit. But packaging Ruby has been a 'bear' and
> seemed to be 'not well solved' yet. I have no aversion to Ruby
> -- we use it on a project internally -- but adding random
> 'gems' not well understood as to versioning and security
> model, is troubling
>
> -- Russ herrold
11 years, 4 months
Re: future of Boxgrinder ... building cloud images
by Steve Loranz
I completely agree with this. I didn't mean for it to seem otherwise.
-steve
On Dec 18, 2012, at 2:03 PM, cloud-request(a)lists.fedoraproject.org wrote:
> ------------------------------
>
> Message: 7
> Date: Tue, 18 Dec 2012 20:03:51 +0000
> From: Tim Bell <Tim.Bell(a)cern.ch>
> To: Fedora Cloud SIG <cloud(a)lists.fedoraproject.org>,
> "herrold(a)owlriver.com" <herrold(a)owlriver.com>
> Subject: RE: cloud Digest, Vol 36, Issue 24
> Message-ID:
> <5D7F9996EA547448BC6C54C8C5AAF4E5A856BF9B(a)CERNXCHG01.cern.ch>
> Content-Type: text/plain; charset="utf-8"
>
>
> I don’t see an image factory approach and a puppet approach as being competitors.
>
> We need to find ways to produce common images for multiple hypervisors in an automated fashion. Booting VMs and then waiting 30 minutes for a yum update (or even worse, waiting an hour for Office 2013 to install) is not exactly elastic computing so a regular run of standard version builds is a key function.
>
> Puppet provides the function to take the base images and create the custom configurations.
>
> Organising up-to-date standard images for the common platforms and then the 'last-mile' via puppet seems efficient.
>
> (I use Puppet as an example, Chef would be equally appropriate)
>
> Tim
>
>> -----Original Message-----
>> From: cloud-bounces(a)lists.fedoraproject.org [mailto:cloud-
>> bounces(a)lists.fedoraproject.org] On Behalf Of Steve Loranz
>> Sent: 18 December 2012 19:13
>> To: herrold(a)owlriver.com
>> Cc: cloud(a)lists.fedoraproject.org
>> Subject: Re: cloud Digest, Vol 36, Issue 24
>>
>> Russ,
>>
>> Apologies if I'm misinterpreting what you're saying here, but I think that
>> imagefactory can do what you are looking for. The core of imagefactory
>> supplies the REST interface, CLI, provides some storage for built images, and
>> manages dispatching work to the plugins. The plugins do the heavy lifting and
>> these are separated as OS and Cloud plugins. We currently have one OS plugin
>> that started off as Fedora/RHEL specific and uses Oz to create a base JEOS
>> image. All of the customization that creates a target image from a base image
>> is done by a cloud plugin.
>>
>> So, you could have a very minimal TDL that creates a minimal base JEOS
>> image. You could then supply your own Cloud plugin for your virt service that
>> does the customization you want.
>>
>> The imagefactory project is packaged separately from Aeolus and can be used
>> without any other component from Aeolus. Oz is used by the current OS plugin,
>> but that plugin can be replaced by another that uses some other method of
>> provisioning.
>>
>> -steve
11 years, 4 months
future of Boxgrinder ... building cloud images
by R P Herrold
in the IRC channel, I am advised by 'msavy' that Boxgrinder is
on a path to end as a project, and transition into:
http://imgfac.org/
which uses underneath: oz
https://github.com/clalancette/oz
Seemingly also, the former (and somewhat broken)
appliance-creator goes away
My goal is to be able to get to an TUI tool:
image building image
that accepts kickstart config files as input, and emits
runnable new images of various type, and it looked as though I
could graft on the needed elements to Boxgrinder. There is a
lot of churn, for example on the Fedora 'cloud' sig mailing
list, and on corresponding Debian list, on what to include, or
exclude from pre-built cloud images.
I think those 'cloud' working groups are solving the wrong
problem at the wrong place, [some want JEOS to include a
listening sshd, and package install tool; others want rsync,
or man, or more, or less ... the preferences never end and
there is no 'right answer']
An:
image building image
decouples those design preferences and moves solving those
issues into a flat text specification ( a 'ks.cfg', etc) that
will work well in a version control system (unlike using a GUI
front end which does not)
-- Russ herrold
11 years, 4 months
to ec2-user or not to ec2-user?
by Matthew Miller
Amazon recommends using ec2-user (with passwordless sudo) for EC2 images.
