New script to setup everything for you to use AI to install machine/ldom

On aiserver now there is a script that takes away all the tedium of setting up all the files you need for AI to install a machine.

It also creates a default first boot script and a default derive manifest script .

It asks for lots of information and contains several warnings and instructions, please read carefully all the instructions!!!

Script is here: /export/auto_install/ai-installs/bin/setup-ai-machine.sh

Hopefully I've made the whole process of using AI much easier!!!

Maria MacCallum : 02 Jul 2015 17:35 |  Tags: AI Installadm Ldom Solaris |  Comments (0) |  Close comments |  Report a problem

–UPDATE – Building a zone quickly using the templates installed in global – UPDATE –

Follow-up to Building a zone quickly using the templates installed in global from Maria's blog

I've scripted some of the work to make things a bit quicker.

Script is called setup-zone.sh

It will do the tedious copying and changing of the templates for you.

It creates a default manifest which you can change later if you like.

The script tells you what to do next.

To call it it's:

NEW: setup-zone.sh zonename initial-vid poolref

Follow the on screen questions

NEW: If you know you want the default manifest, it will create the zone for you too

Make sure you ensure the zone backup script is called in cron for your new zone!

Maria MacCallum : 31 Mar 2015 16:59 |  Tags: 11-2 Solaris Templates Zone |  Comments (2) |  Close comments |  Report a problem

Building a zone quickly using the templates installed in global

The templates mentiond are in /opt/site installed at server build pkg is zone-stuff

1. Get SAN disk ref

2. copy template zonecfg & edit, change the storage ref and the vlan id:

create -b
set brand=solaris
add rootzpool
add storage dev:dsk/xxxx
end
set zonepath=/zones/%{zonename}
set autoboot=true
add fs
set dir=/etc/globalname
set special=/etc/globalname
set type=lofs
add options ro
end
set ip-type=exclusive
add anet
set configure-allowed-address=true
set linkname=net0
set lower-link=aggr0
set vlan-id=xxx
end

*Note can't enable compression or dedup on the zfs here, do it in the manifest.

3.Copy the template sc profile and edit

Default password is the usual temporary initial password.

Check that the network settings are correct

The name of the profile should be zonename-sc-profile.xml so that the backup script finds it.

4. Copy the template manifest and edit

Add /remove packages as needed, the default is the minimum.

Checkout the repo on ports 8082 and 81, if it's a webdev box tomcat/apache & build user stuff will be required:

These should always be there:

<name>pkg://firstboot/after-install-scripts</name>
<name>pkg://firstboot/zone-first-boot-script</name>
<name>pkg://firstboot/teamunix-stuff</name>

Other examples:

<name>pkg://firstboot/build-stuff</name>
<name>pkg://sw/web-app-depend</name>
<name>pkg://sw/tomcat8</name>
<name>pkg://sw/tomcat7</name>
<name>pkg://sw/apache-64bit-event-dependancies-no-ssl</name>

The name of the manifest should be zonename-manifest.xml so that the backup script finds it.

5. zonecfg -z zonename -f zonename.cfg

6. zoneadm -z zonename install -m zonename-manifest.xml -c zonename-sc_profile.xml

zoneadm -z zonename boot

zlogin -C zonename

svcadm enable ipfilter

change the passwords

7. Check everything is OK with the zone.

8. Double check globalzone mounts a directory from the thumpers and start backing up the zone using cron:

Examples:

45 21 * * * /opt/site/backup-zone.sh rpool/zones turk-log z
45 22 * * * /opt/site/backup-zone.sh rpool/zones aiserver z
45 23 * * * /opt/site/backup-zone.sh datapool/zones/aiserver/datapool aiserver p

Backup script takes a snapshot of the zone and copies the profile, the cfg and the snapshot to the thumper. For a pool it just backs up the pool.

