Deploying RHEL 9 on Google Cloud Platform
Deploying RHEL 9 on Google Cloud Platform Red Hat Enterprise Linux 9 Obtaining RHEL system images and creating RHEL instances on GCP Red Hat Customer Content Services
provider = "gcp" [settings] bucket = "GCP_BUCKET" region = "GCP_STORAGE_REGION" object = "OBJECT_KEY" credentials = "GCP_CREDENTIALS" sudo base64 -w 0 cee-gcp-nasa-476a1fa485b7.json sudo composer-cli compose start BLUEPRINT-NAME gce IMAGE_KEY gcp-config.toml sudo composer-cli compose status base64 -w 0 "USD{GOOGLE_APPLICATION_CREDENTIALS}" provider = "gcp" [settings] provider = "gcp" [settings] credentials = "GCP_CREDENTIALS" [gcp] credentials = " PATH_TO_GCP_ACCOUNT_CREDENTIALS " virt-install --name kvmtest --memory 2048 --vcpus 2 --cdrom /home/username/Downloads/rhel9.iso,bus=virtio --os-variant=rhel9.0 subscription-manager register --auto-attach dnf install cloud-init systemctl enable --now cloud-init.service gcloud projects create my-gcp-project3 --name project3 ssh-keygen -t rsa -f ~/.ssh/google_compute_engine ssh -i ~/.ssh/google_compute_engine <username> @ <instance_external_ip> gcloud auth login gsutil mb gs://bucket_name qemu-img convert -f qcow2 -O raw rhel-9.0-sample.qcow2 disk.raw tar --format=oldgnu -Sczf disk.raw.tar.gz disk.raw gsutil cp disk.raw.tar.gz gs://bucket_name gcloud compute images create my-image-name --source-uri gs://my-bucket-name/disk.raw.tar.gz gcloud compute instances create myinstance3 --zone=us-central1-a --image test-iso2-image gcloud compute instances list ssh -i ~/.ssh/google_compute_engine <user_name>@<instance_external_ip> subscription-manager register --auto-attach insights-client register --display-name <display-name-value> gcloud auth login gsutil mb gs:// BucketName gsutil mb gs://rhel-ha-bucket qemu-img convert -f qcow2 ImageName .qcow2 -O raw disk.raw tar -Sczf ImageName .tar.gz disk.raw gsutil cp ImageName .tar.gz gs:// BucketName gcloud compute images create BaseImageName --source-uri gs:// BucketName / BaseImageName .tar.gz [admin@localhost ~] USD gcloud compute images create rhel-76-server --source-uri gs://user-rhelha/rhel-server-76.tar.gz Created [https://www.googleapis.com/compute/v1/projects/MyProject/global/images/rhel-server-76]. NAME PROJECT FAMILY DEPRECATED STATUS rhel-76-server rhel-ha-testing-on-gcp READY gcloud compute instances create BaseInstanceName --can-ip-forward --machine-type n1-standard-2 --image BaseImageName --service-account ServiceAccountEmail [admin@localhost ~] USD gcloud compute instances create rhel-76-server-base-instance --can-ip-forward --machine-type n1-standard-2 --image rhel-76-server --service-account account@project-name-on-gcp.iam.gserviceaccount.com Created [https://www.googleapis.com/compute/v1/projects/rhel-ha-testing-on-gcp/zones/us-east1-b/instances/rhel-76-server-base-instance]. NAME ZONE MACHINE_TYPE PREEMPTIBLE INTERNAL_IP EXTERNAL_IP STATUS rhel-76-server-base-instance us-east1-bn1-standard-2 10.10.10.3 192.227.54.211 RUNNING ssh root@PublicIPaddress subscription-manager repos --disable= * subscription-manager repos --enable=rhel-9-server-rpms dnf update -y metadata.google.internal iburst Google NTP server rm -f /etc/udev/rules.d/70-persistent-net.rules rm -f /etc/udev/rules.d/75-persistent-net-generator.rules chkconfig network on systemctl enable sshd systemctl is-enabled sshd ln -sf /usr/share/zoneinfo/UTC /etc/localtime Server times out connections after several minutes of inactivity. Keep alive ssh connections by sending a packet every 7 