Procedure

1. Install the image builder and other necessary packages on the VM:

   • osbuild-composer - supported from RHEL 8.3 onward
   • composer-cli
   • cockpit-composer
   • bash-completion

   # dnf install osbuild-composer composer-cli cockpit-composer bash-completion

   The web console is installed as a dependency of the cockpit-composer package.

2. Enable image builder to start after each reboot:

   # systemctl enable --now osbuild-composer.socket
   # systemctl enable --now cockpit.socket

   The osbuild-composer and cockpit services start automatically on first access.

3. Load the shell configuration script so that the autocomplete feature for the composer-cli command starts working immediately without reboot:

   $ source /etc/bash_completion.d/composer-cli

Procedure

1. Create a repository source file:

   id = "repository_id"
   name = "repository_name"
   type = "repository_type"
   url = "repository-url"
   check_gpg = false
   check_ssl = false

   For example:

   id = "k8s"
   name = "Kubernetes"
   type = "yum-baseurl"
   url = "https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64"
   check_gpg = false
   check_ssl = false
   system = false

2. Save the file in the TOML format.

3. Add the new third-party source with the following command:

   $ composer-cli sources add <file-name>.toml

Procedure

1. Create a repository source file:

   check_gpg = true
   check_ssl = true
   distros = ["list_of_distributions"]
   id = "repository_id"
   name = "repository-name"
   system = false
   type = ""repository_type"
   url = "repository-url"

   For example, to specify the distribution:

   check_gpg = true
   check_ssl = true
   distros = ["rhel-9"]
   id = "rh9-local"
   name = "packages for RHEL"
   system = false
   type = "yum-baseurl"
   url = "http://local/repos/rhel9/projectrepo/"

2. Save the file in the TOML format.

Procedure

1. Access the folder where you want to create a repository:

   $ cd repo/

2. Run the createrepo_c to create a repository from RPM packages:

   $ createrepo_c .

3. Access the directory where the repodata is:

   $ cd repodata/

4. Set up a repository by signing your repomd.xml file:

   $ gpg -u YOUR-GPG-KEY-EMAIL --yes --detach-sign --armor repomd.xml

5. Check the GPG signature.

   1. Set check_repogpg = true in the repository source.

   2. If your key is available over https, set the gpgkeys field with the key URL for the key. You can add as many URL keys as you need The following is an example:

      check_gpg = true
      check_ssl = true
      id = "repository_id"
      name = "repository_name"
      system = false
      type = "repository_type"
      url = "repository_URL"
      check_repogpg = true
      gpgkeys=["_GPG_key_URL"]

   3. Optional: You can embed the whole key into the gpgkeys field. You can add as many keys as you need. For example, add the GPG key directly in the gpgkeys field:

      check_gpg = true
      check_ssl = true
      check_repogpg
      id = "repository_id"
      name = "repository_name"
      system = false
      type = "repository_type"
      url = "repository_URL"
      gpgkeys=["GPG_key"]

Procedure

1. Create a directory where you want to store your repository overrides:

   $ sudo mkdir -p /etc/osbuild-composer/repositories

2. You can create your own JSON file structure.

3. Create a JSON file, using a name corresponding to your RHEL version. Alternatively, you can copy the file for your distribution from /usr/share/osbuild-composer/ and modify its content.

   For RHEL 9, use /etc/osbuild-composer/repositories/rhel-92.json.

4. Add the following structure to your JSON file, for example:

   {
       "<ARCH>": [
           {
               "name": "baseos",
               "baseurl": "http://mirror.example.com/composes/released/RHEL-9/9.0/BaseOS/x86_64/os/",
               "gpgkey": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\n (…​)",
               "check_gpg": true,
               "metadata_expire": ""
           }
       ]
   }

   Specify only one of the following attributes:

   • baseurl - string: a base URL of the repository.
   • metalink - string: a URL of a metalink file that contains a list of valid mirror repositories.

   • mirrorlist - string: a URL of a mirrorlist file that contains a list of valid mirror repositories

     The remaining fields are optional.

     1. Alternatively, you can copy the JSON file for your distribution.

        1. Copy the repository file to the directory you created. In the following command, replace rhel-version.json with your RHEL version, for example: rhel-9.json.

           $  cp /usr/share/osbuild-composer/repositories/rhel-version.json /etc/osbuild-composer/repositories/

5. Using a text editor, edit the baseurl paths in the rhel-9.json file and save it. For example:

   $ vi /etc/osbuild-composer/repositories/rhel-version.json

6. Restart the osbuild-composer.service:

   $ sudo systemctl restart osbuild-composer.service

Procedure

1. Obtain the baseurl from the /etc/yum.repos.d/redhat.repo file:

   # cat /etc/yum.repos.d/redhat.repo
   [AppStream]
   name = AppStream mirror example
   baseurl = https://mirror.example.com/RHEL-9/9.0/AppStream/x86_64/os/
   enabled = 1
   gpgcheck = 0
   sslverify = 1
   sslcacert = /etc/pki/ca1/ca.crt
   sslclientkey = /etc/pki/ca1/client.key
   sslclientcert = /etc/pki/ca1/client.crt
   metadata_expire = 86400
   enabled_metadata = 0

2. Configure the repository override to use the same baseurl and set rhsm to true:

   {
       "x86_64": [
           {
               "name": "AppStream mirror example",
               "baseurl": "https://mirror.example.com/RHEL-9/9.0/AppStream/x86_64/os/",
               "gpgkey": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\n (…​)",
               "check_gpg": true,
               "rhsm": true
           }
       ]
   }

   Note

   osbuild-composer does not automatically use repositories defined in /etc/yum.repos.d/. You need to manually specify them either as a system repository override or as an additional source using composer-cli. System repository overrides are usually used for “BaseOS” and “AppStream” repositories, whereas composer-cli sources are used for all the other repositories.