That's what Fedora has been doing. Do we want to continue this? Arguments:
A. It doesn't really provide any added security, but does add complication.
Additionally, normal "don't run as root" advice is less important since
cloud instances should be ephemeral and recreatable.
B. But, consistency.
What's our SIG consensus here?
Other points:
- We're making images for EC2 and for other cloud systems as well.
'ec2-user' seems particularly silly on, say, OpenStack.
- We could use ec2-user and something else (including just root) on the
generic images.
- We should decide this really fast because it's already past the last
minute; default is to just stay with ec2-user for F18 and revisit for
F19.
--
Matthew Miller ☁☁☁ Fedora Cloud Architect ☁☁☁ <mattdm(a)fedoraproject.org>
11 years, 4 months
ec2/fedora-18-i386-ec2.ks ec2/fedora-18-x86_64-ec2.ks
by Dennis Gilmore
ec2/fedora-18-i386-ec2.ks | 6 +-----
ec2/fedora-18-x86_64-ec2.ks | 6 +-----
2 files changed, 2 insertions(+), 10 deletions(-)
New commits:
commit 30b961ac4cc0e84cfd092fdd07980e135a6070ce
Author: Dennis Gilmore <dennis(a)ausil.us>
Date: Tue Dec 18 10:46:06 2012 -0600
changes to firewall setup with switch to firewalld
diff --git a/ec2/fedora-18-i386-ec2.ks b/ec2/fedora-18-i386-ec2.ks
index 2792cda..742fec6 100644
--- a/ec2/fedora-18-i386-ec2.ks
+++ b/ec2/fedora-18-i386-ec2.ks
@@ -30,6 +30,7 @@ repo --name=fedora --mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo
pciutils
kernel-PAE
man-db
+firewalld
-biosdevname
@@ -67,11 +68,6 @@ sed -i -e 's/timeout=5/timeout=0/' \
-e '/splashimage/d' \
/boot/grub/grub.conf
-# the firewall rules get saved as .old without this we end up not being able
-# ssh in as iptables blocks access
-
-rename -v .old "" /etc/sysconfig/*old
-
# symlink grub.conf to menu.lst for use by EC2 pv-grub
pushd /boot/grub
ln -s grub.conf menu.lst
diff --git a/ec2/fedora-18-x86_64-ec2.ks b/ec2/fedora-18-x86_64-ec2.ks
index 090e1bf..ccfa11e 100644
--- a/ec2/fedora-18-x86_64-ec2.ks
+++ b/ec2/fedora-18-x86_64-ec2.ks
@@ -35,6 +35,7 @@ repo --name=fedora --mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo
pciutils
kernel
man-db
+firewalld
-biosdevname
@@ -72,11 +73,6 @@ sed -i -e 's/timeout=5/timeout=0/' \
-e '/splashimage/d' \
/boot/grub/grub.conf
-# the firewall rules get saved as .old without this we end up not being able
-# ssh in as iptables blocks access
-
-rename -v .old "" /etc/sysconfig/*old
-
# symlink grub.conf to menu.lst for use by EC2 pv-grub
pushd /boot/grub
ln -s grub.conf menu.lst
11 years, 4 months
6 commits - generic/fedora-18-x86_64-cloud.ks generic/fedora-18-x86_64.ks generic/fedora-18-x86_64-minimal.ks
by Matthew Miller
generic/fedora-18-x86_64-cloud.ks | 135 ++++++++++++++++++++++++++++--------
generic/fedora-18-x86_64-minimal.ks | 14 ++-
generic/fedora-18-x86_64.ks | 132 +++++++++++++++++++++++++++--------
3 files changed, 218 insertions(+), 63 deletions(-)
New commits:
commit 33d2a933ca055d39984a338d164e389279600a49
Author: Matthew Miller <mattdm(a)mattdm.org>
Date: Thu Dec 13 15:39:14 2012 -0500
bring changes from other files into this one
diff --git a/generic/fedora-18-x86_64-cloud.ks b/generic/fedora-18-x86_64-cloud.ks
index 72225ec..cd8b30a 100644
--- a/generic/fedora-18-x86_64-cloud.ks
+++ b/generic/fedora-18-x86_64-cloud.ks
@@ -4,69 +4,146 @@
# ssh keys. That also currently creates an ec2-user account; we'll probably
# want to make that something generic by default. The root password is empty
# by default.
+#
+# Note that unlike the standard F18 install, this image has /tmp on disk
+# rather than in tmpfs, since memory is usually at a premium.
