So is seems that if you remove the machine-id file it won't regenerate the file but if you touch the file and leave it empty on boot it'll put a new machine-id in the empty file. So work around this bug ("feature"?) by touching the file so we don't have other issues in the process. We're track the outcome of this in RHBZ 1379800
283 lines
9.7 KiB
Plaintext
283 lines
9.7 KiB
Plaintext
# This is a basic Fedora 21 spin designed to work in OpenStack and other
|
|
# private cloud environments. It's configured with cloud-init so it will
|
|
# take advantage of ec2-compatible metadata services for provisioning ssh
|
|
# keys. Cloud-init creates a user account named "fedora" with passwordless
|
|
# sudo access. The root password is empty and locked by default.
|
|
#
|
|
# Note that unlike the standard F20 install, this image has /tmp on disk
|
|
# rather than in tmpfs, since memory is usually at a premium.
|
|
#
|
|
# This kickstart file is designed to be used with ImageFactory (in Koji).
|
|
#
|
|
# To do a local build, you'll need to install ImageFactory. See
|
|
# http://worknotes.readthedocs.org/en/latest/cloudimages.html for some notes.
|
|
#
|
|
# For a TDL file, I store one here:
|
|
# https://git.fedorahosted.org/cgit/fedora-atomic.git/tree/fedora-atomic-rawhide.tdl
|
|
# (Koji generates one internally...what we really want is Koji to publish it statically)
|
|
#
|
|
# Once you have imagefactory and imagefactory-plugins installed, run:
|
|
#
|
|
# curl -O https://git.fedorahosted.org/cgit/fedora-atomic.git/plain/fedora-atomic-rawhide.tdl
|
|
# tempfile=$(mktemp --suffix=.ks)
|
|
# ksflatten -v F22 -c fedora-cloud-base.ks > ${tempfile}
|
|
# imagefactory --debug base_image --file-parameter install_script ${tempfile} fedora-atomic-rawhide.tdl
|
|
#
|
|
|
|
cmdline
|
|
lang en_US.UTF-8
|
|
keyboard us
|
|
timezone --utc Etc/UTC
|
|
|
|
auth --useshadow --passalgo=sha512
|
|
selinux --enforcing
|
|
rootpw --lock --iscrypted locked
|
|
user --name=none
|
|
|
|
firewall --disabled
|
|
|
|
bootloader --timeout=1 --append="no_timer_check console=tty1 console=ttyS0,115200n8" --extlinux
|
|
|
|
network --bootproto=dhcp --device=link --activate --onboot=on
|
|
services --enabled=sshd,cloud-init,cloud-init-local,cloud-config,cloud-final
|
|
|
|
zerombr
|
|
clearpart --all
|
|
#
|
|
# We need to disable 64bit options here or extlinux won't work.
|
|
# See: http://www.syslinux.org/wiki/index.php/Filesystem#ext4
|
|
# and
|
|
# https://bugzilla.redhat.com/show_bug.cgi?id=1369934
|
|
#
|
|
part / --fstype ext4 --grow --mkfsoptions="-O ^64bit"