minutes. ServerAliveInterval 420 PermitRootLogin no PasswordAuthentication no AllowTcpForwarding yes X11Forwarding no PermitTunnel no Compute times out connections after 10 minutes of inactivity. Keep ssh connections alive by sending a packet every 7 minutes. ClientAliveInterval 420 ssh_pwauth from 1 to 0. ssh_pwauth: 0 subscription-manager unregister export HISTSIZE=0 sync gcloud compute disks snapshot InstanceName --snapshot-names SnapshotName gcloud compute images create ConfiguredImageFromSnapshot --source-snapshot SnapshotName gcloud compute instance-templates create InstanceTemplateName --can-ip-forward --machine-type n1-standard-2 --image ConfiguredImageFromSnapshot --service-account ServiceAccountEmailAddress [admin@localhost ~] USD gcloud compute instance-templates create rhel-91-instance-template --can-ip-forward --machine-type n1-standard-2 --image rhel-91-gcp-image --service-account account@project-name-on-gcp.iam.gserviceaccount.com Created [https://www.googleapis.com/compute/v1/projects/project-name-on-gcp/global/instanceTemplates/rhel-91-instance-template]. NAME MACHINE_TYPE PREEMPTIBLE CREATION_TIMESTAMP rhel-91-instance-template n1-standard-2 2018-07-25T11:09:30.506-07:00 gcloud compute instances create NodeName01 NodeName02 --source-instance-template InstanceTemplateName --zone RegionZone --network= NetworkName --subnet= SubnetName [admin@localhost ~] USD gcloud compute instances create rhel81-node-01 rhel81-node-02 rhel81-node-03 --source-instance-template rhel-91-instance-template --zone us-west1-b --network=projectVPC --subnet=range0 Created [https://www.googleapis.com/compute/v1/projects/project-name-on-gcp/zones/us-west1-b/instances/rhel81-node-01]. Created [https://www.googleapis.com/compute/v1/projects/project-name-on-gcp/zones/us-west1-b/instances/rhel81-node-02]. Created [https://www.googleapis.com/compute/v1/projects/project-name-on-gcp/zones/us-west1-b/instances/rhel81-node-03]. NAME ZONE MACHINE_TYPE PREEMPTIBLE INTERNAL_IP EXTERNAL_IP STATUS rhel81-node-01 us-west1-b n1-standard-2 10.10.10.4 192.230.25.81 RUNNING rhel81-node-02 us-west1-b n1-standard-2 10.10.10.5 192.230.81.253 RUNNING rhel81-node-03 us-east1-b n1-standard-2 10.10.10.6 192.230.102.15 RUNNING subscription-manager repos --disable= * subscription-manager repos --enable=rhel-9-server-rpms subscription-manager repos --enable=rhel-9-for-x86_64-highavailability-rpms dnf install -y pcs pacemaker fence-agents-gce resource-agents-gcp dnf update -y passwd hacluster firewall-cmd --permanent --add-service=high-availability firewall-cmd --reload systemctl start pcsd.service systemctl enable pcsd.service Created symlink from /etc/systemd/system/multi-user.target.wants/pcsd.service to /usr/lib/systemd/system/pcsd.service. systemctl status pcsd.service pcsd.service - PCS GUI and remote configuration interface Loaded: loaded (/usr/lib/systemd/system/pcsd.service; enabled; vendor preset: disabled) Active: active (running) since Mon 2018-06-25 19:21:42 UTC; 15s ago Docs: man:pcsd(8) man:pcs(8) Main PID: 5901 (pcsd) CGroup: /system.slice/pcsd.service └─5901 /usr/bin/ruby /usr/lib/pcsd/pcsd > /dev/null & pcs host auth hostname1 hostname2 hostname3 Username: hacluster Password: hostname1 : Authorized hostname2 : Authorized hostname3 : Authorized pcs cluster setup cluster-name hostname1 hostname2 hostname3 pcs cluster enable --all pcs cluster start --all fence_gce --zone us-west1-b --project=rhel-ha-on-gcp -o list fence_gce --zone us-west1-b --project=rhel-ha-testing-on-gcp -o