Maria MacCallum : 23 Feb 2015 13:36 |  Tags: 11-2 Solaris Templates Zone |  Comments (0) |  Close comments |  Report a problem

solaris 11.1 copying zones between machines

cp sc_profile.xml-NEW-LOCAL-ZONE sc_profile.xml
zonecfg -z NEW-LOCAL-ZONE "create -t ZONENAME"
zonecfg -z NEW-LOCAL-ZONE "set zonepath=/zones/NEW-LOCAL-ZONE "
zonecfg -z NEW-LOCAL-ZONE "select net physical=net2; set physical=net8;end"
zonecfg -z NEW-LOCAL-ZONE "select net physical=net3; set physical=net9;end"
zoneadm -z NEW-LOCAL-ZONE clone -c /opt/site/sc_profile.xml ZONENAME
zoneadm -z NEW-LOCAL-ZONE boot
zlogin -C NEW-LOCAL-ZONE

zfs snapshot -r rpool/zones/ZONENAME@archive
zfs send -rc rpool/zones/ZONENAME@archive |bzip2 >/var/tmp/ZONENAME.zfs.bz2
scp /var/tmp/ZONENAME.zfs.bz2 MYLOGIN@NEW-MACHINE:/var/tmp
scp ZONENAME.cfg MYLOGIN@NEW-MACHINE:/var/tmp
scp sc_profile.xml MYLOGIN@NEW-MACHINE:/var/tmp

zonecfg -z NEW-ZONE -f NEW-ZONE.cfg
zoneadm -z NEW-ZONE install -a /var/tmp/ZONENAME.zfs.bz2 -u -c /var/tmp/sc_profile.xml
zoneadm -z NEW-ZONE boot
zlogin -C NEW-ZONE

Maria MacCallum : 21 May 2014 15:50 |  Tags: Solaris Zone |  Comments (0) |  Close comments |  Report a problem

apache 2.4.9 in solaris 11 zone on sparc

Install apache 2.4.9 notes so far

This was done on a sparc zone

pkg install gcc-3
pkg install developer/assembler   
pkg install developer/build/make
export PATH=$PATH:/usr/sfw/bin

Install pcre

./configure --prefix=/opt/warwick/pcre/
make
make install

openssl

./Configure solaris-sparcv9-gcc -m32 --prefix=/opt/warwick/openssl --shared
make
make install

apr & apr util
unpack tarball in httpsource---/srclib dir and rename dirs so there's no version numbers

apache

export LD_RUN_PATH=/opt/warwick/openssl/lib
./configure --prefix=/opt/warwick/apache2/2.4.9 --enable-mods-shared=all--enable-cache -enable-cache-disk --enable-deflate --enable-file-cache --enable-cgi --enable-proxy --enable-rewrite --enable-ssl --enable-suexec --with-suexec-caller=USER --enable-exception-hook --with-ssl=/opt/warwick/openssl --with-included-apr --with-mpm=prefork --with-pcre=/opt/warwick/pcre/bin/pcre-config CC="gcc -m32" LDFLAGS=" -s"
make
make install

Tested with a self signed cert & it works.

Next to run as another user using the SMF.

Here is where I found some most excellent notes: https://blogs.oracle.com/observatory/entry/limiting_apache_s_power

1. Give USER the correct privs

pfexec usermod -K defaultpriv=basic,net_privaddr USER 

2. make USER the owner of logs and all that is in it

3. Configure the service:

# svccfg -s application/apache listprop 
manifestfiles  framework  
manifestfiles/opt_src_war-apache249_xml astring  /opt/src/war-apache249.xml
multi_user_dependency  dependency  
multi_user_dependency/entities  fmri  svc:/milestone/multi-user
multi_user_dependency/grouping  astring  require_all
multi_user_dependency/restart_on  astring  none
multi_user_dependency/type  astring  service
start  method  
start/exec  astring  "/opt/warwick/apache2/2.4.9/bin/apachectl start"
start/group  astring  USER
start/privileges  astring  basic,!proc_session,!proc_info,!file_link_any,net_privaddr
start/timeout_seconds  count  60
start/type  astring  method
start/use_profile  boolean  false
start/user  astring  USER
stop  method  
stop/exec  astring  "/opt/warwick/apache2/2.4.9/bin/apachectl stop"
stop/timeout_seconds  count  60
stop/type  astring  method
refresh  method  
refresh/exec  astring  "/opt/warwick/apache2/2.4.9/bin/apachectl graceful"
refresh/timeout_seconds  count  60
refresh/type  astring  method
tm_common_name  template  
tm_common_name/C  ustring  
tm_description  template  
tm_description/C  ustring  