1. Export (save) the blueprint definition to a plain text file
2. Edit this file in a text editor
3. Import (push) the blueprint text file back into image builder
4. Run a compose to build an image from the blueprint
5. Export the image file to download it

Procedure

1. Create a plain text file with the following contents:

   name = "BLUEPRINT-NAME"
   description = "LONG FORM DESCRIPTION TEXT"
   version = "0.0.1"
   modules = []
   groups = []

   Replace BLUEPRINT-NAME and LONG FORM DESCRIPTION TEXT with a name and description for your blueprint.

   Replace 0.0.1 with a version number according to the Semantic Versioning scheme.

2. For every package that you want to be included in the blueprint, add the following lines to the file:

   [[packages]]
   name = "package-name"
   version = "package-version"

   Replace package-name with the name of the package, such as httpd, gdb-doc, or coreutils.

   Replace package-version with the version to use. This field supports dnf version specifications:

   • For a specific version, use the exact version number such as 8.7.0.
   • For the latest available version, use the asterisk *.
   • For the latest minor version, use formats such as 8.*.

3. Customize your blueprints to suit your needs. For example, disable Simultaneous Multi Threading (SMT), add the following lines to the blueprint file:

   [customizations.kernel]
   append = "nosmt=force"

   For additional customizations available, see Supported Image Customizations.

4. Save the file, for example, as BLUEPRINT-NAME.toml and close the text editor.

5. Push (import) the blueprint:

   # composer-cli blueprints push BLUEPRINT-NAME.toml

   Replace BLUEPRINT-NAME with the value you used in previous steps.

   Note

   To create images using composer-cli as non-root, add your user to the weldr or root groups.

   # usermod -a -G weldr user
   $ newgrp weldr

Procedure

1. Save (export) the blueprint to a local text file:

   # composer-cli blueprints save BLUEPRINT-NAME

2. Edit the BLUEPRINT-NAME.toml file with a text editor and make your changes.

3. Before finishing the edits, verify that the file is a valid blueprint:

   1. Remove this line, if present:

      packages = []

   2. Increase the version number, for example, fro 0.0.1 to 0.1.0. Remember that image builder blueprint versions must use the Semantic Versioning scheme. Note also that if you do not change the version, the patch version component increases automatically.

   3. Check if the contents are valid TOML specifications. See the TOML documentation for more information.

      Note

      TOML documentation is a community product and is not supported by Red Hat. You can report any issues with the tool at https://github.com/toml-lang/toml/issues

4. Save the file and close the text editor.

5. Push (import) the blueprint back into image builder:

   # composer-cli blueprints push BLUEPRINT-NAME.toml

   Note

   To import the blueprint back into image builder, supply the file name including the .toml extension, while in other commands use only the blueprint name.

6. To verify that the contents uploaded to image builder match your edits, list the contents of blueprint:

   # composer-cli blueprints show BLUEPRINT-NAME

7. Check whether the components and versions listed in the blueprint and their dependencies are valid:

   # composer-cli blueprints depsolve BLUEPRINT-NAME

Procedure

1. Start the compose:

   # composer-cli compose start BLUEPRINT-NAME IMAGE-TYPE

   Replace BLUEPRINT-NAME with name of the blueprint, and IMAGE-TYPE with the type of the image. For the available values, see the output of the composer-cli compose types command.

   The compose process starts in the background and shows the composer Universally Unique Identifier (UUID).

2. Wait until the compose process is finished. The image creation can take up to ten minutes to complete.

   To check the status of the compose:

   # composer-cli compose status

   A finished compose shows the FINISHED status value. To identify your compose in the list, use its UUID.

3. After the compose process is finished, download the resulting image file:

   # composer-cli compose image UUID

   Replace UUID with the UUID value shown in the previous steps.

Procedure

1. Open https://localhost:9090/ in a web browser on the system where image builder is installed.

   For more information about how to remotely access image builder, see Managing systems using the RHEL web console document.

2. Log in to the web console as the root user.

3. To display the image builder controls, click the image builder icon, in the upper-left corner of the window.

   The image builder dashabord opens, listing existing blueprints, if any.

Procedure

1. Click Create Blueprint in the upper-right corner.

   A dialog wizard with fields for the blueprint name and description opens.

2. On the Details page:

   1. Enter the name of the blueprint and, optionally, its description. Click Next.

3. Optional: In the Packages page:

   1. On the Available packages search, enter the package name and click the > button to move it to the Chosen packages field. Search and include as many packages as you want. Click Next.

      Note

      These customizations are all optional unless otherwise specified.

4. On the Kernel page, enter a kernel name and the command-line arguments.

5. On the File system page, you can select Use automatic partitioning or Manually configure partitions for your image file system. For manually configuring the partitions, complete the following steps:

   1. Click the Manually configure partitions button.

      The Configure partitions section opens, showing the configuration based on Red Hat standards and security guides.

   2. From the dropdown menu, provide details to configure the partitions:

      1. For the Mount point field, select one of the following mount point type options:

         • / - the root mount point
         • /var
         • /home
         • /opt
         • /srv
         • /usr
         • /app
         • /data
         • /tmp

         • /usr/local

           You can also add an additional path to the Mount point, such as /tmp. For example: /var as a prefix and /tmp as an additional path results in /var/tmp.

