unkinben
105487c090
Adds a fast, reproducible install path that unpacks a prebuilt AlmaLinux 9 node
rootfs onto the device (Anaconda liveimg) instead of resolving packages, with
per-host networking still templated after the unpack. Reuses the OptiPlex storage
vars so image and package installs lay disks out identically. Templates-only per
review; the rootfs build lives in the bootapi-images repo.
- kickstart/image.ks.tmpl: liveimg --url={{ .DistroVars.rootfs_tarball }};
%post renders per-host NetworkManager keyfiles from NetBox interface data
(the image is generic and liveimg overwrites /etc), hostname, puppet-initial
PUPPETCA_URL env, and the provisioned callback.
- kickstart/_storage.ks.tmpl: shared storage-block/storage-pre partials
(storage_mode / vg_grow); almalinux9.ks.tmpl now uses them (no behaviour
change).
- catalog/almalinux9-image.yaml (VM autopart) + optiplex-7080-image.yaml
(auto-nvme + vg_grow), rootfs_tarball -> artifactapi rootfs-images repo.
Rootfs tarball built+published by https://git.unkin.net/unkin/bootapi-images
(v* tag). Validated with bootapi validate + shellcheck; no bootapi code change.
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
132 lines
4.8 KiB
Cheetah
132 lines
4.8 KiB
Cheetah
{{- /*
|
|
Image-based AlmaLinux 9 kickstart. Anaconda `liveimg` unpacks a prebuilt rootfs
|
|
tarball (catalog var rootfs_tarball, on the artifactapi rootfs-images local repo)
|
|
onto the disk instead of resolving+installing packages: it formats the KS-defined
|
|
filesystems, untars the rootfs, installs grub and regenerates the initramfs. The
|
|
package set (kernel, grub2, openssh, chrony, puppet-agent, ...) is baked into the
|
|
tarball by .woodpecker/build-image.yaml.
|
|
|
|
The image is GENERIC (no per-host identity). liveimg overwrites /etc with the
|
|
tarball, so all per-host config is applied in %post AFTER the unpack: static
|
|
NetworkManager keyfiles from the SAME NetBox interface data the classic template
|
|
uses, the hostname, the puppet-initial env, and the provisioned callback.
|
|
|
|
Storage reuses the shared _storage.ks.tmpl partials (storage_mode / vg_grow), so
|
|
image and package installs land on disk identically (VM autopart, OptiPlex NVMe).
|
|
Select via a device's provision_template custom field (e.g. almalinux9-image).
|
|
*/ -}}
|
|
#version=RHEL9
|
|
# Rendered by bootapi (image install) for {{ .FQDN }} (platform {{ .Platform }})
|
|
text
|
|
firstboot --disable
|
|
reboot
|
|
|
|
# --- payload: unpack the prebuilt rootfs tarball ---
|
|
liveimg --url={{ .DistroVars.rootfs_tarball }}
|
|
|
|
# --- localization ---
|
|
keyboard --xlayouts='au'
|
|
lang en_AU.UTF-8
|
|
timezone Australia/Sydney --utc
|
|
|
|
# --- security ---
|
|
{{ if .RootPasswordHash -}}
|
|
rootpw --iscrypted {{ .RootPasswordHash }}
|
|
{{- else -}}
|
|
rootpw --lock
|
|
{{- end }}
|
|
selinux --enforcing
|
|
firewall --enabled --service=ssh
|
|
|
|
# --- install-time networking (primary NIC only, so Anaconda can fetch the
|
|
# tarball). The installed system's network is written authoritatively in %post
|
|
# below, because the liveimg unpack overwrites whatever Anaconda configures. ---
|
|
{{- $primary := .PrimaryInterface }}
|
|
{{- if and $primary $primary.IP }}
|
|
network --bootproto=static --device={{ $primary.MAC }} --ip={{ $primary.IP }} --netmask={{ $primary.Netmask }}{{ if $primary.Gateway }} --gateway={{ $primary.Gateway }}{{ end }}{{ range .Nameservers }} --nameserver={{ . }}{{ end }} --hostname={{ $.FQDN }} --activate --onboot=on --noipv6
