randy/randy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fully updated to bionic

Browse source
This commit is contained in:
Randy Bush 2019-08-15 11:34:20 -07:00
parent 6b0bc7fef2
commit 307d1c9e5a
No known key found for this signature in database
GPG key ID: D5597695EA37E360
1 changed files with 114 additions and 68 deletions
Download patch file Download diff file Expand all files Collapse all files

182
ubuntu18-on-ganeti.md
View file

@ -1,6 +1,6 @@
# Installing a Ubuntu 18.04 Guest on an Ganeti Cluster
For this example, I will use the vm/host name build1.sjc.arrcus.com on the
For this example, I will use the vm/host name gogs.sjc.arrcus.com on the
San Jose office cluster. Modify to suit your needs.
Before I start the install, I put the new host in the DNS so that it has
@ -10,24 +10,24 @@ time to propagate.
I cheat and use a script.
vm0.sjc.arrcus.com:/root# ./do-add vm1 128 32 build1.sjc.arrcus.com
vm0.sjc.arrcus.com:/root# ./do-add vm1 128 32 gogs.sjc.arrcus.com
Tue Jun 19 22:10:05 2018 * disk 0, size 128.0G
Tue Jun 19 22:10:05 2018 * creating instance disks...
Tue Jun 19 22:10:06 2018 adding instance build1.sjc.arrcus.com to cluster config
Tue Jun 19 22:10:06 2018 adding instance gogs.sjc.arrcus.com to cluster config
Tue Jun 19 22:10:06 2018 adding disks to cluster config
Tue Jun 19 22:10:06 2018 * wiping instance disks...
Tue Jun 19 22:10:06 2018 - INFO: * Wiping disk 0
Tue Jun 19 22:10:10 2018 - INFO: - done: 0.8% ETA: 7m 40s
...
Tue Jun 19 22:17:25 2018 - INFO: - done: 93.8% ETA: 29s
Tue Jun 19 22:17:55 2018 - INFO: Waiting for instance build1.sjc.arrcus.com to sync disks
Tue Jun 19 22:17:55 2018 - INFO: Instance build1.sjc.arrcus.com's disks are in sync
Tue Jun 19 22:17:55 2018 - INFO: Waiting for instance build1.sjc.arrcus.com to sync disks
Tue Jun 19 22:17:56 2018 - INFO: Instance build1.sjc.arrcus.com's disks are in sync
Tue Jun 19 22:17:55 2018 - INFO: Waiting for instance gogs.sjc.arrcus.com to sync disks
Tue Jun 19 22:17:55 2018 - INFO: Instance gogs.sjc.arrcus.com's disks are in sync
Tue Jun 19 22:17:55 2018 - INFO: Waiting for instance gogs.sjc.arrcus.com to sync disks
Tue Jun 19 22:17:56 2018 - INFO: Instance gogs.sjc.arrcus.com's disks are in sync
Find the VNC console of the new VM
vm0.sjc.arrcus.com:/root# gnt-instance info build1.sjc.arrcus.com | grep console
vm0.sjc.arrcus.com:/root# gnt-instance info gogs.sjc.arrcus.com | grep console
console connection: vnc to 127.0.0.1:11003 (node vm1.sjc.arrcus.com) (display 5138)
serial_console: default (True)
@ -35,7 +35,7 @@ Remember that `11002` for VNC.
Spin up the VM but boot from the Debian install CD-ROM
gnt-instance start -H boot_order=cdrom,cdrom_image_path=/ISOs/ubuntu-18.04.2-live-server-amd64.iso build1.sjc.arrcus.com
gnt-instance start -H boot_order=cdrom,cdrom_image_path=/ISOs/ubuntu-18.04.3-server-amd64.iso gogs.sjc.arrcus.com
From your local host, go for the VNC concole over a nice safe ssh
tunnel. Tunnel to vm1.sjc.arrcus.com because that is where the instance
@ -58,7 +58,9 @@ Do the Debian install over the VNC GUI. The options I choose are:
Alternatively, instead of this step, use
https://git.rg.net/randy/randy/src/master/expanded-lvm-install.md
* OpenSSH server as well as the standard system utilities. Not the
* I choose security updates, but later configuration will automate that.
* OpenSSH server. If offered, the standard system utilities. Not the
desktop stuff. No print server.
@ -67,22 +69,35 @@ Do the Debian install over the VNC GUI. The options I choose are:
The installation completes, and the darn thing reboots the CD-ROM. So I
get brutal, and back on the VM node I
gnt-instance reboot --shutdown-timeout=3 build1.sjc.arrcus.com
gnt-instance reboot --shutdown-timeout=3 gogs.sjc.arrcus.com
This usually whacks my VNC session, so I have to restart the client.