           Note

           Depending on the Mount point type you choose, the file system type changes to xfs, and so on.

      2. For the Minimum size partition field of the file system, enter the desired minimum partition size. In the Minimum size dropdown menu, you can use common size units such as GiB, MiB, or KiB. The default unit is GiB.

         Note

         Minimum size means that the image builder can still increase the partition sizes, in case they are too small to create a working image.

   3. To add more partitions, click the Add partition button. If you see the following error message: “Duplicate partitions: Only one partition at each mount point can be created.”, you can:

      1. Click the Remove button to remove the duplicated partition.
      2. Choose a new mount point for the partition you want to create.
   4. After you finish the partitioning configuration, click Next.

6. On the Services page, you can enable or disable services:

   1. Enter the service names you want to enable or disable, separating them by a comma, by space, or by pressing the Enter key. Click Next.

7. On the Firewall page, set up your firewall setting:

   1. Enter the Ports, and the firewall services you want to enable or disable.
   2. Click the Add zone button to manage your firewall rules for each zone independently. Click Next.

8. On the Users page, add a users by following the steps:

   1. Click Add user.
   2. Enter a Username, a password, and a SSH key. You can also mark the user as a privileged user, by clicking the Server administrator checkbox. Click Next.

9. On the Groups page, add groups by completing the following steps:

   1. Click the Add groups button:

      1. Enter a Group name and a Group ID. You can add more groups. Click Next.

10. On the SSH keys page, add a key:

    1. Click the Add key button.

       1. Enter the SSH key.
       2. Enter a User. Click Next.

11. On the Timezone page, set your timezone settings:

    1. On the Timezone field, enter the timezone you want to add to your system image. For example, add the following timezone format: "US/Eastern".

       If you do not set a timezone, the system uses Universal Time, Coordinated (UTC) as default.

    2. Enter the NTP servers. Click Next.

12. On the Locale page, complete the following steps:

    1. On the Keyboard search field, enter the package name you want to add to your system image. For example: ["en_US.UTF-8"].
    2. On the Languages search field, enter the package name you want to add to your system image. For example: "us". Click Next.

13. On the Others page, complete the following steps:

    1. On the Hostname field, enter the hostname you want to add to your system image. If you do not add a hostname, the operating system determines the hostname.
    2. Mandatory only for the Simplifier Installer image: On the Installation Devices field, enter a valid node for your system image. For example: dev/sda1. Click Next.

14. Mandatory only when building FIDO images: On the FIDO device onboarding page, complete the following steps:

    1. On the Manufacturing server URL field, enter the following information:

       1. On the DIUN public key insecure field, enter the insecure public key.
       2. On the DIUN public key hash field, enter the public key hash.
       3. On the DIUN public key root certs field, enter the public key root certs. Click Next.

15. On the OpenSCAP page, complete the following steps:

    1. On the Datastream field, enter the datastream remediation instructions you want to add to your system image.
    2. On the Profile ID field, enter the profile_id security profile you want to add to your system image. Click Next.

16. Mandatory only when building Ignition images: On the Ignition page, complete the following steps:

    1. On the Firstboot URL field, enter the package name you want to add to your system image.
    2. On the Embedded Data field, drag or upload your file. Click Next.
17. . On the Review page, review the details about the blueprint. Click Create.

Procedure

1. On the image builder dashboard, click Import blueprint. The Import blueprint wizard opens.
2. From the Upload field, either drag or upload an existing blueprint. This blueprint can be in either TOML or JSON format.

3. Click Import. The dashboard lists the blueprint you imported.

   When you click the blueprint you imported, you have access to a dashboard with all the customizations for the blueprint that you imported.

Procedure

1. On the image builder dashboard, select the blueprint you want to export.
2. Click Export blueprint. The Export blueprint wizard opens.

3. To save the Exported blueprint, click the Export button.

   1. Optionally, click the Copy button to copy the blueprint.

Verification

1. Open the exported blueprint to inspect and review it.

Procedure

1. Access image builder dashboard.
2. On the blueprint table, find the blueprint you want to build an image.
3. On the right side of the chosen blueprint, click Create Image. The Create image dialog wizard opens.
4. Navigate to the Images tab and click Create Image. The Create image wizard opens.

5. On the Image output page, complete the following steps:

   1. From the Select a blueprint list, select the image type you want.

   2. From the Image output type list, select the image output type you want.

      Depending on the image type you select, you need to add further details.

6. Click Next.

7. On the Review page, review the details about the image creation and click Create image.

   The image build starts and takes up to 20 minutes to complete.

Procedure

1. Create the ISO image:

   # composer-cli compose start BLUEPRINT-NAME image-installer

   • BLUEPRINT-NAME with name of the blueprint you created

   • image-installer is the image type

     The compose process starts in the background and the UUID of the compose is shown.

2. Wait until the compose is finished. Note that this might take several minutes.

   To check the status of the compose:

   # composer-cli compose status

   A finished compose shows a status value of FINISHED. Identify the compose in the list by its UUID.

3. After the compose is finished, download the created image file:

   # composer-cli compose image UUID

   Replace UUID with the UUID value obtained in the previous steps.

   As a result, image builder builds a .iso file that contains a .tar file. The .tar file is the image that will be installed for the Operating system. The . iso is set up to boot Anaconda and install the tar file to set up the system.

Verification

1. Navigate to the folder where you downloaded the image file.
2. Locate the .iso image you downloaded.

3. Mount the ISO.

   $ mount -o ro path_to_ISO /mnt

   You can find the .tar file at the /mnt/liveimg.tar.gz directory.