4. check one of the processes

pfexec ppriv 29316
29316:  /opt/warwick/apache2/2.4.9/bin/httpd -k start
flags = <none>
  E: basic,!file_link_any,net_privaddr,!proc_info,!proc_session
  I: basic,!file_link_any,net_privaddr,!proc_info,!proc_session
  P: basic,!file_link_any,net_privaddr,!proc_info,!proc_session
 
 L: 
basic,contract_event,contract_identity,contract_observer,file_chown,file_chown_self,file_dac_execute,file_dac_read,file_dac_search,file_dac_write,file_owner,file_setid,ipc_dac_read,ipc_dac_write,ipc_owner,net_bindmlp,net_icmpaccess,net_mac_aware,net_observability,net_privaddr,net_rawaccess,proc_audit,proc_chroot,proc_lock_memory,proc_owner,proc_setid,proc_taskid,sys_acct,sys_admin,sys_audit,sys_flow_config,sys_ip_config,sys_iptun_config,sys_mount,sys_nfs,sys_ppp_config,sys_resource,sys_share
{code}

Here's the service manifest:

<?xml version="1.0" ?>
<!DOCTYPE service_bundle
 SYSTEM '/usr/share/lib/xml/dtd/service_bundle.dtd.1'>
<service_bundle type="manifest" name="application/apache">
  <service version="1" type="service" name="application/apache">
  <dependency restart_on="none" type="service"
  name="multi_user_dependency" grouping="require_all">
  <service_fmri value="svc:/milestone/multi-user"/>
  </dependency>
  <exec_method timeout_seconds="60" type="method" name="start"
  exec="/opt/warwick/apache2/2.4.9/bin/apachectl start">
  <method_context>
 
 <method_credential user='USER' group='GROUP' 
privileges='basic,!proc_session,!proc_info,!file_link_any,net_privaddr'/>
  </method_context>
  </exec_method>
  <exec_method timeout_seconds="60" type="method" name="stop"
  exec="/opt/warwick/apache2/2.4.9/bin/apachectl stop"/>
  <exec_method timeout_seconds="60" type="method" name="refresh"
  exec="/opt/warwick/apache2/2.4.9/bin/apachectl graceful"/>
  <instance enabled="true" name="default"/>
  <template>
  <common_name>
  <loctext xml:lang="C">
  <!--
  Replace this comment with a short name for the
  service.
  -->
  </loctext>
  </common_name>
  <description>
  <loctext xml:lang="C">
  <!--
  Replace this comment with a brief description of
  the service
  -->
  </loctext>
  </description>
  </template>
  </service>
</service_bundle>

Maria MacCallum : 12 May 2014 11:57 |  Tags: Apache |  Comments (0) |  Close comments |  Report a problem

Using AI to install solaris on an LDOM

The aim of this blog is to fill in the gaps from other notes on using AI with an LDOM, not to repeat the previous notes. Also they do not document installing the hypervisor or the initial set up, there's already Paul E's notes for this.

So:

1. On your AI server, create a client, manifest/ derive script, profile and if relevant, 1st boot script (see previous notes).

2. Confgure your LDOM:

ldm add-domain DOMAIN-NAME

ldm set-vcpu NN DOMAIN-NAME

ldm set-mem NNg DOMAIN-NAME

ldm add-vnet pvid=XXX vnet01 primary-vsw0 DOMAIN-NAME

ldm add-vnet pvid=XXX vnet02 iodomain-vsw0 DOMAIN-NAME

ldm add-vdisk vdisk01 sharedVOLNAME@primary-vds0 DOMAIN-NAME

ldm set-var autoboot?=false DOMAIN-NAME

ldm set-var local-mac-address?=true DOMAIN-NAME

ldm start DOMAIN-NAME

3.You don't have to use DHCP, it's just nicer. I'll document both ways:

a) With no DHCP

ldm set-var network-boot-arguments=host-ip=IPofDOMAIN-NAME,router-ip=XXX.XXX.XXX.XXX,subnet-mask=255.255.255.0,hostname=DOMAIN-NAME,file=http://IPofAISERVER:5555/cgi-bin/wanboot-cgi