Because I used DHCP I have to `ip address` to get the DHCP address of
the host and ssh into it from a terminal/xterm window on my laptop so I
have a copy and paste interface.
the host and ssh into it from a terminal/xterm window on my laptop so
I have a copy and paste interface. So log in the VNC session to find
the IP address
```
ip address
```
Then, one can ssh in from a real x[]term as the configured user and
```
sudo bash
```
## First Configuration
The first thing is set the password to something nasty.
Then I become root, and get the software current. This is generally a noop on debian, as the install does the upgrades automagically.
Then get the software current as, unlike debian, Ubuntu does not upgrade
on install.
sudo apt update
sudo apt upgrade
```
apt update
apt upgrade
```
This can take a while.
@ -92,33 +107,45 @@ If it does not run Emacs, it is not a computer. And I install unbound so
we have a local nameserver, and chrony so we have a local chime. We will
do detailed configuration of unbound later.
sudo apt install emacs-nox unbound chrony rsync sudo screen
sudo chown -R unbound:unbound /etc/unbound
```
apt install emacs-nox unbound chrony rsync sudo screen
```
Hack `/etc/sudoers` to make it passwordless for members of the sudo group.
%sudo ALL=(ALL) NOPASSWD: SETENV: ALL
```
%sudo ALL=(ALL) NOPASSWD: SETENV: ALL
```
Add the initial user to /etc/group in group sudo
sudo usermod -a -G sudo randy
```
sudo usermod -a -G sudo randy
```
I want to disable ssh passwording as soon as reasonable, so I install
my ssh credentials.
```
cd /root
mkdir .ssh
chmod 700 .ssh
cat > .ssh/authorized_keys
cat > .ssh/authorized_keys << EOF
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID9DzOVboz/9daQwQRPkxD/D4PZ4ZVNgMLqd+zc79Gl+ randy@ryuu.psg.com
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAww1WTCBezBK1snfUKi1LAwIIvQEQuhgV63toCMnTrYZfkp9/jyI1WVmKf4FIiodJWWeUtjCkt2E7t0oPZ7BxNbP8bn6HTso8qTexng8kM23UCgdzorp0ofatO0esdIdbuXd8qu9uJRlJn1TwVYeY7qY10eF60CbSZawuwSsM0iq0EbKTJQkHBtytd1zC7a7geGfieR4D3sHB9b33YhUgP9b1EO+CYtS8Qbb8xbMboD1eIB0UH0jcSUVZvb2DRtnsyIVQioW6zaAbIbFz7x+5zJBsFjkDvjR/80atOvNYJTyYZRD71D3kBu2peYup2XrsTPvrsKh5hJCVlJFCuFQaNQ== randy@psg.com
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC8yvE/UBwHdLVDk708/U81ZQdtDLF9Y7grMkVBfUoclF4BGFCcH1bIv6y0p1I/2PATSRnK/B5ndvWP/SrQ6y0DqnQugHKoFMR3idkzVagjjXOhcZkpitcp5hRCdjn/y/88QEiIKItEM66q48nW0OtCgcq7ENXQuYUVt0e6kh6UKRDfrPP3i2D7m8o3/W+xYt8QkYZ0iFanCfhxHAP7w3SOezmThu+p7V6yxVcy+G0WTvPHrs2JlgSaI+4SoJ2btPgqIrmKu1ILfyoAr9/RjSVHr74LijsdUKec7OXnKnV2v1VfMRglBXFgXVaWyX/adA2tMuh9nMk3Y3a3+xDqPIz6RnzQAupqUmPZ/1qbFIrVSNmhygWTC9jgemaNNC/B1nFG7em6m+fmxKjauuWoIdpybaofWiJElUDBBT4bHU+L8NF7zbNROt1GtaDnbL4W9/asqzPu+aJy7L6uJQHtkc/eoXsheajztFC9I5qxW/29ja+FcQsVoDJpe96XmBtJ7elOGXaq3YtDRURwrdu9fGUBDWqwP1IFECVkeVh/NrXbQRHtgp4v533D+0MubA+hDhVTsUk6G93WLyX3usUprU1cJjyhrVzZ9U23eCPOj8J18Ixw4sJFuNeUhSCaN6j+rmOyGor3PYYysKTp1VfLNAYdcc/AYC0jDy9mYjjfCDwKfQ== randy@ryuu.psg.com
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP2qXA3uRFGv7Q0yolQtC5bcF7kVW94c/aOhf0xbU3i8 randy@kappa.local
```
```
EOF
chmod 600 .ssh/authorized_keys
```
Copy the ssh authority to the user account
```
rsync -vlpPStgoHxr .ssh ~randy
chown -R randy:randy ~randy
```
Disallow plaintext password logins by editing `/etc/ssh/sshd_config` as
root
@ -129,53 +156,59 @@ root
Take the new sshd config
sudo service ssh restart
I want to be able to do ssh stuff to the root, so I
sudo rsync -r .ssh /root
sudo chown -R root:root /root
```
service ssh restart
```
I want real addressing as soon as possible, so I go through the netplan
horror
sudo cat > /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg << EOF
network: {config: disabled}
EOF
```
sudo cat > /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg << EOF
network: {config: disabled}
EOF
```
Then edit the netplan config to look something such as
Then edit `/etc/netplan/01-netcfg.yaml` to look something such as
network:
ethernets:
ens5:
dhcp4: no
dhcp6: no
addresses: [10.9.42.55/16,]
gateway4: 10.9.1.1
nameservers:
addresses: [127.0.0.1, 10.9.101.207]
version: 2
```
network:
version: 2
renderer: networkd
ethernets:
ens5:
dhcp4: no
dhcp6: no
addresses: [10.9.42.43/16,]
gateway4: 10.9.1.1
nameservers:
addresses: [127.0.0.1, 10.9.42.25]
```
It's YAML, so no tabs. Then check it with
sudo netplan --debug generate
```
sudo netplan --debug generate
```
Then you can make it the active configuration with
sudo netplan apply
```
sudo netplan apply
```
Of course this will lose connectivity, but now you can ssh back in to
the real address.