list 4435801234567893181,InstanceName-3 4081901234567896811,InstanceName-1 7173601234567893341,InstanceName-2 pcs stonith create FenceDeviceName fence_gce zone= Region-Zone project= MyProject pcs status pcs status Cluster name: gcp-cluster Stack: corosync Current DC: rhel81-node-02 (version 1.1.18-11.el7_5.3-2b07d5c5a9) - partition with quorum Last updated: Fri Jul 27 12:53:25 2018 Last change: Fri Jul 27 12:51:43 2018 by root via cibadmin on rhel81-node-01 3 nodes configured 3 resources configured Online: [ rhel81-node-01 rhel81-node-02 rhel81-node-03 ] Full list of resources: us-west1-b-fence (stonith:fence_gce): Started rhel81-node-01 Daemon Status: corosync: active/enabled pacemaker: active/enabled pcsd: active/enabled pcs resource describe gcp-vpc-move-vip pcs resource create aliasip gcp-vpc-move-vip alias_ip= UnusedIPaddress/CIDRblock pcs resource create aliasip gcp-vpc-move-vip alias_ip=10.10.10.200/32 pcs resource create vip IPaddr2 nic= interface ip= AliasIPaddress cidr_netmask=32 pcs resource create vip IPaddr2 nic=eth0 ip=10.10.10.200 cidr_netmask=32 pcs resource group add vipgrp aliasip vip pcs status pcs resource move vip Node pcs resource move vip rhel81-node-03 pcs status gcloud compute networks subnets update SubnetName --region RegionName --add-secondary-ranges SecondarySubnetName = SecondarySubnetRange gcloud compute networks subnets update range0 --region us-west1 --add-secondary-ranges range1=10.10.20.0/24 pcs resource create aliasip gcp-vpc-move-vip alias_ip= UnusedIPaddress/CIDRblock pcs resource create aliasip gcp-vpc-move-vip alias_ip=10.10.20.200/32 pcs resource create vip IPaddr2 nic= interface ip= AliasIPaddress cidr_netmask=32 pcs resource create vip IPaddr2 nic=eth0 ip=10.10.20.200 cidr_netmask=32 pcs resource group add vipgrp aliasip vip pcs status pcs resource move vip Node pcs resource move vip rhel81-node-03 pcs status mokutil --sb-state SecureBoot enabled sudo keyctl list %:.platform 4 keys in keyring: 12702216: ---lswrv 0 0 asymmetric: Microsoft Corporation UEFI CA 2011: 13adbf4309bd82709c8cd54f316ed522988a1bd4 50338534: ---lswrv 0 0 asymmetric: Red Hat Secure Boot CA 5: cc6fa5e72868ba494e939bbd680b9144769a9f8f 681047026: ---lswrv 0 0 asymmetric: Microsoft Windows Production PCA 2011: a92902398e16c49778cd90f99e4f9ae17c55af53 uuidgen --random > GUID.txt openssl req -quiet -newkey rsa:4096 -nodes -keyout PK.key -new -x509 -sha256 -days 3650 -subj "/CN=Platform key/" -outform DER -out PK.cer openssl req -quiet -newkey rsa:4096 -nodes -keyout KEK.key -new -x509 -sha256 -days 3650 -subj "/CN=Key Exchange Key/" -outform DER -out KEK.cer openssl req -quiet -newkey rsa:4096 -nodes -keyout custom_db.key -new -x509 -sha256 -days 3650 -subj "/CN=Signature Database key/" --outform DER -out custom_db.cer wget https://go.microsoft.com/fwlink/p/?linkid=321194 --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" -O MicCorUEFCA2011_2011-06-27.crt wget https://uefi.org/sites/default/files/resources/x64_DBXUpdate.bin gcloud compute images create <example-rhel-9-efi-image> --source-image projects/ <example_project_id> /global/images/ <example_image_name> --platform-key-file=PK.cer --key-exchange-key-file=KEK.cer --signature-database-file=custom_db.cer,MicCorUEFCA2011_2011-06-27.crt --forbidden-database-file x64_DBXUpdate.bin --guest-os-features="UEFI_COMPATIBLE" mokutil --sb-state SecureBoot enabled sudo keyctl list %:.platform 757453569: ---lswrv 0 0 asymmetric: Signature Database key: f064979641c24e1b935e402bdbc3d5c4672a1acc