lang en_US.UTF-8
keyboard us
timezone --utc America/New_York
+
auth --useshadow --enablemd5
selinux --enforcing
-firewall --service=ssh
-bootloader --timeout=3 --location=mbr --driveorder=sda
-network --bootproto=dhcp --device=eth0 --onboot=on
-services --enabled=network,sshd,rsyslog
+# this is actually not used, but a static firewall
+# matching these rules is generated below.
+firewall --service=ssh --service=http --service=https
+
+bootloader --timeout=0 --location=mbr --driveorder=sda
+
+network --bootproto=dhcp --device=eth0 --onboot=on
+services --enabled=network,sshd,rsyslog,iptables,cloud-init,cloud-init-local,cloud-config,cloud-final
-# Define how large you want your rootfs to be
part biosboot --fstype=biosboot --size=1 --ondisk sda
-part / --size 4000 --fstype ext4 --ondisk sda
+part / --size 4096 --fstype ext4 --ondisk sda
# Repositories
repo --name=fedora --mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=fedora-18&arch=$basearch
-# We start with @core, and then add a few more packages to make a nice
-# functional Fedora-like but still reasonably minimal cloud image.
+
+# Package list.
%packages --nobase
@core
-cloud-init
kernel
+
+# cloud-init does magical things with EC2 metadata, including provisioning
+# a user account with ssh keys.
+cloud-init
+
+# Not needed with pv-grub (as in EC2). Would be nice to have
+# something smaller for F19 (syslinux?), but this is what we have now.
grub2
-# if we're not going to be installing firewalld, we need this
+
+# Needed initially, but removed below.
+firewalld
+
+# Basic firewall. If you're going to rely on your cloud service's
+# security groups you can remove this.
iptables-services
-# and, some things from @core we can do without
+# cherry-pick a few things from @standard
+logrotate
+tmpwatch
+tar
+rsync
+
+# Some things from @core we can do without in a minimal install
-biosdevname
-plymouth
--linux-firmware
-NetworkManager
-polkit
%end
-# more ec2-ify
-%post --erroronfail
-cat <<EOL > /etc/fstab
-LABEL=_/ / ext4 defaults 1 1
-proc /proc proc defaults 0 0
-sysfs /sys sysfs defaults 0 0
-devpts /dev/pts devpts gid=5,mode=620 0 0
-tmpfs /dev/shm tmpfs defaults 0 0
-EOL
+%post --erroronfail
-# grub tweaks
-cat <<EOL > /etc/default/grub
-GRUB_TIMEOUT=0
-EOL
-sed -ie 's/^set timeout=5/set timeout=0/' /boot/grub2/grub.cfg
+echo -n "Writing fstab"
+cat <<EOF > /etc/fstab
+LABEL=_/ / ext4 defaults 1 1
+EOF
+echo .
+
+echo -n "Grub tweaks"
+echo GRUB_TIMEOUT=0 > /etc/default/grub
+sed -i 's/^set timeout=5/set timeout=0/' /boot/grub2/grub.cfg
+sed -i '1i# This file is for use with pv-grub; legacy grub is not installed in this image' /boot/grub2/grub.cfg
+sed -i 's/^timeout=5/timeout=0/' /boot/grub/grub.conf
+# need to file a bug on this one
+sed -i 's/root=.*/root=LABEL=_\//' /boot/grub/grub.conf
+echo .
+echo -n "Linking menu.lst to old-style grub.conf for pv-grub"
+mv /boot/grub/grub.conf /boot/grub/menu.lst
+ln -s /boot/grub/menu.lst /etc/grub.conf
-# for EC2, need to figure out how to set up menu.list for pv-grub
# setup systemd to boot to the right runlevel
+echo -n "Setting default runlevel to multiuser text mode"
rm -f /etc/systemd/system/default.target
ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
-
-# TODO: fix firewall
+echo .
+
+# If you want to remove rsyslog and just use journald, also uncomment this.