4. Extract .tar file content.

   $ tar xzf /mnt/liveimg.tar.gz

Procedure

1. Open the image builder interface of the RHEL web console in a browser. See Creating an image builder blueprint using the command-line interface.
2. Locate the blueprint that you want to use to build your image. To do so, enter the blueprint name or a part of it into the search box at upper left, and click Enter.

3. On the right side of the blueprint, click the corresponding Create Image button.

   The Create image dialog wizard opens.

4. On the Create image dialog wizard:

   1. In the Image Type list, select "RHEL Installer (.iso)".
   2. Click Create.

1. Click Download to save the "RHEL Installer (.iso)" image to your system.
2. Navigate to the folder where you downloaded the "RHEL Installer (.iso)" image.
3. Locate the .tar image you downloaded.

4. Extract the "RHEL Installer (.iso)" image content.

   $ tar -xf content.tar

Procedure

1. Write the bootable ISO image directly to the USB drive using the dd tool. For example:

   dd if=installer.iso of=/dev/sdX

   Where installer.iso is the ISO image file name and /dev/sdX is your USB flash drive device path.

2. Insert the flash drive into a USB port of the computer you want to boot.

3. Boot the ISO image from the USB flash drive.

   When the installation environment starts, you might need to complete the installation manually, similarly to the default Red Hat Enterprise Linux installation.

Procedure

1. Create a blueprint in the TOML format, with the following content:

   name = "blueprint_name"
   description = "blueprint_description"
   version = "0.0.1"
   modules = []
   groups = []
   distro = ""
   
   [customizations]
   [[customizations.user]]
   name = "scap-security-guide"
   description = "Admin account"
   password = secure_password_hash
   key = ssh-key
   home = "/home/scap-security-guide"
   group = ["wheel"]
   
   
   [[customizations.filesystem]]
   mountpoint = "/tmp"
   size = 13107200
   [customizations.openscap]
   datastream = "/usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml "
   profile_id = "cis"

2. Start the build of a OpenSCAP image:

   # composer-cli compose start blueprint_name qcow2

   Where blueprint_name is the blueprint name.

   After the image build is ready, you can use your pre-hardened image on your deployments. See Creating a virtual machine.

1. Connect to the image using SSH.

2. Run the oscap scanner.

   # scap-workbench

3. Select the version of the system you want to scan. Click Load content.
4. Select the profile you want to scan and click Scan. OpenSCAP checks all the requirements for the system.
5. After the scan finishes, click Show Report.

Procedure

1. Click the blueprint name you created.
2. Select the tab Images.
3. Click Create Image to create your customized image. A pop-up window opens.
4. From the Type drop-down menu list, select QEMU Image(.qcow2).
5. Set the size that you want the image to be when instantiated and click Create.
6. A small pop-up on the upper right side of the window informs you that the image creation has been added to the queue. After the image creation process is complete, you can see the Image build complete status.

Verification

1. Click the breadcrumbs icon and select the Download option. Image builder downloads the KVM guest image .qcow2 file at your default download location.

Procedure

1. Move the KVM Guest Image you created using image builder to the /var/lib/libvirt/images directory.

2. Create a directory, for example, cloudinitiso and navigate to this newly created directory:

   $ mkdir cloudinitiso
   $ cd cloudinitiso

3. Create a file named meta-data. Add the following information to this file:

   instance-id: citest
   local-hostname: vmname

4. Create a file named user-data. Add the following information to the file:

   #cloud-config
   user: admin
   password: password
   chpasswd: {expire: False}
   ssh_pwauth: True
   ssh_authorized_keys:
     - ssh-rsa AAA...fhHQ== your.email@example.com

   Where, ssh_authorized_keys is your SSH public key. You can find your SSH public key in ~/.ssh/id_rsa.pub.

5. Use the genisoimage command to create an ISO image that includes the user-data and meta-data files.

   # genisoimage -output cloud-init.iso -volid cidata -joliet -rock user-data meta-data
   
   I: -input-charset not specified, using utf-8 (detected in locale settings)
   Total translation table size: 0
   Total rockridge attributes bytes: 331
   Total directory bytes: 0
   Path table size(bytes): 10
   Max brk space used 0
   183 extents written (0 MB)

6. Create a new VM from the KVM Guest Image using the virt-install command. Include the ISO image you created on step 4 as an attachment to the VM image.

   # virt-install \
       --memory 4096 \
       --vcpus 4 \
       --name myvm \
       --disk rhel-9-x86_64-kvm.qcow2,device=disk,bus=virtio,format=qcow2 \
       --disk cloud-init.iso,device=cdrom \
       --os-variant rhel 9 \
       --virt-type kvm \
       --graphics none \
       --import

   Where,

   • --graphics none - means it is a headless RHEL 9 VM.
   • --vcpus 4 - means that it uses 4 virtual CPUs.
   • --memory 4096 - means it uses 4096 MB RAM.

7. The VM installation starts:

   Starting install...
   Connected to domain mytestcivm
   ...
   [  OK  ] Started Execute cloud user/final scripts.
   [  OK  ] Reached target Cloud-init target.
   
   Red Hat Enterprise Linux 9 (Ootpa)
   Kernel 4.18.0-221.el8.x86_64 on an x86_64

1. Enter admin as a username and press Enter.

2. Enter password as password and press Enter.

   After the login authentication is complete, you have access to the VM using the CLI.

