unkinben
c66eaedbd8
Adds a fast, reproducible install path that unpacks a prebuilt AlmaLinux 9 node
rootfs onto the disk instead of resolving packages, with per-host networking
still templated after the unpack. Storage reuses the OptiPlex model vars so
image and package installs lay disks out identically.
- kickstart/image.ks.tmpl: liveimg --url={{ .DistroVars.rootfs_tarball }};
%post renders per-host NetworkManager keyfiles from NetBox interface data
(the image is generic and liveimg clobbers /etc), sets hostname, the
puppet-initial PUPPETCA_URL env, and the provisioned callback.
- kickstart/_storage.ks.tmpl: shared storage-block/storage-pre partials
(storage_mode / vg_grow); almalinux9.ks.tmpl now uses them too (no behaviour
change) so both installs share one storage layout.
- catalog/almalinux9-image.yaml (generic autopart) + optiplex-7080-image.yaml
(auto-nvme + vg_grow) point liveimg at the artifactapi rootfs-images repo.
- .woodpecker/build-image.yaml: builds the rootfs via dnf --installroot,
tars almalinux9-node-<ver>.tar.zst, uploads to the rootfs-images local repo
on tag node-image-<ver>.
Validated with bootapi validate + shellcheck; no bootapi code change (DistroVars
+ existing interface data suffice).
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
118 lines
4.1 KiB
Cheetah
118 lines
4.1 KiB
Cheetah
{{- /*
|
|
AlmaLinux 9 kickstart (package install), ported from the Cobbler default.ks
|
|
contract. Install source is the artifactapi almalinux remote (catalog mirror
|
|
var). The %post installs the Puppet agent, points it at the k8s puppetserver,
|
|
writes the puppet-initial PUPPETCA_URL env file, then posts back to bootapi so
|
|
pxe_enabled flips off (Cobbler's netboot_enabled flow).
|
|
|
|
Storage is model-aware via the shared _storage.ks.tmpl partials (storage_mode /
|
|
vg_grow catalog vars) so this and image.ks.tmpl lay disks out identically.
|
|
|
|
Data model: docs/data-model.md. `.RootPasswordHash` / `.ProvisionToken` come
|
|
from Vault/env at render time, never from NetBox.
|
|
*/ -}}
|
|
{{- $mirror := .DistroVars.mirror -}}
|
|
#version=RHEL9
|
|
# Rendered by bootapi for {{ .FQDN }} (platform {{ .Platform }}, role {{ default "none" .Role }})
|
|
text
|
|
eula --agreed
|
|
firstboot --disable
|
|
reboot
|
|
|
|
# --- install source (artifactapi almalinux remote, from the distro catalog) ---
|
|
url --url={{ $mirror }}/BaseOS/{{ .Arch }}/os/
|
|
repo --name=AppStream --baseurl={{ $mirror }}/AppStream/{{ .Arch }}/os/
|
|
|
|
# --- localization ---
|
|
keyboard --xlayouts='au'
|
|
lang en_AU.UTF-8
|
|
timezone Australia/Sydney --utc
|
|
|
|
# --- security ---
|
|
{{ if .RootPasswordHash -}}
|
|
rootpw --iscrypted {{ .RootPasswordHash }}
|
|
{{- else -}}
|
|
rootpw --lock
|
|
{{- end }}
|
|
selinux --enforcing
|
|
firewall --enabled --service=ssh
|
|
authselect select sssd with-mkhomedir --force
|
|
|
|
# --- networking (static, from NetBox) ---
|
|
{{- $primary := .PrimaryInterface }}
|
|
{{- range .Interfaces }}
|
|
{{- if .IP }}
|
|
network --bootproto=static --device={{ .MAC }} --ip={{ .IP }} --netmask={{ .Netmask }}{{ if .Gateway }} --gateway={{ .Gateway }}{{ end }}{{ range $.Nameservers }} --nameserver={{ . }}{{ end }}{{ if and $primary (eq .MAC $primary.MAC) }} --hostname={{ $.FQDN }}{{ end }} --activate --onboot=on --noipv6
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
# --- storage (model-aware; shared with image.ks.tmpl via _storage.ks.tmpl) ---
|
|
{{ template "storage-block" . }}
|
|
|
|
# kdump: reserve crash memory (Cobbler com_redhat_kdump; kexec-tools baked below).
|
|
%addon com_redhat_kdump --enable --reserve-mb='auto'
|
|
%end
|
|
{{ template "storage-pre" . }}
|
|
|
|
# --- packages ---
|
|
%packages --ignoremissing --excludedocs
|
|
@^minimal-environment
|
|
openssh-server
|
|
chrony
|
|
kexec-tools
|
|
bind-utils
|
|
vim-minimal
|
|
tmux
|
|
git
|
|
-iwl*-firmware
|
|
%end
|
|
|
|
# --- bootstrap: puppet (k8s) + end-of-install callback ---
|
|
%post --log=/root/bootapi-post.log
|
|
set -x
|
|
|
|
# chrony: keep time sane before any cert work.
|
|
systemctl enable chronyd
|
|
|
|
{{ if .SSHAuthorizedKeys -}}
|
|
# root authorized_keys (from render-time config, not NetBox).
|
|
install -d -m0700 /root/.ssh
|
|
cat > /root/.ssh/authorized_keys <<'EOF'
|
|
{{ range .SSHAuthorizedKeys }}{{ . }}
|
|
{{ end }}EOF
|
|
chmod 0600 /root/.ssh/authorized_keys
|
|
{{- end }}
|
|
|
|
# Install the Puppet 8 agent from the puppet platform repo.
|
|
rpm -q puppet-agent >/dev/null 2>&1 || \
|
|
dnf install -y https://yum.puppet.com/puppet8-release-el-9.noarch.rpm
|
|
dnf install -y puppet-agent
|
|
|
|
# Point the agent at the k8s puppetserver / CA.
|
|
PUPPET_BIN=/opt/puppetlabs/bin/puppet
|
|
"$PUPPET_BIN" config set --section main certname "{{ .FQDN }}"
|
|
"$PUPPET_BIN" config set --section main server "{{ .PuppetServer }}"
|
|
"$PUPPET_BIN" config set --section main ca_server "{{ .PuppetCAServer }}"
|
|
"$PUPPET_BIN" config set --section main report_server "{{ .PuppetServer }}"
|
|
"$PUPPET_BIN" config set --section main environment production
|
|
|
|
# puppet-initial bootstrap unit reads PUPPETCA_URL from this EnvironmentFile.
|
|
install -d -m0755 /etc/sysconfig
|
|
cat > /etc/sysconfig/puppet-initial <<'EOF'
|
|
PUPPETCA_URL={{ .PuppetCAURL }}
|
|
EOF
|
|
|
|
# Enable the agent; first boot triggers firstrun (autosign handles the CSR).
|
|
systemctl enable puppet
|
|
|
|
{{ if and .ProvisionToken .CallbackURL -}}
|
|
# Tell bootapi the install is done so it clears pxe_enabled in NetBox and the
|
|
# next PXE boots local disk. Runs over plain HTTP (no internal CA trust yet);
|
|
# the token authenticates the call. Non-fatal if it fails (the local-disk
|
|
# fallback still protects a re-provisioned host on the following boot).
|
|
curl -fsS -m 15 -X POST \
|
|
-H "Authorization: Bearer {{ .ProvisionToken }}" \
|
|
"{{ .CallbackURL }}" || echo "bootapi: provisioned callback failed (non-fatal)"
|
|
{{- end }}
|
|
%end
|