Deploying RHEL 9 on Amazon Web Services
Deploying RHEL 9 on Amazon Web Services Red Hat Enterprise Linux 9 Obtaining RHEL system images and creating RHEL instances on AWS Red Hat Customer Content Services
dnf install python3 python3-pip pip3 install awscli aws configure AWS Access Key ID [None]: AWS Secret Access Key [None]: Default region name [None]: Default output format [None]: BUCKET= bucketname aws s3 mb s3://USDBUCKET { "Version": "2022-10-17", "Statement": [{ "Effect": "Allow", "Principal": { "Service": "vmie.amazonaws.com" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "sts:Externalid": "vmimport" } } }] } { "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": ["s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket"], "Resource": ["arn:aws:s3:::%s", "arn:aws:s3:::%s/ "] }, { "Effect": "Allow", "Action": ["ec2:ModifySnapshotAttribute", "ec2:CopySnapshot", "ec2:RegisterImage", "ec2:Describe "], "Resource": "*" }] } USDBUCKET USDBUCKET aws iam create-role --role-name vmimport --assume-role-policy-document file://trust-policy.json aws iam put-role-policy --role-name vmimport --policy-name vmimport --policy-document file://role-policy.json provider = "aws" [settings] accessKeyID = " AWS_ACCESS_KEY_ID " secretAccessKey = "AWS_SECRET_ACCESS_KEY" bucket = "AWS_BUCKET" region = "AWS_REGION" key = "IMAGE_KEY" composer-cli compose start blueprint-name image-type image-key configuration-file .toml composer-cli compose status chmod 400 <_your-instance-name.pem_> ssh -i <_your-instance-name.pem_> ec2-user@<_your-instance-IP-address_> virt-install --name kvmtest --memory 2048 --vcpus 2 --cdrom /home/username/Downloads/rhel9.iso,bus=virtio --os-variant=rhel9.0 subscription-manager register --auto-attach dnf install cloud-init systemctl enable --now cloud-init.service dracut -f --add-drivers "nvme xen-netfront xen-blkfront" dracut -f --add-drivers "nvme" dnf install awscli aws --version aws-cli/1.19.77 Python/3.6.15 Linux/5.14.16-201.fc34.x86_64 botocore/1.20.77 aws configure AWS Access Key ID [None]: AWS Secret Access Key [None]: Default region name [None]: Default output format [None]: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "vmie.amazonaws.com" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals":{ "sts:Externalid": "vmimport" } } } ] } aws iam create-role --role-name vmimport --assume-role-policy-document file:///home/sample/ImportService/trust-policy.json { "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket" ], "Resource":[ "arn:aws:s3:::s3-bucket-name", "arn:aws:s3:::s3-bucket-name/*" ] }, { "Effect":"Allow", "Action":[ "ec2:ModifySnapshotAttribute", "ec2:CopySnapshot", "ec2:RegisterImage", "ec2:Describe*" ], "Resource":"*" } ] } aws iam put-role-policy --role-name vmimport --policy-name vmimport --policy-document file:///home/sample/ImportService/role-policy.json qemu-img convert -f qcow2 -O raw rhel-9.0-sample.qcow2 rhel-9.0-sample.raw aws s3 cp rhel-9.0-sample.raw s3://s3-bucket-name { "Description": "rhel-9.0-sample.raw", "Format": "raw", "UserBucket": { "S3Bucket": "s3-bucket-name", "S3Key": "s3-key" } } aws ec2 import-snapshot --disk-container file://containers.json { "SnapshotTaskDetail": { "Status": "active", "Format": "RAW", "DiskImageSize": 0.0, "UserBucket": { "S3Bucket": "s3-bucket-name", "S3Key": "rhel-9.0-sample.raw" }, "Progress": "3", "StatusMessage": "pending" }, "ImportTaskId": "import-snap-06cea01fa0f1166a8" } aws ec2 describe-import-snapshot-tasks --import-task-ids import-snap-06cea01fa0f1166a8 aws ec2 register-image --name "myimagename" --description "myimagedescription" --architecture x86_64 --virtualization-type hvm --root-device-name "/dev/sda1" --ena-support --block-device-mappings "{\"DeviceName\": \"/dev/sda1\",\"Ebs\": {\"SnapshotId\": \"snap-0ce7f009b69ab274d\"}}" subscription-manager register --auto-attach insights-client register --display-name <display-name-value> subscription-manager identity system identity: fdc46662-c536-43fb-a18a-bbcb283102b7 name: 192.168.122.222 org name: 6340056 org ID: 6340056 dnf install awscli aws --version aws-cli/1.19.77 Python/3.6.15 Linux/5.14.16-201.fc34.x86_64 botocore/1.20.77 aws configure AWS Access Key ID [None]: AWS Secret Access Key [None]: Default region name [None]: Default output format [None]: chmod 400 KeyName.pem sudo -i dnf -y remove rh-amazon-rhui-client * subscription-manager register --auto-attach subscription-manager repos --disable= * subscription-manager repos --enable=rhel-9-for-x86_64-highavailability-rpms dnf update -y dnf install pcs pacemaker fence-agents-aws passwd hacluster firewall-cmd --permanent --add-service=high-availability firewall-cmd --reload systemctl start pcsd.service systemctl enable pcsd.service systemctl status pcsd.service pcsd.service - PCS GUI and remote configuration interface Loaded: loaded (/usr/lib/systemd/system/pcsd.service; enabled; vendor preset: disabled) Active: active (running) since Thu 2018-03-01 14:53:28 UTC; 28min ago Docs: man:pcsd(8) man:pcs(8) Main PID: 5437 (pcsd) CGroup: /system.slice/pcsd.service └─5437 /usr/bin/ruby /usr/lib/pcsd/pcsd > /dev/null & Mar 01 14:53:27 ip-10-0-0-48.ec2.internal systemd[1]: Starting PCS GUI and remote configuration interface... Mar 01 14:53:28 ip-10-0-0-48.ec2.internal systemd[1]: Started PCS GUI and remote configuration interface. pcs host auth <hostname1> <hostname2> <hostname3> pcs host auth node01 node02 node03 Username: hacluster Password: node01: Authorized node02: Authorized node03: Authorized pcs cluster setup <cluster_name> <hostname1> <hostname2> <hostname3> pcs cluster setup new_cluster node01 node02 node03 [...] Synchronizing pcsd certificates on nodes node01, node02, node03 node02: Success node03: Success node01: Success Restarting pcsd on the nodes in order to reload the certificates node02: Success node03: Success node01: Success pcs cluster enable --all node02: Cluster Enabled node03: Cluster Enabled node01: Cluster Enabled pcs cluster start --all node02: Starting Cluster node03: Starting Cluster node01: Starting Cluster echo USD(curl -s http://169.254.169.254/latest/meta-data/instance-id) echo USD(curl -s http://169.254.169.254/latest/meta-data/instance-id) i-07f1ac63af0ec0ac6 pcs stonith create <name> fence_aws access_key=access-key secret_key= <secret-access-key> region= <region> pcmk_host_map="rhel-hostname-1:Instance-ID-1;rhel-hostname-2:Instance-ID-2;rhel-hostname-3:Instance-ID-3" power_timeout=240 pcmk_reboot_timeout=480 pcmk_reboot_retries=4 pcs stonith create clusterfence fence_aws access_key=AKIAI123456MRMJA secret_key=a75EYIG4RVL3hdsdAslK7koQ8dzaDyn5yoIZ/ region=us-east-1 pcmk_host_map="ip-10-0-0-48:i-07f1ac63af0ec0ac6;ip-10-0-0-46:i-063fc5fe93b4167b2;ip-10-0-0-58:i-08bd39eb03a6fd2c7" power_timeout=240 pcmk_reboot_timeout=480 pcmk_reboot_retries=4 aws ec2 describe-vpcs --output text --filters "Name=tag:Name,Values= <clustername> -vpc" --query 'Vpcs[ * ].VpcId' vpc-06bc10ac8f6006664 aws ec2 describe-instances --output text --filters "Name=vpc-id,Values=vpc-06bc10ac8f6006664" --query 'Reservations[ * ].Instances[ * ].