[Fedora-spins] [spin-kickstarts] add cloud image kickstarts, pulled from the cloud-kickstart repo, we have different snippets per arc

commit 8bf40fdc8e1c097385faaa6a64c4a8944598150c Author: Dennis Gilmore <dennis(a)ausil.us&gt; Date: Sat Oct 26 08:41:43 2013 -0500 add cloud image kickstarts, pulled from the cloud-kickstart repo, we have different snippets per arch because they need different kernels fedora-cloud-base.ks | 236 ++++++++++++++++++++++++++++++++++++++++++++++++ fedora-i386-cloud.ks | 20 ++++ fedora-x86_64-cloud.ks | 16 ++++ 3 files changed, 272 insertions(+), 0 deletions(-) --- diff --git a/fedora-cloud-base.ks b/fedora-cloud-base.ks new file mode 100644 index 0000000..15e6b70 --- /dev/null +++ b/fedora-cloud-base.ks @@ -0,0 +1,236 @@ +# This is a basic Fedora 20 spin designed to work in OpenStack and other +# private cloud environments. It's configured with cloud-init so it will +# take advantage of ec2-compatible metadata services for provisioning ssh +# keys. Cloud-init creates a user account named "fedora" with passwordless +# sudo access. The root password is empty and locked by default. +# +# Note that unlike the standard F20 install, this image has /tmp on disk +# rather than in tmpfs, since memory is usually at a premium. +# +# This kickstart file is designed to be used with appliance-creator and +# may need slight modification for use with actual anaconda or other tools. +# We intend to target anaconda-in-a-vm style image building for F20. + +lang en_US.UTF-8 +keyboard us +timezone --utc Etc/UTC + +auth --useshadow --enablemd5 +selinux --enforcing +rootpw --lock --iscrypted locked + +# this is actually not used, but a static firewall +# matching these rules is generated below. +firewall --service=ssh + +bootloader --timeout=1 --append="console=ttyS0,115200n8 console=tty0" extlinux + +network --bootproto=dhcp --device=eth0 --onboot=on +services --enabled=network,sshd,rsyslog,iptables,cloud-init,cloud-init-local,cloud-config,cloud-final + + +zerombr +clearpart --all +part / --size 2048 --fstype ext4 + +%include fedora-repo.ks + + +reboot + +# Package list. +%packages +@core +grubby + +# cloud-init does magical things with EC2 metadata, including provisioning +# a user account with ssh keys. +cloud-init + +# this is used by openstack's cloud orchestration framework (and it's small) +heat-cfntools + +# need this for growpart, because parted doesn't yet support resizepart +# https://bugzilla.redhat.com/show_bug.cgi?id=966993 +cloud-utils-growpart + +# We need this image to be portable; also, rescue mode isn't useful here. +dracut-config-generic +-dracut-config-rescue + +syslinux-extlinux + +# Needed initially, but removed below. +firewalld + +# Basic firewall. If you're going to rely on your cloud service's +# security groups you can remove this. +iptables-services + +# cherry-pick a few things from @standard +tar +rsync + +# Some things from @core we can do without in a minimal install +-biosdevname +-plymouth +-NetworkManager +-iprutils +-kbd + +%end + + + +%post --erroronfail + +# Create grub.conf for EC2. This used to be done by appliance creator but +# anaconda doesn't do it. And, in case appliance-creator is used, we're +# overriding it here so that both cases get the exact same file. +# Note that the console line is different -- that's because EC2 provides +# different virtual hardware, and this is a convenient way to act differently +echo -n "Creating grub.conf for pvgrub" +rootuuid=$( awk '$2=="/" { print $1 };' /etc/fstab ) +mkdir /boot/grub +echo -e 'default=0\ntimeout=0\n\n' > /boot/grub/grub.conf +for kv in $( ls -1v /boot/vmlinuz* |grep -v rescue |sed s/.*vmlinuz-// ); do + echo "title Fedora ($kv)" >> /boot/grub/grub.conf + echo -e "\troot (hd0)" >> /boot/grub/grub.conf + echo -e "\tkernel /boot/vmlinuz-$kv ro root=$rootuuid console=hvc0 LANG=en_US.UTF-8" >> /boot/grub/grub.conf + echo -e "\tinitrd /boot/initramfs-$kv.img" >> /boot/grub/grub.conf + echo +done + + +#link grub.conf to menu.lst for ec2 to work +echo -n "Linking menu.lst to old-style grub.conf for pv-grub" +ln -sf grub.conf /boot/grub/menu.lst +ln -sf /boot/grub/grub.conf /etc/grub.conf + +# older versions of livecd-tools do not follow "rootpw --lock" line above +# https://bugzilla.redhat.com/show_bug.cgi?id=964299 +passwd -l root + +# Kickstart specifies timeout in seconds; syslinux uses 10ths. +# 0 means wait forever, so instead we'll go with 1. +sed -i 's/^timeout 10/timeout 1/' /boot/extlinux/extlinux.conf + +# setup systemd to boot to the right runlevel +echo -n "Setting default runlevel to multiuser text mode" +rm -f /etc/systemd/system/default.target +ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target +echo . + +# If