+#echo -n "Enabling persistent journal"
+#mkdir /var/log/journal/
+#echo .
+
+# this is installed by default but we don't need it in virt
+echo "Removing linux-firmware package."
+yum -C -y remove linux-firmware
+
+# Remove firewalld; was supposed to be optional in F18, but is required to
+# be present for install/image building.
+echo "Removing firewalld and dependencies"
+yum -C -y remove firewalld
+# These are all pulled in by firewalld (libselinux-python is too, but
+# is also required by cloud-init).
+yum -C -y remove cairo dbus-glib dbus-python ebtables fontconfig fontpackages-filesystem gobject-introspection js libdrm libpciaccess libpng libwayland-client libwayland-server libX11 libX11-common libXau libxcb libXdamage libXext libXfixes libXrender libXxf86vm mesa-libEGL mesa-libgbm mesa-libGL mesa-libglapi pixman polkit pycairo pygobject2 pygobject3 python-decorator python-slip python-slip-dbus
+
+# Non-firewalld-firewall
+echo -n "Writing static firewall"
+cat <<EOF > /etc/sysconfig/iptables
+# Simple static firewall loaded by iptables.service. Replace
+# this with your own custom rules, run lokkit, or switch to
+# shorewall or firewalld as your needs dictate.
+*filter
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+-A INPUT -p icmp -j ACCEPT
+-A INPUT -i lo -j ACCEPT
+-A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 22 -j ACCEPT
+-A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 80 -j ACCEPT
+-A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 443 -j ACCEPT
+-A INPUT -j REJECT --reject-with icmp-host-prohibited
+-A FORWARD -j REJECT --reject-with icmp-host-prohibited
+COMMIT
+EOF
+echo .
+
+# Because memory is scarce resource in most cloud/virt environments,
+# and because this impedes forensics, we are differing from the Fedora
+# default of having /tmp on tmpfs.
+echo "Disabling tmpfs for /tmp."
+systemctl mask tmp.mount
+
+echo "Zeroing out empty space."
+# This forces the filesystem to reclaim space from deleted files
+dd bs=1M if=/dev/zero of=/var/tmp/zeros || :
+rm -f /var/tmp/zeros
+echo "(Don't worry -- that out-of-space error was expected.)"
%end
commit b191d941256245f6c504d3c251dea4e14f9480b4
Author: Matthew Miller <mattdm(a)mattdm.org>
Date: Thu Dec 13 14:55:51 2012 -0500
tar and rsync for staging files to images (small, add no new deps)
diff --git a/generic/fedora-18-x86_64.ks b/generic/fedora-18-x86_64.ks
index 11a1647..a49ad26 100644
--- a/generic/fedora-18-x86_64.ks
+++ b/generic/fedora-18-x86_64.ks
@@ -48,6 +48,8 @@ iptables-services
# cherry-pick a few things from @standard
logrotate
tmpwatch
+tar
+rsync
# Some things from @core we can do without in a minimal install
-biosdevname
commit a470988f6dffb9f69074d775d9751f9e5ca10fed
Author: Matthew Miller <mattdm(a)mattdm.org>
Date: Thu Dec 13 14:55:04 2012 -0500
use rsyslog in this version, and include tmpwatch and logrotate to keep the
system clean.
diff --git a/generic/fedora-18-x86_64.ks b/generic/fedora-18-x86_64.ks
index 27047d2..11a1647 100644
--- a/generic/fedora-18-x86_64.ks
+++ b/generic/fedora-18-x86_64.ks
@@ -45,6 +45,10 @@ firewalld
# security groups you can remove this.
iptables-services
+# cherry-pick a few things from @standard
+logrotate
+tmpwatch
+
# Some things from @core we can do without in a minimal install
-biosdevname
-plymouth
@@ -82,10 +86,10 @@ rm -f /etc/systemd/system/default.target
ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
echo .
-# because we didn't install rsyslog, enable persistent journal
-echo -n "Enabling persistent journal"
-mkdir /var/log/journal/
-echo .
+# If you want to remove rsyslog and just use journald, also uncomment this.
+#echo -n "Enabling persistent journal"
+#mkdir /var/log/journal/
+#echo .