Procedure

1. Set up a registry-config.toml file to select the container provider.

   provider = "container_provider"
   
   [settings]
   tls_verify = false
   username = "admin"
   password = "your_password"

2. Create a blueprint in the .toml format. This is a blueprint for the container in which you install an nginx package into the blueprint.

   name = "simple-container"
   description = "Simple RHEL container"
   version = "0.0.1"
   
   [[packages]]
   name = "nginx"
   version = "*"

3. Push the blueprint:

   # composer-cli blueprints push blueprint.toml

4. Build the container image:

   # composer-cli compose start simple-container container "quay.io:8080/osbuild/repository" registry-config.toml

   • simple-container - is the blueprint name.
   • container - is the image type.

   • "quay.io:8080/osbuild/repository" - quay.io is the target registry, osbuild is the organization and repository is the location to push the container when it finishes building. Optionally, you can set a tag. If you do not set a value for :tag, it uses :latest tag by default.

     Note

     Building the container image takes time because of resolving dependencies of the customized packages.

5. After the image build finishes, the container you created is available in quay.io.

6. Access quay.io. and click Repository Tags.

    You can see details about the container you created, such as:
   - last modified
   - image size
   - the `manifest ID`, that you can copy to the clipboard.

7. Copy the manifest ID value to build the image in which you want to embed a container.

Procedure

1. Create a blueprint to build a qcow2 image. The blueprint must contain the customization.

   name = "image"
   description = "A qcow2 image with a container"
   version = "0.0.1"
   distro = "rhel-90"
   
   [[packages]]
   name = "podman"
   version = "*"
   
   [[containers]]
   source = "registry.access.redhat.com/ubi9:8080/osbuild/container/container-image@sha256:manifest-ID-from-Repository-tag: tag-version"
   name =  "source-name"
   tls-verify = true

2. Push the blueprint:

   # composer-cli blueprints push blueprint-image.toml

3. Build the container image:

   # composer-cli start compose image qcow2

   Where:

   • image is the blueprint name.

   • qcow2 is the image type.

     Note

     Building the image takes time because it checks the container on quay.io registry.

     After the image build status is "FINISHED", you can use the qcow2 image you created in a VM.

Verification

1. Pull the .qcow2 image from the composer-cli to your local file system:

   # composer-cli compose image COMPOSE-UUID

2. Start the qcow2 image in a VM. See Creating a virtual machine from a KVM guest image.

3. The qemu wizard opens. Login in to the qcow2 image.

   1. Enter the username and password. These can be the username and password you set up in the .qcow2 blueprint in the "customizations.user" section, or created at boot time with cloud-init.

4. Run the container image and open a shell prompt inside the container:

   # podman run -it registry.access.redhat.com/ubi9:8080/osbuild/repository /bin/bash/

   Where:

   • registry.access.redhat.com is the target registry, osbuild is the organization and repository is the location to push the container when it finishes building.

5. Check that the packages you added to the blueprint are available:

   # type -a nginx

   The output shows you the nginx package path.

Procedure

1. Install Python 3 and the pip tool:

   # dnf install python3
   # dnf install python3-pip

2. Install the AWS command-line tools with pip:

   # pip3 install awscli

3. Run the following command to set your profile. The terminal prompts you to provide your credentials, region and output format:

   $ aws configure
   AWS Access Key ID [None]:
   AWS Secret Access Key [None]:
   Default region name [None]:
   Default output format [None]:

4. Define a name for your bucket and use the following command to create a bucket:

   $ BUCKET=bucketname
   $ aws s3 mb s3://$BUCKET

   Replace bucketname with the actual bucket name. It must be a globally unique name. As a result, your bucket is created.

5. To grant permission to access the S3 bucket, create a vmimport S3 Role in the AWS Identity and Access Management (IAM), if you have not already done so in the past:

   $ printf '{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "vmie.amazonaws.com" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals":{ "sts:Externalid": "vmimport" } } } ] }' > trust-policy.json
   $ printf '{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket" ], "Resource":[ "arn:aws:s3:::%s", "arn:aws:s3:::%s/*" ] }, { "Effect":"Allow", "Action":[ "ec2:ModifySnapshotAttribute", "ec2:CopySnapshot", "ec2:RegisterImage", "ec2:Describe*" ], "Resource":"*" } ] }' $BUCKET $BUCKET > role-policy.json
   $ aws iam create-role --role-name vmimport --assume-role-policy-document file://trust-policy.json
   $ aws iam put-role-policy --role-name vmimport --policy-name vmimport --policy-document file://role-policy.json

Procedure

1. Using the text editor, create a configuration file with the following content:

   provider = "aws"
   
   [settings]
   accessKeyID = "AWS_ACCESS_KEY_ID"
   secretAccessKey = "AWS_SECRET_ACCESS_KEY"
   bucket = "AWS_BUCKET"
   region = "AWS_REGION"
   key = "IMAGE_KEY"

   Replace values in the fields with your credentials for accessKeyID, secretAccessKey, bucket, and region. The IMAGE_KEY value is the name of your VM Image to be uploaded to EC2.

2. Save the file as CONFIGURATION-FILE.toml and close the text editor.

3. Start the compose:

   # composer-cli compose start BLUEPRINT-NAME IMAGE-TYPE IMAGE_KEY CONFIGURATION-FILE.toml

   Replace:

   • BLUEPRINT-NAME with the name of the blueprint you created
   • IMAGE-TYPE with the ami image type.
   • IMAGE_KEY with the name of your VM Image to be uploaded to EC2.

   • CONFIGURATION-FILE.toml with the name of the configuration file of the cloud provider.

     Note

     You must have the correct IAM settings for the bucket you are going to send your customized image to. You have to set up a policy to your bucket before you are able to upload images to it.