you want to remove rsyslog and just use journald, remove this! +echo -n "Disabling persistent journal" +rmdir /var/log/journal/ +echo . + +# this is installed by default but we don't need it in virt +echo "Removing linux-firmware package." +yum -C -y remove linux-firmware + +# Remove firewalld; was supposed to be optional in F18+, but is required to +# be present for install/image building. +echo "Removing firewalld." +yum -C -y remove firewalld --setopt="clean_requirements_on_remove=1" + +# Non-firewalld-firewall +echo -n "Writing static firewall" +cat <<EOF > /etc/sysconfig/iptables +# Simple static firewall loaded by iptables.service. Replace +# this with your own custom rules, run lokkit, or switch to +# shorewall or firewalld as your needs dictate. +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT +-A INPUT -p icmp -j ACCEPT +-A INPUT -i lo -j ACCEPT +-A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 22 -j ACCEPT +#-A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 80 -j ACCEPT +#-A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 443 -j ACCEPT +-A INPUT -j REJECT --reject-with icmp-host-prohibited +-A FORWARD -j REJECT --reject-with icmp-host-prohibited +COMMIT +EOF +echo . + +# Another one needed at install time but not after that, and it pulls +# in some unneeded deps (like, newt and slang) +echo "Removing authconfig." +yum -C -y remove authconfig --setopt="clean_requirements_on_remove=1" + +echo -n "Getty fixes" +# although we want console output going to the serial console, we don't +# actually have the opportunity to login there. FIX. +# we don't really need to auto-spawn _any_ gettys. +sed -i '/^#NAutoVTs=.*/ a\ +NAutoVTs=0' /etc/systemd/logind.conf + +echo -n "Network fixes" +# initscripts don't like this file to be missing. +cat > /etc/sysconfig/network << EOF +NETWORKING=yes +NOZEROCONF=yes +EOF + +# For cloud images, 'eth0' _is_ the predictable device name, since +# we don't want to be tied to specific virtual (!) hardware +rm -f /etc/udev/rules.d/70* +ln -s /dev/null /etc/udev/rules.d/80-net-name-slot.rules + +# simple eth0 config, again not hard-coded to the build hardware +cat > /etc/sysconfig/network-scripts/ifcfg-eth0 << EOF +DEVICE="eth0" +BOOTPROTO="dhcp" +ONBOOT="yes" +TYPE="Ethernet" +EOF + +# generic localhost names +cat > /etc/hosts << EOF +127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 +::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 + +EOF +echo . + + +# Because memory is scarce resource in most cloud/virt environments, +# and because this impedes forensics, we are differing from the Fedora +# default of having /tmp on tmpfs. +echo "Disabling tmpfs for /tmp." +systemctl mask tmp.mount + +# make sure firstboot doesn't start +echo "RUN_FIRSTBOOT=NO" > /etc/sysconfig/firstboot + +# Uncomment this if you want to use cloud init but suppress the creation +# of an "ec2-user" account. This will, in the absence of further config, +# cause the ssh key from a metadata source to be put in the root account. +#cat <<EOF > /etc/cloud/cloud.cfg.d/50_suppress_ec2-user_use_root.cfg +#users: [] +#disable_root: 0 +#EOF + +echo "Removing random-seed so it's not the same in every image." +rm -f /var/lib/random-seed + +echo "Cleaning old yum repodata." +yum history new +yum clean all +truncate -c -s 0 /var/log/yum.log + +echo "Fixing SELinux contexts." +/usr/sbin/fixfiles -R -a restore + +echo "Zeroing out empty space." +# This forces the filesystem to reclaim space from deleted files +dd bs=1M if=/dev/zero of=/var/tmp/zeros || : +rm -f /var/tmp/zeros +echo "(Don't worry -- that out-of-space error was expected.)" + +%end + diff --git a/fedora-i386-cloud.ks b/fedora-i386-cloud.ks new file mode 100644 index 0000000..88adce9 --- /dev/null +++ b/fedora-i386-cloud.ks @@ -0,0 +1,20 @@ +%include fedora-cloud-base.ks + +# Package list. +%packages +kernel-PAE + +%end +%post +if [ ! -e /etc/sysconfig/kernel ]; then +echo "Creating /etc/sysconfig/kernel." +cat <<EOF > /etc/sysconfig/kernel +# UPDATEDEFAULT specifies if new-kernel-pkg should make +# new kernels the default +UPDATEDEFAULT=yes + +# DEFAULTKERNEL specifies the default kernel package type +DEFAULTKERNEL=kernel-PAE +EOF +fi +%end diff --git a/fedora-x86_64-cloud.ks b/fedora-x86_64-cloud.ks new file mode 100644 index 0000000..a13f6ac --- /dev/null +++ b/fedora-x86_64-cloud.ks @@ -0,0 +1,16 @@ +%packages +kernel +%end + +%post +if [ ! -e /etc/sysconfig/kernel ]; then +echo "Creating /etc/sysconfig/kernel." +cat <<EOF > /etc/sysconfig/kernel +# UPDATEDEFAULT specifies if new-kernel-pkg should make +# new kernels the default +UPDATEDEFAULT=yes + +# DEFAULTKERNEL specifies the default kernel package type +DEFAULTKERNEL=kernel +EOF +fi