# this is installed by default but we don't need it in virt
echo "Removing linux-firmware package."
commit 6a583eff6c8ef06c9941c3cd325342d54756e945
Author: Matthew Miller <mattdm(a)mattdm.org>
Date: Thu Dec 13 14:40:56 2012 -0500
4GB image size instead of 1GB
diff --git a/generic/fedora-18-x86_64.ks b/generic/fedora-18-x86_64.ks
index c67ec31..27047d2 100644
--- a/generic/fedora-18-x86_64.ks
+++ b/generic/fedora-18-x86_64.ks
@@ -21,7 +21,7 @@ services --enabled=network,sshd,rsyslog,iptables
part biosboot --fstype=biosboot --size=1 --ondisk sda
-part / --size 1024 --fstype ext4 --ondisk sda
+part / --size 4096 --fstype ext4 --ondisk sda
# Repositories
repo --name=fedora --mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=fedora-18&arch=$basearch
commit 35d5ce5415307da7f45c87c74c51000a93e871a5
Author: Matthew Miller <mattdm(a)mattdm.org>
Date: Thu Dec 13 14:32:31 2012 -0500
copy in everything from the -minimal version, but take out the
ultra-minimalization
diff --git a/generic/fedora-18-x86_64.ks b/generic/fedora-18-x86_64.ks
index dd0b1f7..c67ec31 100644
--- a/generic/fedora-18-x86_64.ks
+++ b/generic/fedora-18-x86_64.ks
@@ -1,68 +1,136 @@
# This is a basic Fedora 18 spin designed to work in OpenStack and other
-# private cloud environments. This version is _not_ configured with cloud
-# init. The root password is empty by default.
+# private cloud environments. This flavor isn't configured with cloud-init
+# or any other metadata service; you'll need your own say of getting
+# user (or root) credentials on the system.
lang en_US.UTF-8
keyboard us
timezone --utc America/New_York
+
auth --useshadow --enablemd5
selinux --enforcing
-firewall --service=ssh
-bootloader --timeout=3 --location=mbr --driveorder=sda
+
+# this is actually not used, but a static firewall
+# matching these rules is generated below.
+firewall --service=ssh --service=http --service=https
+
+bootloader --timeout=0 --location=mbr --driveorder=sda
+
network --bootproto=dhcp --device=eth0 --onboot=on
-services --enabled=network,sshd,rsyslog
+services --enabled=network,sshd,rsyslog,iptables
-# Define how large you want your rootfs to be
part biosboot --fstype=biosboot --size=1 --ondisk sda
-part / --size 4000 --fstype ext4 --ondisk sda
+part / --size 1024 --fstype ext4 --ondisk sda
# Repositories
repo --name=fedora --mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=fedora-18&arch=$basearch
-# We start with @core, and then add a few more packages to make a nice
-# functional Fedora-like but still reasonably minimal cloud image.
+
+# Package list.
+# Just the basics, here.
+
%packages --nobase
@core
kernel
+
+# Not needed with pv-grub (as in EC2). Would be nice to have
+# something smaller for F19 (syslinux?), but this is what we have now.
grub2
-# if we're not going to be installing firewalld, we need this
+
+# Needed initially, but removed below.
+firewalld
+
+# Basic firewall. If you're going to rely on your cloud service's
+# security groups you can remove this.
iptables-services
-# and, some things from @core we can do without
+# Some things from @core we can do without in a minimal install
-biosdevname
-plymouth
--linux-firmware
-NetworkManager
-polkit
%end
-# more ec2-ify
-%post --erroronfail
-cat <<EOL > /etc/fstab
-LABEL=_/ / ext4 defaults 1 1
-proc /proc proc defaults 0 0
-sysfs /sys sysfs defaults 0 0
-devpts /dev/pts devpts gid=5,mode=620 0 0
-tmpfs /dev/shm tmpfs defaults 0 0
-EOL
+%post --erroronfail
-# grub tweaks
-cat <<EOL > /etc/default/grub
-GRUB_TIMEOUT=0
-EOL
-sed -ie 's/^set timeout=5/set timeout=0/' /boot/grub2/grub.cfg
+echo -n "Writing fstab"
+cat <<EOF > /etc/fstab
+LABEL=_/ / ext4 defaults 1 1
+EOF
+echo .