4. Check the status of the image build and upload it to AWS:

   # composer-cli compose status

   After the image upload process is complete, you can see the "FINISHED" status.

1. Access EC2 on the menu and select the correct region in the AWS console. The image must have the available status, to indicate that it was successfully uploaded.
2. On the dashboard, select your image and click Launch.

Procedure

1. Click the blueprint name.
2. Select the tab Images.

3. Click Create Image to create your customized image.

   A pop-up window opens.

   1. From the Type drop-down menu list, select Amazon Machine Image Disk (.raw).
   2. Check the Upload to AWS check box to upload your image to the AWS Cloud and click Next.

   3. To authenticate your access to AWS, type your AWS access key ID and AWS secret access key in the corresponding fields. Click Next.

      Note

      You can view your AWS secret access key only when you create a new Access Key ID. If you do not know your Secret Key, generate a new Access Key ID.

   4. Type the name of the image in the Image name field, type the Amazon bucket name in the Amazon S3 bucket name field and type the AWS region field for the bucket you are going to add your customized image to. Click Next.

   5. Review the information and click Finish.

      Optionally, you can click Back to modify any incorrect detail.

      Note

      You must have the correct IAM settings for the bucket you are going to send your customized image. This procedure uses the IAM Import and Export, so you have to set up a policy to your bucket before you are able to upload images to it. For more information, see Required Permissions for IAM Users.

4. A small pop-up on the upper right informs you of the saving progress. It also informs that the image creation has been initiated, the progress of this image creation and the subsequent upload to the AWS Cloud.

   After the process is complete, you can see the Image build complete status.

5. Click Service→EC2 on the menu and choose the correct region in the AWS console. The image must have the Available status, to indicate that it is uploaded.
6. On the dashboard, select your image and click Launch.
7. A new window opens. Choose an instance type according to the resources you need to start your image. Click Review and Launch.
8. Review your instance start details. You can edit each section if you need to make any changes. Click Launch

9. Before you start the instance, select a public key to access it.

   You can either use the key pair you already have or you can create a new key pair.

   Follow the next steps to create a new key pair in EC2 and attach it to the new instance.

   1. From the drop-down menu list, select Create a new key pair.
   2. Enter the name to the new key pair. It generates a new key pair.
   3. Click Download Key Pair to save the new key pair on your local system.

10. Then, you can click Launch Instance to start your instance.

    You can check the status of the instance, which displays as Initializing.

11. After the instance status is running, the Connect button becomes available.

12. Click Connect. A pop-up window appears with instructions on how to connect using SSH.

    1. Select A standalone SSH client as the preferred connection method to and open a terminal.

    2. In the location you store your private key, ensure that your key is publicly viewable for SSH to work. To do so, run the command:

       $ chmod 400 <your-instance-name.pem>_

    3. Connect to your instance using its Public DNS:

       $ ssh -i "<_your-instance-name.pem_"> ec2-user@<_your-instance-IP-address_>

    4. Type yes to confirm that you want to continue connecting.

       As a result, you are connected to your instance using SSH.

Verification

1. Check if you are able to perform any action while connected to your instance using SSH.

Procedure

1. Import the Microsoft repository key:

   # rpm --import https://packages.microsoft.com/keys/microsoft.asc

2. Create a local azure-cli repository information:

   # sh -c 'echo -e "[azure-cli]\nname=Azure CLI\nbaseurl=https://packages.microsoft.com/yumrepos/azure-cli\nenabled=1\ngpgcheck=1\ngpgkey=https://packages.microsoft.com/keys/microsoft.asc" > /etc/yum.repos.d/azure-cli.repo'

3. Install the Microsoft Azure CLI:

   # dnfdownloader azure-cli
   # rpm -ivh --nodeps azure-cli-2.0.64-1.el7.x86_64.rpm

   Note

   The downloaded version of the Microsoft Azure CLI package may vary depending on the current available version.

4. Run the Microsoft Azure CLI:

   $ az login

   The terminal shows the following message Note, we have launched a browser for you to login. For old experience with device code, use "az login --use-device-code. Then, the terminal opens a browser with a link to https://microsoft.com/devicelogin from where you can login.

   Note

   If you are running a remote (SSH) session, the https://microsoft.com/devicelogin link will not open in the browser. In this case, you can copy the link to a browser and login to authenticate your remote session. To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the device code to authenticate.

5. List the keys for the storage account in Microsoft Azure:

   $ GROUP=resource-group-name
   $ ACCOUNT=storage-account-name
   $ az storage account keys list --resource-group $GROUP --account-name $ACCOUNT

   Replace resource-group-name with name of your Microsoft Azure resource group and storage-account-name with name of your Microsoft Azure storage account.

   Note

   You can list the available resources using the following command:

   $ az resource list

6. Make note of value key1 in the output of the previous command, and assign it to an environment variable:

   $ KEY1=value

7. Create a storage container:

   $ CONTAINER=storage-account-name
   $ az storage container create --account-name $ACCOUNT \
   --account-key $KEY1 --name $CONTAINER

   Replace storage-account-name with name of the storage account.

Procedure

1. Push the image to Microsoft Azure and create an instance from it:

   $ VHD=25ccb8dd-3872-477f-9e3d-c2970cd4bbaf-disk.vhd
   $ az storage blob upload --account-name $ACCOUNT --container-name $CONTAINER --file $VHD --name $VHD --type page
   ...

2. After the upload to the Microsoft Azure Blob storage completes, create a Microsoft Azure image from it:

   $ az image create --resource-group $GROUP --name $VHD --os-type linux --location eastus --source https://$ACCOUNT.blob.core.windows.net/$CONTAINER/$VHD
    - Running ...

