|
| 1 | +--- |
| 2 | +partial_category: capi-image-builder |
| 3 | +partial_name: vm-prerequisites |
| 4 | +--- |
| 5 | + |
| 6 | +- An existing VM with an OS of Rocky Linux 8 or 9 installed. This VM will be used as the base of your image and must |
| 7 | + meet the following requirements: |
| 8 | + |
| 9 | + - The following tools installed: |
| 10 | + |
| 11 | + - [conntrack-tools](https://conntrack-tools.netfilter.org/) |
| 12 | + - [cloud-init](https://cloud-init.io/) |
| 13 | + - [cloud-utils-growpart](https://github.com/canonical/cloud-utils/) |
| 14 | + - [iptables](https://linux.die.net/man/8/iptables) |
| 15 | + - python2-pip |
| 16 | + - [python3](https://www.python.org/downloads/) |
| 17 | + |
| 18 | + - A user of `builder` with a password of `builder`. This is required by the |
| 19 | + [vsphere-clone-builder](https://image-builder.sigs.k8s.io/capi/providers/vsphere#vsphere-clone-builder). The |
| 20 | + `builder` user must be granted passwordless sudo privileges. |
| 21 | + |
| 22 | + <details> |
| 23 | + |
| 24 | + <summary> `builder` user and password privileges </summary> |
| 25 | + |
| 26 | + 1. On your Rocky Linux VM, add a `builder` user. |
| 27 | + |
| 28 | + ```shell |
| 29 | + sudo useradd builder |
| 30 | + ``` |
| 31 | + |
| 32 | + 2. Set the password for the `builder` user to `builder`. |
| 33 | + |
| 34 | + ```shell |
| 35 | + echo 'builder:builder' | sudo chpasswd |
| 36 | + ``` |
| 37 | + |
| 38 | + 3. Assign passwordless sudo privileges to the `builder` user and assign the appropriate permissions. |
| 39 | + |
| 40 | + ```shell |
| 41 | + echo 'builder ALL=(ALL) NOPASSWD: ALL' | sudo tee /etc/sudoers.d/builder |
| 42 | + sudo chmod 0440 /etc/sudoers.d/builder |
| 43 | + ``` |
| 44 | + |
| 45 | + </details> |
| 46 | + |
| 47 | + - SSH password authentication enabled in `/etc/ssh/sshd_config` by setting `PasswordAuthentication` to `yes`. You must |
| 48 | + either restart `sshd` or reboot your system for the changes to take effect. |
| 49 | + |
| 50 | + - SSH password authentication enabled for `cloud-init` by setting `ssh_pwauth` to `true`. This is required to prevent |
| 51 | + `cloud-init` from overwriting `PasswordAuthentication yes` in `/etc/ssh/sshd_config` when booting the cloned VM. We |
| 52 | + recommend creating a separate file that explicitly sets `ssh_pwauth: true`. |
| 53 | + |
| 54 | + ```shell |
| 55 | + sudo tee /etc/cloud/cloud.cfg.d/99-enable-ssh-pwauth.cfg << EOF |
| 56 | + ssh_pwauth: true |
| 57 | + EOF |
| 58 | + ``` |
| 59 | +
|
| 60 | + - [IPv4 packet forwarding](https://kubernetes.io/docs/setup/production-environment/container-runtimes/#prerequisite-ipv4-forwarding-optional) |
| 61 | + enabled. |
| 62 | +
|
| 63 | + - firewalld disabled. |
| 64 | +
|
| 65 | + ```shell |
| 66 | + sudo systemctl disable --now firewalld |
| 67 | + ``` |
| 68 | +
|
| 69 | + - `/tmp` mounted to execute binaries and scripts. |
| 70 | +
|
| 71 | + <details> |
| 72 | + <summary> Check `/tmp` status </summary> |
| 73 | +
|
| 74 | + 1. Check the mount status of `/tmp`. Look for a status of `noexec`. |
| 75 | +
|
| 76 | + ```shell |
| 77 | + mount | grep '/tmp' |
| 78 | + ``` |
| 79 | +
|
| 80 | + ```shell title="Example output" hideClipboard |
| 81 | + tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noexec,relatime,size=2G) |
| 82 | + ``` |
| 83 | +
|
| 84 | + :::tip |
| 85 | +
|
| 86 | + If you receive an error, where `/tmp` is not displayed in the mount output, it is likely because it is a regular directory on the filesystem and not a separate mount. |
| 87 | +
|
| 88 | + Issue the following command to confirm the mount point of `/tmp`. If the `Mounted on` location is `/`, no action is required. |
| 89 | +
|
| 90 | + ```shell |
| 91 | + df --human-readable /tmp |
| 92 | + ``` |