+
+echo -n "Grub tweaks"
+echo GRUB_TIMEOUT=0 > /etc/default/grub
+sed -i 's/^set timeout=5/set timeout=0/' /boot/grub2/grub.cfg
+sed -i '1i# This file is for use with pv-grub; legacy grub is not installed in this image' /boot/grub2/grub.cfg
+sed -i 's/^timeout=5/timeout=0/' /boot/grub/grub.conf
+# need to file a bug on this one
+sed -i 's/root=.*/root=LABEL=_\//' /boot/grub/grub.conf
+echo .
+echo -n "Linking menu.lst to old-style grub.conf for pv-grub"
+mv /boot/grub/grub.conf /boot/grub/menu.lst
+ln -s /boot/grub/menu.lst /etc/grub.conf
-# for EC2, need to figure out how to set up menu.list for pv-grub
# setup systemd to boot to the right runlevel
+echo -n "Setting default runlevel to multiuser text mode"
rm -f /etc/systemd/system/default.target
ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
-
-# TODO: fix firewall
+echo .
+
+# because we didn't install rsyslog, enable persistent journal
+echo -n "Enabling persistent journal"
+mkdir /var/log/journal/
+echo .
+
+# this is installed by default but we don't need it in virt
+echo "Removing linux-firmware package."
+yum -C -y remove linux-firmware
+
+# Remove firewalld; was supposed to be optional in F18, but is required to
+# be present for install/image building.
+echo "Removing firewalld and dependencies"
+yum -C -y remove firewalld
+# These are all pulled in by firewalld
+yum -C -y remove cairo dbus-glib dbus-python ebtables fontconfig fontpackages-filesystem gobject-introspection js libdrm libpciaccess libpng libselinux-python libwayland-client libwayland-server libX11 libX11-common libXau libxcb libXdamage libXext libXfixes libXrender libXxf86vm mesa-libEGL mesa-libgbm mesa-libGL mesa-libglapi pixman polkit pycairo pygobject2 pygobject3 python-decorator python-slip python-slip-dbus
+
+# Non-firewalld-firewall
+echo -n "Writing static firewall"
+cat <<EOF > /etc/sysconfig/iptables
+# Simple static firewall loaded by iptables.service. Replace
+# this with your own custom rules, run lokkit, or switch to
+# shorewall or firewalld as your needs dictate.
+*filter
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+-A INPUT -p icmp -j ACCEPT
+-A INPUT -i lo -j ACCEPT
+-A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 22 -j ACCEPT
+-A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 80 -j ACCEPT
+-A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 443 -j ACCEPT
+-A INPUT -j REJECT --reject-with icmp-host-prohibited
+-A FORWARD -j REJECT --reject-with icmp-host-prohibited
+COMMIT
+EOF
+echo .
+
+# Because memory is scarce resource in most cloud/virt environments,
+# and because this impedes forensics, we are differing from the Fedora
+# default of having /tmp on tmpfs.
+echo "Disabling tmpfs for /tmp."
+systemctl mask tmp.mount
+
+echo "Zeroing out empty space."
+# This forces the filesystem to reclaim space from deleted files
+dd bs=1M if=/dev/zero of=/var/tmp/zeros || :
+rm -f /var/tmp/zeros
+echo "(Don't worry -- that out-of-space error was expected.)"
%end
commit d63f76a48e2b5d9fa5f660b09dd4fd8481196998
Author: Matthew Miller <mattdm(a)mattdm.org>
Date: Thu Dec 13 14:30:21 2012 -0500
update note on ultra-minimal
diff --git a/generic/fedora-18-x86_64-minimal.ks b/generic/fedora-18-x86_64-minimal.ks
index 82d4ea7..d317b7e 100644
--- a/generic/fedora-18-x86_64-minimal.ks
+++ b/generic/fedora-18-x86_64-minimal.ks
@@ -1,9 +1,13 @@
# This is a basic Fedora 18 spin designed to work in OpenStack and other
-# private cloud environments. It's configured with cloud-init so it will
-# take advantage of ec2-compatible metadata services for provisioning
-# ssh keys. That also currently creates an ec2-user account; we'll probably
-# want to make that something generic by default. The root password is empty
-# by default.
+# private cloud environments. This particular kickstart is designed to
+# be as obsessively minimal as we can be and still be Fedora. Because
+# this has not traditionally been a priority, that's not particularly
+# very small, making this in some ways an academic exercise, but it's also
+# a base for the more complete kickstarts.