Verification

1. Create an instance either with the Microsoft Azure portal, or a command similar to the following:

   $ az vm create --resource-group $GROUP --location eastus --name $VHD --image $VHD --admin-username azure-user --generate-ssh-keys
    - Running ...

2. Use your private key via SSH to access the resulting instance. Log in as azure-user.

Procedure

1. In the image builder dashboard, select the blueprint you want to use.
2. Click the Images tab.

3. Click Create Image to create your customized .vhd image.

   The Create image wizard opens.

   1. Select Microsoft Azure (.vhd) from the Type drop-down menu list.
   2. Check the Upload to Azure check box to upload your image to the Microsoft Azure Cloud.
   3. Enter the Image Size and click Next.

4. On the Upload to Azure page, enter the following information:

   1. On the Authentication page, enter:

      1. Your Storage account name. You can find it on the Storage account page, in the Microsoft Azure portal.
      2. Your Storage access key: You can find it on the Access Key Storage page.
      3. Click Next.

   2. On the Authentication page, enter:

      1. The image name.
      2. The Storage container. It is the blob container to which you will upload the image. Find it under the Blob service section, in the Microsoft Azure portal.
      3. Click Next.
5. On the Review page, click Create. The image build and upload processes start.

Next Steps

1. To access the image you pushed into Microsoft Azure Cloud, access the Microsoft Azure portal.
2. In the search bar, type "storage account" and click Storage accounts from the list.
3. On the search bar, type "Images" and select the first entry under Services. You are redirected to the Image dashboard.
4. On the navigation panel, click Containers.
5. Find the container you created. Inside the container is the your_image_name.vhd file you created and pushed.

1. In the search bar, type images account and click Images from the list.
2. Click +Create.
3. From the dropdown list, choose the resource group you used earlier.
4. Enter a name for the image.
5. For the OS type, select Linux.
6. For the VM generation, select Gen 2.
7. Under Storage Blob, click Browse and click through the storage accounts and container until you reach your VHD file.
8. Click Select at the end of the page.
9. Choose an Account Type, for example, Standard SSD.
10. Click Review + Create and then Create. Wait a few moments for the image creation.

1. Click Go to resource.
2. Click + Create VM from the menu bar on the header.
3. Enter a name for your virtual machine.
4. Complete the Size and Administrator account sections.

5. Click Review + Create and then Create. You can see the deployment progress.

   After the deployment finishes, click the virtual machine name to retrieve the public IP address of the instance to connect by using SSH.

6. Open a terminal to create an SSH connection to connect to VM.

Procedure

1. Navigate to the directory where you downloaded your .vmdk image.

2. Launch the image on vSphere by following the steps:

   1. Import the .vmdk image in to vSphere:

      $ govc import.vmdk ./composer-api.vmdk foldername

   2. Create the VM in vSphere without powering it on:

      govc vm.create \
      -net.adapter=vmxnet3 \
      -m=4096 -c=2 -g=rhel8_64Guest \
      -firmware=efi -disk=”foldername/composer-api.vmdk” \
      -disk.controller=scsi -on=false \
       vmname

   3. Power-on the VM:

      govc vm.power -on vmname

   4. Retrieve the VM IP address:

      HOST=$(govc vm.ip vmname)

   5. Use SSH to log in to the VM, using the username and password you specified in your blueprint:

      $ ssh admin@HOST

      Note

      If you copied the .vmdk image from your local host to the destination using the govc datastore.upload command, using the image is not supported. There is no option to use the import.vmdk command in the vSphere GUI and as a consequence, the vSphere GUI does not support the direct upload, as a consequence, the .vmdk image is not directly usable from the vSphere GUI.

Procedure

1. For the blueprint you created, click the Images tab .

2. Click Create Image to create your customized image.

   The Image type window opens.

3. In the Image type window:

   1. From the dropdown menu, select the Type: VMware vSphere (.vmdk).
   2. Check the Upload to VMware checkbox to upload your image to the vSphere.
   3. Optional: Set the size of the image you want to instantiate. The minimal default size is 2GB.
   4. Click Next.

4. In the Upload to VMware window, under Authentication, enter the following details:

   1. Username: username of the vSphere account.
   2. Password: password of the vSphere account.

5. In the Upload to VMware window, under Destination, enter the following details:

   1. Image name: a name for the image to be uploaded.
   2. Host: The URL of your VMware vSphere where the image will be uploaded.
   3. Cluster: The name of the cluster where the image will be uploaded.
   4. Data center: The name of the data center where the image will be uploaded.
   5. Data store:The name of the Data store where the image will be uploaded.
   6. Click Next.

6. In the Review window, review the details of the image creation and click Finish.

   You can click Back to modify any incorrect detail.

   Image builder adds the compose of a RHEL vSphere image to the queue, and creates and uploads the image to the Cluster on the vSphere instance you specified.

   Note

   The image build and upload processes take a few minutes to complete.

   After the process is complete, you can see the Image build complete status.

1. Access VMware vSphere Client.
2. Search for the image in the Cluster on the vSphere instance you specified.

3. You can create a new VM from the image you uploaded:

   1. Select the image you uploaded.
   2. Right-click the selected image.

   3. Click New Virtual Machine.

      A New Virtual Machine window opens.