|
|
|
|
%include fedora-repo.ks
|
|
|
|
reboot
|
|
|
|
# Package list.
|
|
# FIXME: instLangs does not work, so there's a hack below
|
|
# (see https://bugzilla.redhat.com/show_bug.cgi?id=1051816)
|
|
# FIXME: instLangs bug has been fixed but now having instLangs
|
|
# with an arg causes no langs to get installed because of BZ1262040
|
|
# which yields the errors in BZ1261249. For now fix by not using
|
|
# --instLangs at all
|
|
#%packages --instLangs=en
|
|
%packages
|
|
|
|
kernel-core
|
|
@^cloud-server-environment
|
|
# Need to pull in the udev subpackage
|
|
systemd-udev
|
|
|
|
# after move away from grub2 - let's add 'which' back
|
|
which
|
|
|
|
# rescue mode generally isn't useful in the cloud context
|
|
-dracut-config-rescue
|
|
|
|
# Some things from @core we can do without in a minimal install
|
|
-biosdevname
|
|
# Need to also add back plymouth in order to mask failure of
|
|
# systemd-vconsole-setup.service. BZ#1272684. Comment out for now
|
|
#-plymouth
|
|
-NetworkManager
|
|
-iprutils
|
|
# Now that BZ#1199868 is fixed kbd really gets removed but it breaks
|
|
# systemd-vconsole-setup.service on boot. Comment out for now
|
|
#-kbd
|
|
-uboot-tools
|
|
-kernel
|
|
-grub2
|
|
|
|
%end
|
|
|
|
|
|
|
|
%post --erroronfail
|
|
|
|
# Create grub.conf for EC2. This used to be done by appliance creator but
|
|
# anaconda doesn't do it. And, in case appliance-creator is used, we're
|
|
# overriding it here so that both cases get the exact same file.
|
|
# Note that the console line is different -- that's because EC2 provides
|
|
# different virtual hardware, and this is a convenient way to act differently
|
|
echo -n "Creating grub.conf for pvgrub"
|
|
rootuuid=$( awk '$2=="/" { print $1 };' /etc/fstab )
|
|
mkdir /boot/grub
|
|
echo -e 'default=0\ntimeout=0\n\n' > /boot/grub/grub.conf
|
|
for kv in $( ls -1v /boot/vmlinuz* |grep -v rescue |sed s/.*vmlinuz-// ); do
|
|
echo "title Fedora ($kv)" >> /boot/grub/grub.conf
|
|
echo -e "\troot (hd0,0)" >> /boot/grub/grub.conf
|
|
echo -e "\tkernel /boot/vmlinuz-$kv ro root=$rootuuid no_timer_check console=hvc0 LANG=en_US.UTF-8" >> /boot/grub/grub.conf
|
|
echo -e "\tinitrd /boot/initramfs-$kv.img" >> /boot/grub/grub.conf
|
|
echo
|
|
done
|
|
|
|
|
|
#link grub.conf to menu.lst for ec2 to work
|
|
echo -n "Linking menu.lst to old-style grub.conf for pv-grub"
|
|
ln -sf grub.conf /boot/grub/menu.lst
|
|
ln -sf /boot/grub/grub.conf /etc/grub.conf
|
|
|
|
# older versions of livecd-tools do not follow "rootpw --lock" line above
|
|
# https://bugzilla.redhat.com/show_bug.cgi?id=964299
|
|
passwd -l root
|
|
# remove the user anaconda forces us to make
|
|
userdel -r none
|
|
|
|
# Kickstart specifies timeout in seconds; syslinux uses 10ths.
|
|
# 0 means wait forever, so instead we'll go with 1.
|
|
sed -i 's/^timeout 10/timeout 1/' /boot/extlinux/extlinux.conf
|
|
|
|
# setup systemd to boot to the right runlevel
|
|
echo -n "Setting default runlevel to multiuser text mode"
|
|
rm -f /etc/systemd/system/default.target
|
|
ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
|
|
echo .
|
|
|
|
# this is installed by default but we don't need it in virt
|
|
# Commenting out the following for #1234504
|
|
# rpm works just fine for removing this, no idea why dnf can't cope
|
|
echo "Removing linux-firmware package."
|
|
rpm -e linux-firmware
|
|
|
|
# Remove firewalld; was supposed to be optional in F18+, but is pulled in
|
|
# in install/image building.
|
|
echo "Removing firewalld."
|
|
# FIXME! clean_requirements_on_remove is the default with DNF, but may
|
|
# not work when package was installed by Anaconda instead of command line.
|
|
# Also -- check if this is still even needed with new anaconda -- disabled
|
|
# firewall should _not_ pull in this package.
|
|
# yum -C -y remove "firewalld*" --setopt="clean_requirements_on_remove=1"
|
|
dnf -C -y erase "firewalld*"
|
|
|
|
# Another one needed at install time but not after that, and it pulls
|
|
# in some unneeded deps (like, newt and slang)
|
|
echo "Removing authconfig."
|
|
dnf -C -y erase authconfig
|
|
|
|
# instlang hack. (Note! See bug referenced above package list)
|
|
find /usr/share/locale -mindepth 1 -maxdepth 1 -type d -not -name en_US -exec rm -rf {} +
|
|
localedef --list-archive | grep -v ^en_US | xargs localedef --delete-from-archive
|
|
# this will kill a live system (since it's memory mapped) but should be safe offline
|
|
mv -f /usr/lib/locale/locale-archive /usr/lib/locale/locale-archive.tmpl
|
|
build-locale-archive
|
|
echo '%_install_langs C:en:en_US:en_US.UTF-8' >> /etc/rpm/macros.image-language-conf
|
|
awk '(NF==0&&!done){print "override_install_langs='$LANG'";done=1}{print}' \
|
|
< /etc/yum.conf > /etc/yum.conf.new
|
|
mv /etc/yum.conf.new /etc/yum.conf
|
|
|
|
|
|
echo -n "Getty fixes"
|
|
# although we want console output going to the serial console, we don't
|
|
# actually have the opportunity to login there. FIX.
|
|
# we don't really need to auto-spawn _any_ gettys.
|
|
sed -i '/^#NAutoVTs=.*/ a\
|
|
NAutoVTs=0' /etc/systemd/logind.conf
|
|
|
|
echo -n "Network fixes"