| 93 | +
|
| 94 | + ```shell title="Example output" hideClipboard |
| 95 | + Filesystem Size Used Avail Use% Mounted on |
| 96 | + /dev/mapper/rl-root 70G 3.7G 67G 6% / |
| 97 | + ``` |
| 98 | +
|
| 99 | + ::: |
| 100 | +
|
| 101 | + 2. If `/tmp` has a status of `noexec`, use your preferred text editor to edit the file `/etc/fstab` and set `/tmp` to `exec`. |
| 102 | +
|
| 103 | + ```shell |
| 104 | + vi /etc/fstab |
| 105 | + ``` |
| 106 | +
|
| 107 | + ```shell title="Example output" hideClipboard {6} |
| 108 | + /dev/mapper/rl-root / xfs defaults 0 0 |
| 109 | + UUID=3b068723-b40a-4c10-ac6d-00271cd4d3a4 /boot xfs defaults 0 0 |
| 110 | + UUID=F867-A7CE /boot/efi vfat umask=0077,shortname=winnt 0 2 |
| 111 | + /dev/mapper/rl-home /home xfs defaults 0 0 |
| 112 | + /dev/mapper/rl-swap none swap defaults 0 0 |
| 113 | + tmpfs /tmp tmpfs defaults,nosuid,nodev,exec,size=2G 0 0 |
| 114 | + ``` |
| 115 | +
|
| 116 | + 3. Remount all filesystems in `/etc/fstab`. |
| 117 | +
|
| 118 | + ```shell |
| 119 | + sudo mount --all |
| 120 | + ``` |
| 121 | +
|
| 122 | + 4. Confirm the mount status of `/tmp` is set to `exec`. |
| 123 | +
|
| 124 | + ```shell |
| 125 | + mount | grep '/tmp' |
| 126 | + ``` |
| 127 | +
|
| 128 | + ```shell title="Example output" hideClipboard |
| 129 | + tmpfs on /tmp type tmpfs (rw,nosuid,nodev,exec,relatime,size=2G) |
| 130 | + ``` |
| 131 | +
|
| 132 | + </details> |
| 133 | +
|
| 134 | + - If your system has been hardened using a Security Technical Implementation Guide (STIG) policy, you may need to |
| 135 | + remediate the following: |
| 136 | +
|
| 137 | + - SELinux may prevent binaries from executing, including `cloud-init` scripts. We recommend setting the SELinux |
| 138 | + status to `permissive` or `disabled` until the image building process is complete. |
| 139 | +
|
| 140 | + <details> |
| 141 | +
|
| 142 | + <summary> Check SELinux status </summary> |
| 143 | +
|
| 144 | + 1. Check the status of SELinux. |
| 145 | +
|
| 146 | + ```shell |
| 147 | + getenforce |
| 148 | + ``` |
| 149 | +
|
| 150 | + ```shell title="Example output" hideClipboard |
| 151 | + Enforcing |
| 152 | + ``` |
| 153 | +
|
| 154 | + 2. If the status is `Enforcing`, use your preferred text editor to open the SELinux config file and set `SELINUX` |
| 155 | + to either `permissive` or `disabled`. |
| 156 | +
|
| 157 | + ```shell |
| 158 | + vi /etc/selinux/config |
| 159 | + ``` |
| 160 | +
|
| 161 | + ```shell title="Example output" hideClipboard {6} |
| 162 | + # This file controls the state of SELinux on the system. |
| 163 | + # SELINUX= can take one of these three values: |
| 164 | + # enforcing - SELinux security policy is enforced. |
| 165 | + # permissive - SELinux prints warnings instead of enforcing. |
| 166 | + # disabled - No SELinux policy is loaded. |
| 167 | + SELINUX=permissive |
| 168 | + # SELINUXTYPE= can take one of these three values: |
| 169 | + # targeted - Targeted processes are protected, |
| 170 | + # minimum - Modification of targeted policy. Only selected processes are protected. |
| 171 | + # mls - Multi Level Security protection. |
| 172 | + SELINUXTYPE=targeted |
| 173 | + ``` |
| 174 | +
|
| 175 | + </details> |
| 176 | +
|
| 177 | + - fapolicyd may prevent certain applications from executing, such as `containerd-shim-runc-v2`. We recommend |
| 178 | + disabling `fapolicyd` until the image building process is complete. |
| 179 | +
|
| 180 | + ```shell |
| 181 | + sudo systemctl disable --now fapolicyd |
| 182 | + ``` |
| 183 | +
|
| 184 | + - A snapshot of your VM created once all other prerequisites are met. This is required by the |
| 185 | + [vsphere-clone-builder](https://image-builder.sigs.k8s.io/capi/providers/vsphere#vsphere-clone-builder). |
0 commit comments