I want my standard dot files, so I go to a recently customized Xenial
I want my standard dot files, so I go to a recently customized Bionic
system and rsync them over.
rsync -vlpPStgoHx .bashrc .emacs .exrc .forward .inputrc randy@build1.sjc.arrcus.com:
ssh randy@build1.sjc.arrcus.com chown -R randy:randy .
rsync -vlpPStgoHx .bashrc .emacs .exrc .forward .inputrc randy@gogs.sjc.arrcus.com:
ssh randy@gogs.sjc.arrcus.com chown -R randy:randy .
And a bit of decoration from the other system
rsync -vlpPStgoHx xtitle root@build1.sjc.arrcus.com:/usr/bin/
rsync -vlpPStgoHx xtitle root@gogs.sjc.arrcus.com:/usr/bin/
## Configure GRUB and the Network
@ -186,17 +219,20 @@ Configure GRUB for
Edit `/etc/default/grub`
GRUB_TIMEOUT=6
...
GRUB_CMDLINE_LINUX="console=tty0 console=ttyS0,9600n8 no-kvmclock"
...
GRUB_TERMINAL="console serial"
GRUB_SERIAL_COMMAND="serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1"
```
GRUB_TIMEOUT=6
...
GRUB_CMDLINE_LINUX="console=tty0 console=ttyS0,9600n8 no-kvmclock"
...
GRUB_TERMINAL="console serial"
GRUB_SERIAL_COMMAND="serial --speed=9600 --unit=0 --word=8 --parity=no --stop=1"
```
**And remember to update GRUB**
sudo update-grub
```
sudo update-grub
```
## Try to get the DNS working
@ -204,7 +240,7 @@ Edit `/etc/hosts` to know the short and long form of the host's name
Set the hostnme in a very broque manner
sudo hostnamectl set-hostname build1.sjc.arrcus.com
sudo hostnamectl set-hostname gogs.sjc.arrcus.com
Then one has to edit `/etc/cloud/cloud.cfg` and change
@ -231,7 +267,17 @@ unbound to know. So copy the file over and restart unbound
sudo -Es
rsync 10.9.101.207:/etc/unbound/unbound.conf.d/stubs.conf /etc/unbound/unbound.conf.d/
service unbound restart
edit `/etc/resolv.conf`
```
cat > /etc/resolv.conf << EOF
nameserver 127.0.0.1
search arrcus.com sjc.arrcus.com
EOF
```
## Final Cosmetics
Set the timezone. All my servers are in UTC
@ -243,21 +289,21 @@ and watch for problems. I could tell the VM to reboot, or whack it from
the Ganeti master. To ensure it is really clean, I do the latter. I do
not force the timeout so I can ensure that APCI works.
gnt-instance reboot build1.sjc.arrcus.com
gnt-instance reboot gogs.sjc.arrcus.com
## Use Ansible to Install and Configure a Bunch of Things
Now the barrage of ansible, which for me is based on my Mac laptop.
ansible-playbook -l build1.sjc.arrcus.com no-depends.yml unattended-upgrades.yml
ansible-playbook -l gogs.sjc.arrcus.com no-depends.yml unattended-upgrades.yml chrony.yml
## Add the VM to Infrastructure Monitoring Etc.
Create an entry in `srv0.iad.arrcus.com:/etc/nagios3/conf.d` and enable
checks in the GUI
Add the device to snmp monitoring `https://nms.arrcus.com/`
---
2019.03.23
2019.08.15