|
|
# initscripts don't like this file to be missing.
|
|
# and https://bugzilla.redhat.com/show_bug.cgi?id=1204612
|
|
cat > /etc/sysconfig/network << EOF
|
|
NETWORKING=yes
|
|
NOZEROCONF=yes
|
|
DEVTIMEOUT=10
|
|
EOF
|
|
|
|
# For cloud images, 'eth0' _is_ the predictable device name, since
|
|
# we don't want to be tied to specific virtual (!) hardware
|
|
rm -f /etc/udev/rules.d/70*
|
|
ln -s /dev/null /etc/udev/rules.d/80-net-setup-link.rules
|
|
|
|
# simple eth0 config, again not hard-coded to the build hardware
|
|
cat > /etc/sysconfig/network-scripts/ifcfg-eth0 << EOF
|
|
DEVICE="eth0"
|
|
BOOTPROTO="dhcp"
|
|
ONBOOT="yes"
|
|
TYPE="Ethernet"
|
|
PERSISTENT_DHCLIENT="yes"
|
|
EOF
|
|
|
|
# generic localhost names
|
|
cat > /etc/hosts << EOF
|
|
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
|
|
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
|
|
|
|
EOF
|
|
echo .
|
|
|
|
|
|
# Because memory is scarce resource in most cloud/virt environments,
|
|
# and because this impedes forensics, we are differing from the Fedora
|
|
# default of having /tmp on tmpfs.
|
|
echo "Disabling tmpfs for /tmp."
|
|
systemctl mask tmp.mount
|
|
|
|
# make sure firstboot doesn't start
|
|
echo "RUN_FIRSTBOOT=NO" > /etc/sysconfig/firstboot
|
|
|
|
# Uncomment this if you want to use cloud init but suppress the creation
|
|
# of an "ec2-user" account. This will, in the absence of further config,
|
|
# cause the ssh key from a metadata source to be put in the root account.
|
|
#cat <<EOF > /etc/cloud/cloud.cfg.d/50_suppress_ec2-user_use_root.cfg
|
|
#users: []
|
|
#disable_root: 0
|
|
#EOF
|
|
|
|
echo "Removing random-seed so it's not the same in every image."
|
|
rm -f /var/lib/random-seed
|
|
|
|
echo "Cleaning old dnf repodata."
|
|
# FIXME: clear history?
|
|
dnf clean all
|
|
truncate -c -s 0 /var/log/dnf.log
|
|
truncate -c -s 0 /var/log/dnf.rpm.log
|
|
|
|
echo "Import RPM GPG key"
|
|
releasever=$(rpm -q --qf '%{version}\n' fedora-release)
|
|
basearch=$(uname -i)
|
|
rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
|
|
|
|
echo "Packages within this cloud image:"
|
|
echo "-----------------------------------------------------------------------"
|
|
rpm -qa
|
|
echo "-----------------------------------------------------------------------"
|
|
# Note that running rpm recreates the rpm db files which aren't needed/wanted
|
|
rm -f /var/lib/rpm/__db*
|
|
|
|
|
|
# This is a temporary workaround for
|
|
# <https://bugzilla.redhat.com/show_bug.cgi?id=1147998>
|
|
# where sfdisk seems to be messing up the mbr.
|
|
# Long-term fix is to address this in anaconda directly and remove this.
|
|
# <https://bugzilla.redhat.com/show_bug.cgi?id=1015931>
|
|
dd if=/usr/share/syslinux/mbr.bin of=/dev/vda
|
|
|
|
# FIXME: is this still needed?
|
|
echo "Fixing SELinux contexts."
|
|
touch /var/log/cron
|
|
touch /var/log/boot.log
|
|
chattr -i /boot/extlinux/ldlinux.sys
|
|
/usr/sbin/fixfiles -R -a restore
|
|
chattr +i /boot/extlinux/ldlinux.sys
|
|
|
|
echo "Zeroing out empty space."
|
|
# This forces the filesystem to reclaim space from deleted files
|
|
dd bs=1M if=/dev/zero of=/var/tmp/zeros || :
|
|
rm -f /var/tmp/zeros
|
|
echo "(Don't worry -- that out-of-space error was expected.)"
|
|
|
|
# For trac ticket https://fedorahosted.org/cloud/ticket/128
|
|
rm -f /etc/sysconfig/network-scripts/ifcfg-ens3
|
|
|
|
# Enable network service here, as doing it in the services line
|
|
# fails due to RHBZ #1369794
|
|
/sbin/chkconfig network on
|
|
|
|
# Remove machine-id on pre generated images
|
|
rm -f /etc/machine-id
|
|
touch /etc/machine-id
|
|
|
|
%end
|
|
|