|
|
{{- else }}
|
|
network --bootproto=dhcp --hostname={{ .FQDN }} --activate
|
|
{{- end }}
|
|
|
|
# --- storage (model-aware; shared with almalinux9.ks.tmpl via _storage.ks.tmpl) ---
|
|
{{ template "storage-block" . }}
|
|
|
|
# kdump: reserve crash memory (kexec-tools is baked into the image).
|
|
%addon com_redhat_kdump --enable --reserve-mb='auto'
|
|
%end
|
|
{{ template "storage-pre" . }}
|
|
|
|
# NOTE: no %packages section - liveimg provides the package set from the tarball.
|
|
|
|
# --- %post: apply per-host config AFTER the generic image is unpacked ---
|
|
%post --log=/root/bootapi-post.log
|
|
set -x
|
|
|
|
# Hostname (the image is generic).
|
|
echo "{{ .FQDN }}" > /etc/hostname
|
|
|
|
# Static per-host networking as NetworkManager keyfiles, from NetBox interface
|
|
# data. Written here (not via `network`) because the liveimg unpack clobbers
|
|
# /etc. Match on MAC so NIC renaming can't misapply an address.
|
|
install -d -m0755 /etc/NetworkManager/system-connections
|
|
rm -f /etc/NetworkManager/system-connections/*.nmconnection
|
|
{{- range .Interfaces }}
|
|
{{- if .IP }}
|
|
cat > "/etc/NetworkManager/system-connections/{{ .Name }}.nmconnection" <<'EOF'
|
|
[connection]
|
|
id={{ .Name }}
|
|
type=ethernet
|
|
interface-name={{ .Name }}
|
|
autoconnect=true
|
|
|
|
[ethernet]
|
|
mac-address={{ .MAC }}
|
|
|
|
[ipv4]
|
|
method=manual
|
|
address1={{ .IP }}/{{ .PrefixLen }}{{ if .Gateway }},{{ .Gateway }}{{ end }}
|
|
dns={{ range $.Nameservers }}{{ . }};{{ end }}
|
|
may-fail=false
|
|
|
|
[ipv6]
|
|
method=disabled
|
|
EOF
|
|
{{- end }}
|
|
{{- end }}
|
|
chmod 600 /etc/NetworkManager/system-connections/*.nmconnection
|
|
|
|
# chrony + ssh + NetworkManager come from the image; ensure they're enabled.
|
|
systemctl enable chronyd sshd NetworkManager
|
|
|
|
{{ if .SSHAuthorizedKeys -}}
|
|
install -d -m0700 /root/.ssh
|
|
cat > /root/.ssh/authorized_keys <<'EOF'
|
|
{{ range .SSHAuthorizedKeys }}{{ . }}
|
|
{{ end }}EOF
|
|
chmod 0600 /root/.ssh/authorized_keys
|
|
{{- end }}
|
|
|
|
# Puppet agent is baked into the image; just point it at the k8s server/CA.
|
|
PUPPET_BIN=/opt/puppetlabs/bin/puppet
|
|
"$PUPPET_BIN" config set --section main certname "{{ .FQDN }}"
|
|
"$PUPPET_BIN" config set --section main server "{{ .PuppetServer }}"
|
|
"$PUPPET_BIN" config set --section main ca_server "{{ .PuppetCAServer }}"
|
|
"$PUPPET_BIN" config set --section main report_server "{{ .PuppetServer }}"
|
|
"$PUPPET_BIN" config set --section main environment production
|
|
|
|
install -d -m0755 /etc/sysconfig
|
|
cat > /etc/sysconfig/puppet-initial <<'EOF'
|
|
PUPPETCA_URL={{ .PuppetCAURL }}
|
|
EOF
|
|
|
|
systemctl enable puppet
|
|
|
|
{{ if and .ProvisionToken .CallbackURL -}}
|
|
# Clear pxe_enabled in NetBox so the next PXE boots local disk (plain HTTP; the
|
|
# token authenticates). Non-fatal on failure.
|
|
curl -fsS -m 15 -X POST \
|
|
-H "Authorization: Bearer {{ .ProvisionToken }}" \
|
|
"{{ .CallbackURL }}" || echo "bootapi: provisioned callback failed (non-fatal)"
|
|
{{- end }}
|
|
%end
|