On the aiserver in the manifest you cannot use names, you need to use IP addresses as you have no DNS.

ldm ls

telnet 0 500X

ok boot net - install

b) Using DHCP

Set Next Server to the IP of your AI server

Set File Name to:
http://IPofAISERVER:5555/cgi-bin/wanboot-cgi

ldm ls

telnet 0 500X

ok boot vnet01:dhcp - install

Maria MacCallum : 02 Apr 2014 16:29 |  Tags: Automated Installer Ldom Oracle Solaris Sparc |  Comments (0) |  Close comments |  Report a problem

Having fun with Oracle's Solaris 11.1 Automated Installer – Adding a repo for post install scripts

I've been having a go at post install scripts with AI

I needed to do this as I wanted to configure IPMP and this is a post install task.

Actually the notes from oracle on this were much better than the ones on AI: http://docs.oracle.com/cd/E26502_01/html/E28980/firstboot-1.html#scrolltoc

1. You create a run once script.

2. You make it into a run once service

3. Make it available for clients when they are installing in a repo

4. Specify the package in your clients manifest

1. You create a run once script:

The bit you write is in the middle, the rest is part of making it a run once only service.

2. You make it into a run once service

For speed I used svcbundle to create the service:

Create first-boot-script.p5m

3. Make it available for clients when they are installing in a repo

I created a new repo for this:

Tip top tip (Sep 2013, Solaris v11.1) whenever you have published anything the service needs to be disabled and re-enabled before you can see the package!

4. Specify the package in your clients manifest

In the <software type="IPS"> section locate <source> and add your publisher, add a <new software_data_action="install">

Maria MacCallum : 19 Sep 2013 10:33 |  Tags: Automated Install Installer Oracle Post Solaris |  Comments (0) |  Close comments |  Report a problem

Having fun with Oracle's Solaris 11.1 Automated Installer

I thought I'd provide a complete script that will derive a manifest. This one will create a swap that is the size of the memory of the machine and create a mirrored root with a spare disk:

Maria MacCallum : 17 Sep 2013 17:21 |  Tags: Automated Installer Oracle Solaris |  Comments (0) |  Close comments |  Report a problem

Having fun with Oracle's Solaris 11.1 Automated Installer

Preamble:

If I get any apostrophes wrong, hey I'm sorry, buy me chocolate and commiserate with my ignorance, please don't shout at me! (same goes for spelling, but people are more tolerant with that).

I'm intending this to be my AI diary as I keep forgetting important things, it's not supposed to be documentation, as documentation has to be perfect and I will eventually produce some lovely stuff, this is more like my on-going thoughts and discoveries.

Todays fun with derived manifests:

I'm trying stuff out with derived manifest at the moment, I've found the Oracle notes only go so far.

Here's how I have a mirrored root pool with spare disk :

The above bungs the below into the derived manifest

Here's how to configure the swap to your own size:

In this example I wanted the swap to match memory size, but the variable was supposed to be in Mbytes but was actually in bytes, solaris didn't like the value as it was not a a multiple of volume block size (actual error was: InstallationLogger ERROR cannot create 'rpool/swap': volume size must be a multiple of volume block size) , to get around this I converted the value into Gbytes, but obviously when they fix this undocumented feature my script will need to be fixed also. You could say how about specifying the block size, but I would say don't think you can with manifests!

So then altogether it looks like this:

Which bungs this into the derived manifest:

Whoop whoop!

This is really useful:
http://docs.oracle.com/cd/E26502_01/html/E28978/instal.html#glniv

Here's the list of variables available:
http://docs.oracle.com/cd/E26502_01/html/E28980/provision-2.html#provision-3

Maria MacCallum : 11 Sep 2013 16:03 |  Tags: Automated Installer Oracle Solaris |  Comments (1) |  Close comments |  Report a problem