+#
+# If you're interested in making this more minimal, big problems to solve
+# are the not-needed-for-cloud kernel modules and the gigantic locale
+# database. After that, it's chipping at dependencies.
lang en_US.UTF-8
keyboard us
11 years, 4 months
user-data via CDROM
by Shahar Havivi
Hi,
I am trying to configure RHEL 6.3 via cloud-init.
I am using cloud-init-0.6.3-0.7.bzr532.el6.noarch package and have a RHEL 6.3
guest os.
iso format ant label are:
[root@vm-17-184 cloudinit]# blkid /dev/sr0
/dev/sr0: LABEL="cidata" TYPE="iso9660"
iso file content:
[root@vm-17-184 cdrom]# cat meta-data
instance-id: iid-abcdefg
network-interfaces: |
iface eth0 inet static
address 192.168.1.10
network 192.168.1.0
netmask 255.255.255.0
broadcast 192.168.1.255
gateway 192.168.1.254
and I try the user-data file:
[root@vm-17-184 ~]# cat cdrom/user-data
hostname: mynode
fqdn: mynode.example.com
manage_etc_hosts: true
There is no effect on the IP address or host name, am I doing something wrong?
Attached the cloud-init.log
Thank you,
Shahar Havivi.
11 years, 4 months
generic/fedora-18-x86_64-cloud.ks
by Matthew Miller
generic/fedora-18-x86_64-cloud.ks | 68 ++++++++++++++++++++++++++++++++++++++
1 file changed, 68 insertions(+)
New commits:
commit 0944412c942864363e49b5bcf66a9faa2c5f3193
Author: Matthew Miller <mattdm(a)mattdm.org>
Date: Sun Dec 16 13:50:53 2012 -0500
Work around cloud-init 0.7.1 config file change, in case 0.7.1-2 doesn't make the cut.
(This can be pulled out later, if it does.)
diff --git a/generic/fedora-18-x86_64-cloud.ks b/generic/fedora-18-x86_64-cloud.ks
index 38ceed4..db04391 100644
--- a/generic/fedora-18-x86_64-cloud.ks
+++ b/generic/fedora-18-x86_64-cloud.ks
@@ -143,6 +143,74 @@ systemctl mask tmp.mount
#disable_root: 0
#EOF
+# Temporary kludge in case https://bugzilla.redhat.com/show_bug.cgi?id=887363
+# does not make F18 final release.
+if [[ $( rpm -q --qf '%{v}-%{r}' cloud-init) == "0.7.1-1.fc18" ]]; then
+echo "Detected older cloud-init; generating config file now."
+cat <<EOF > /etc/cloud/cloud.cfg
+users:
+ - default
+
+disable_root: 1
+ssh_pwauth: 0
+
+locale_configfile: /etc/sysconfig/i18n
+mount_default_fields: [~, ~, 'auto', 'defaults,nofail', '0', '2']
+resize_rootfs_tmp: /dev
+ssh_deletekeys: 0
+ssh_genkeytypes: ~
+syslog_fix_perms: ~
+
+cloud_init_modules:
+ - bootcmd
+ - write-files
+ - resizefs
+ - set_hostname
+ - update_hostname
+ - update_etc_hosts
+ - rsyslog
+ - users-groups
+ - ssh
+
+cloud_config_modules:
+ - mounts
+ - locale
+ - set-passwords
+ - timezone
+ - puppet
+ - chef
+ - salt-minion
+ - mcollective
+ - disable-ec2-metadata
+ - runcmd
+
+cloud_final_modules:
+ - rightscale_userdata
+ - scripts-per-once
+ - scripts-per-boot
+ - scripts-per-instance
+ - scripts-user
+ - ssh-authkey-fingerprints
+ - keys-to-console
+ - phone-home
+ - final-message
+
+system_info:
+ default_user:
+ name: ec2-user
+ lock_passwd: true
+ gecos: EC2 user
+ groups: [wheel, adm]
+ sudo: ["ALL=(ALL) NOPASSWD:ALL"]
+ shell: /bin/bash
+ distro: fedora
+ paths:
+ cloud_dir: /var/lib/cloud
+ templates_dir: /etc/cloud/templates
+ ssh_svcname: sshd
+# vim:syntax=yaml
+EOF
+fi
echo "Zeroing out empty space."
11 years, 4 months