{Name:Tags[? Key== Name ]|[0].Value,Instance:InstanceId}' | grep "\-node[a-c]" i-0b02af8927a895137 <clustername> -nodea-vm i-0cceb4ba8ab743b69 <clustername> -nodeb-vm i-0502291ab38c762a5 <clustername> -nodec-vm CLUSTER= <clustername> && pcs stonith create fenceUSD{CLUSTER} fence_aws access_key=XXXXXXXXXXXXXXXXXXXX pcmk_host_map=USD(for NODE in node{a..c}; do ssh USD{NODE} "echo -n \USD{HOSTNAME}:\USD(curl -s http://169.254.169.254/latest/meta-data/instance-id)\;"; done) pcmk_reboot_retries=4 pcmk_reboot_timeout=480 power_timeout=240 region=xx-xxxx-x secret_key=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX pcs stonith config fenceUSD{CLUSTER} Resource: <clustername> (class=stonith type=fence_aws) Attributes: access_key=XXXXXXXXXXXXXXXXXXXX pcmk_host_map=nodea:i-0b02af8927a895137;nodeb:i-0cceb4ba8ab743b69;nodec:i-0502291ab38c762a5; pcmk_reboot_retries=4 pcmk_reboot_timeout=480 power_timeout=240 region=xx-xxxx-x secret_key=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Operations: monitor interval=60s ( <clustername> -monitor-interval-60s) pcs stonith fence <awsnodename> pcs stonith fence ip-10-0-0-58 Node: ip-10-0-0-58 fenced pcs status pcs status Cluster name: newcluster Stack: corosync Current DC: ip-10-0-0-46 (version 1.1.18-11.el7-2b07d5c5a9) - partition with quorum Last updated: Fri Mar 2 19:55:41 2018 Last change: Fri Mar 2 19:24:59 2018 by root via cibadmin on ip-10-0-0-46 3 nodes configured 1 resource configured Online: [ ip-10-0-0-46 ip-10-0-0-48 ] OFFLINE: [ ip-10-0-0-58 ] Full list of resources: clusterfence (stonith:fence_aws): Started ip-10-0-0-46 Daemon Status: corosync: active/disabled pacemaker: active/disabled pcsd: active/enabled pcs cluster start <awshostname> pcs status pcs status Cluster name: newcluster Stack: corosync Current DC: ip-10-0-0-46 (version 1.1.18-11.el7-2b07d5c5a9) - partition with quorum Last updated: Fri Mar 2 20:01:31 2018 Last change: Fri Mar 2 19:24:59 2018 by root via cibadmin on ip-10-0-0-48 3 nodes configured 1 resource configured Online: [ ip-10-0-0-46 ip-10-0-0-48 ip-10-0-0-58 ] Full list of resources: clusterfence (stonith:fence_aws): Started ip-10-0-0-46 Daemon Status: corosync: active/disabled pacemaker: active/disabled pcsd: active/enabled aws ec2 describe-instances --output text --query 'Reservations[ * ].Instances[ * ].[InstanceId,Tags[?Key== Name ].Value]' i-07f1ac63af0ec0ac6 ip-10-0-0-48 i-063fc5fe93b4167b2 ip-10-0-0-46 i-08bd39eb03a6fd2c7 ip-10-0-0-58 dnf install resource-agents-cloud aws ec2 allocate-address --domain vpc --output text eipalloc-4c4a2c45 vpc 35.169.153.122 pcs resource describe awseip pcs resource create <resource-id> awseip elastic_ip= <Elastic-IP-Address> allocation_id= <Elastic-IP-Association-ID> --group networking-group pcs resource create elastic awseip elastic_ip=35.169.153.122 allocation_id=eipalloc-4c4a2c45 --group networking-group pcs status pcs status Cluster name: newcluster Stack: corosync Current DC: ip-10-0-0-58 (version 1.1.18-11.el7-2b07d5c5a9) - partition with quorum Last updated: Mon Mar 5 16:27:55 2018 Last change: Mon Mar 5 15:57:51 2018 by root via cibadmin on ip-10-0-0-46 3 nodes configured 4 resources configured Online: [ ip-10-0-0-46 ip-10-0-0-48 ip-10-0-0-58 ] Full list of resources: clusterfence (stonith:fence_aws): Started ip-10-0-0-46 Resource Group: networking-group vip (ocf::heartbeat:IPaddr2): Started ip-10-0-0-48 elastic (ocf::heartbeat:awseip): Started ip-10-0-0-48 Daemon Status: corosync: active/disabled pacemaker: active/disabled pcsd: active/enabled ssh -l <user-name> -i ~/.ssh/<KeyName>.pem <elastic-IP> ssh -l ec2-user -i ~/.ssh/cluster-admin.pem 35.169.153.122 dnf install resource-agents-cloud pcs resource describe awsvip pcs resource create <resource-id> awsvip secondary_private_ip= <Unused-IP-Address> --group <group-name> pcs resource create privip awsvip secondary_private_ip=10.0.0.68 --group networking-group pcs resource create <resource-id> IPaddr2 ip= <secondary-private-IP> --group <group-name> root@ip-10-0-0-48 ~]# pcs resource create vip IPaddr2 ip=10.0.0.68 --group networking-group pcs status pcs status Cluster name: newcluster Stack: corosync Current DC: ip-10-0-0-46 (version 1.1.18-11.el7-2b07d5c5a9) - partition with quorum Last updated: Fri Mar 2 22:34:24 2018 Last change: Fri Mar 2 22:14:58 2018 by root via cibadmin on ip-10-0-0-46 3 nodes configured 3 resources configured Online: [ ip-10-0-0-46 ip-10-0-0-48 ip-10-0-0-58 ] Full list of resources: clusterfence (stonith:fence_aws): Started ip-10-0-0-46 Resource Group: networking-group privip (ocf::heartbeat:awsvip): Started ip-10-0-0-48 vip (ocf::heartbeat:IPaddr2): Started ip-10-0-0-58 Daemon Status: corosync: active/disabled pacemaker: active/disabled pcsd: active/enabled dnf install resource-agents-cloud pcs resource describe aws-vpc-move-ip { "Version": "2012-10-17", "Statement": [ { "Sid": "Stmt1424870324000", "Effect": "Allow", "Action": "ec2:DescribeRouteTables", "Resource": "*" }, { "Sid": "Stmt1424860166260", "Action": [ "ec2:CreateRoute", "ec2:ReplaceRoute" ], "Effect": "Allow", "Resource": "arn:aws:ec2:<region>:<account-id>:route-table/<ClusterRouteTableID>" } ] } aws ec2 create-route --route-table-id <ClusterRouteTableID> --destination-cidr-block <NewCIDRblockIP/NetMask> --instance-id <ClusterNodeID> pcs resource create vpcip aws-vpc-move-ip ip= 192.168.0.15 interface=eth0 routing_table= <ClusterRouteTableID> 192.168.0.15 vpcip pcs resource move vpcip pcs resource clear vpcip aws ec2 create-volume --availability-zone <availability_zone> --no-encrypted --size 1024 --volume-type io1 --iops 51200 --multi-attach-enabled aws ec2 create-volume --availability-zone us-east-1a --no-encrypted --size 1024 --volume-type io1 --iops 51200 --multi-attach-enabled { "AvailabilityZone": "us-east-1a", "CreateTime": "2020-08-27T19:16:42.000Z", "Encrypted": false, "Size": 1024, "SnapshotId": "", "State": "creating", "VolumeId": "vol-042a5652867304f09", "Iops": 51200, "Tags": [ ], "VolumeType": "io1" } aws ec2 attach-volume --device /dev/xvdd --instance-id <instance_id> --volume-id <volume_id> aws ec2 attach-volume --device /dev/xvdd --instance-id i-0eb803361c2c887f2 --volume-id vol-042a5652867304f09 { "AttachTime": "2020-08-27T19:26:16.086Z", "Device": "/dev/xvdd", "InstanceId": "i-0eb803361c2c887f2", "State": "attaching", "VolumeId": "vol-042a5652867304f09" } ssh <ip_address> "hostname ; lsblk -d | grep ' 1T '" ssh 198.51.100.3 "hostname ; lsblk -d | grep ' 1T '" nodea nvme2n1 259:1 0 1T 0 disk ssh <ip_address> "hostname ; lsblk -d | grep ' 1T ' | awk '{print \USD1}' | xargs -i udevadm info --query=all --name=/dev/{} | grep '^E: ID_SERIAL='" ssh 198.51.100.3 "hostname ; lsblk -d | grep ' 1T ' | awk '{print \USD1}' | xargs -i udevadm info --query=all --name=/dev/{} | grep '^E: ID_SERIAL='" nodea E: ID_SERIAL=Amazon Elastic Block Store_vol0fa5342e7aedf09f7 dnf install -y opentelemetry-collector systemctl enable --now opentelemetry-collector.service exporters: awscloudwatchlogs: log_group_name: testing-logs-emf log_stream_name: testing-integrations-stream-emf raw_log: true region: us-east-1 endpoint: logs.us-east-1.amazonaws.com log_retention: 365 tags: sampleKey: sampleValue service: pipelines: logs: receivers: - journald exporters: - awscloudwatchlogs systemctl restart opentelemetry-collector.service systemctl stop opentelemetry-collector.service systemctl disable opentelemetry-collector.service