      In the New Virtual Machine window, provide the following details:

      1. Select New Virtual Machine.
      2. Select a name and a folder for your VM.
      3. Select a computer resource: choose a destination computer resource for this operation.
      4. Select storage: For example, select NFS-Node1
      5. Select compatibility: The image should be BIOS only.
      6. Select a guest operating system: For example, select Linux and Red Hat Fedora (64-bit).
      7. Customize hardware: When creating a VM, on the Device Configuration button on the upper right, delete the default New Hard Disk and use the drop-down to select an Existing Hard Disk disk image:
      8. Ready to complete: Review the details and click Finish to create the image.

   4. Navigate to the VMs tab.

      1. From the list, select the VM you created.
      2. Click the Start button from the panel. A new window appears, showing the VM image loading.
      3. Log in with the credentials you created for the blueprint.

      4. You can verify if the packages you added to the blueprint are installed. For example:

         $ rpm -qa | grep firefox

Procedure

1. Open the image builder interface of the web console in a browser.
2. Click Create blueprint. The Create blueprint wizard opens.
3. On the Details page, enter a name for the blueprint, and optionally, a description. Click Next.
4. On the Packages page, select the components and packages that you want to include in the image. Click Next.
5. On the Customizations page, configure the customizations that you want for your blueprint. Click Next.
6. On the Review page, click Create.
7. To create an image, click Create Image. The Create image wizard opens.

8. On the Image output page, complete the following steps:

   1. From the "Select a blueprint" drop-down menu, select the blueprint you want.
   2. From the "Image output type" drop-down menu, select Oracle Cloud Infrastructure (.qcow2).
   3. Check the "Upload OCI check box to upload your image to the OCI.
   4. Enter the "image size". Click Next.

9. On the Upload to OCI - Authentication page, enter the following mandatory details:

   1. User OCID: you can find it in the Console on the page showing the user’s details.
   2. Private key

10. On the Upload to OCI - Destination page, enter the following mandatory details and click Next.:

    1. Image name: a name for the image to be uploaded.
    2. OCI bucket
    3. Bucket namespace
    4. Bucket region
    5. Bucket compartment
    6. Bucket tenancy
11. Review the details in the wizard and click Finish.

Verification

1. Access the OCI dashboard → Custom Images.
2. Select the Compartment you specified for the image and locate the image in the Import image table.
3. Click the image name and verify the image information.

Procedure

1. Start the compose of a QCOW2 image.

   # composer-cli compose start blueprint_name openstack

2. Check the status of the building.

   # composer-cli compose status

   After the image build finishes, you can download the image.

3. Download the QCOW2 image:

   # composer-cli compose image UUID

4. Access the OpenStack dashboard and click +Create Image.

5. On the left menu, select the Admin tab.

   1. From the System Panel, click Image.

      The Create An Image wizard opens.

6. In the Create An Image wizard:

   1. Enter a name for the image
   2. Click Browse to upload the QCOW2 image.
   3. From the Format dropdown list, select the QCOW2 - QEMU Emulator.

   4. Click Create Image.

      

7. On the left menu, select the Project tab.

   1. From the Compute menu, select Instances.

   2. Click the Launch Instance button.

      The Launch Instance wizard opens.

   3. On the Details page, enter a name for the instance. Click Next.
   4. On the Source page, select the name of the image you uploaded. Click Next.

   5. On the Flavor page, select the machine resources that best fit your needs. Click Launch.

      

8. You can run the image instance using any mechanism (CLI or OpenStack web UI) from the image. Use your private key via SSH to access the resulting instance. Log in as cloud-user.

Procedure

1. Connect to the system containing the image that you want to check by using the Alibaba image_check tool.

2. Download the image_check tool:

   $ curl -O http://docs-aliyun.cn-hangzhou.oss.aliyun-inc.com/assets/attach/73848/cn_zh/1557459863884/image_check

3. Change the file permission of the image compliance tool:

   # chmod +x image_check

4. Run the command to start the image compliance tool checkup:

   # ./image_check

   The tool verifies the system configuration and generates a report that is displayed on your screen. The image_check tool saves this report in the same folder where the image compliance tool is running.

Procedure

1. Log in to the OSS console.
2. In Bucket menu on the left, select the bucket to which you want to upload an image.
3. In the upper right menu, click the Files tab.

4. Click Upload. A dialog window opens on the right side. Configure the following:

   • Upload To: Choose to upload the file to the Current directory or to a Specified directory.
   • File ACL: Choose the type of permission of the uploaded file.
5. Click Upload.
6. Select the image you want to upload.
7. Click Open.

Procedure

1. Log in to the ECS console.

   1. On the left-side menu, click Images.
   2. On the upper right side, click Import Image. A dialog window opens.

   3. Confirm that you have set up the correct region where the image is located. Enter the following information:

      1. OSS Object Address: See how to obtain OSS Object Address.
      2. Image Name
      3. Operating System
      4. System Disk Size
      5. System Architecture
      6. Platform: Red Hat

   4. Optionally, provide the following details:

      7. Image Format: qcow2 or ami, depending on the uploaded image format.
      8. Image Description

      9. Add Images of Data Disks

         The address can be determined in the OSS management console. After selecting the required bucket in the left menu:

2. Select Files section.

3. Click the Details link on the right for the appropriate image.

   A window appears on the right side of the screen, showing image details. The OSS object address is in the URL box.

4. Click OK.

   Note

   The importing process time can vary depending on the image size.

Procedure

1. Log in to the ECS console.
2. On the left-side menu, select Instances.
3. In the upper-right corner, click Create Instance. You are redirected to a new window.
4. Complete all the required information. See Creating an instance by using the wizard for more details.

5. Click Create Instance and confirm the order.

   Note

   You can see the option Create Order instead of Create Instance, depending on your subscription.