forked from openshift/os
-
Notifications
You must be signed in to change notification settings - Fork 0
/
common.yaml
262 lines (242 loc) · 9.22 KB
/
common.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
# We inherit from Fedora CoreOS' base configuration
include:
- fedora-coreos-config/manifests/ignition-and-ostree.yaml
- fedora-coreos-config/manifests/file-transfer.yaml
- fedora-coreos-config/manifests/networking-tools.yaml
- fedora-coreos-config/manifests/system-configuration.yaml
- fedora-coreos-config/manifests/user-experience.yaml
- fedora-coreos-config/manifests/shared-workarounds.yaml
# RHCOS owned packages
- rhcos-packages.yaml
# Layers common to all versions of RHCOS and SCOS
ostree-layers:
- overlay/01fcos
- overlay/02fcos-nouveau
- overlay/05rhcos
- overlay/06gcp-routes
- overlay/15rhcos-tuned-bits
- overlay/20platform-chrony
- overlay/21dhcp-chrony
arch-include:
x86_64:
- fedora-coreos-config/manifests/grub2-removals.yaml
- fedora-coreos-config/manifests/bootupd.yaml
ppc64le: fedora-coreos-config/manifests/grub2-removals.yaml
aarch64:
- fedora-coreos-config/manifests/grub2-removals.yaml
- fedora-coreos-config/manifests/bootupd.yaml
documentation: false
initramfs-args:
- "--no-hostonly"
- "--omit-drivers"
- "nouveau"
- "--omit"
# we don't need root-on-NFS
# see upstream: https://github.com/coreos/fedora-coreos-config/pull/60
- "nfs"
- "--add"
- "iscsi"
- "ignition"
- "--add"
- "ifcfg"
- "--add"
- "fips"
# The current default in RHEL8 is network-legacy
## XXX: This does not work for now: https://github.com/dracutdevs/dracut/issues/798
## XXX: Temporarily use overlay.d/05rhcos/usr/lib/dracut/modules.d/29rhcos-need-network-manager/module-setup.sh
#- "--add"
#- "network-manager"
- "--omit"
- "network-legacy"
postprocess:
- |
#!/usr/bin/env bash
set -xeo pipefail
# Disable PasswordAuthentication in SSH
sed -i "s|^PasswordAuthentication yes$|PasswordAuthentication no|g" /etc/ssh/sshd_config
# Disable root login because don't do that.
sed -i "s|^PermitRootLogin yes$|PermitRootLogin no|g" /etc/ssh/sshd_config
# Enable ClientAliveInterval and set to 180 per https://bugzilla.redhat.com/show_bug.cgi?id=1701050
sed -i "s|^#ClientAliveInterval 0$|ClientAliveInterval 180|g" /etc/ssh/sshd_config
# TEMPORARY: Create /etc/vmware-tools/tools.conf to ensure RHCOS shows up properly in VMWare
# See https://jira.coreos.com/browse/RHCOS-258
if [ "$(uname -m)" == "x86_64" ]; then
cat > /etc/vmware-tools/tools.conf <<'EOF'
[guestosinfo]
short-name = rhel8-64
EOF
fi
# TEMPORARY: Fix file permission for cpictl until fix is backported to RHEL 8.6
# See https://bugzilla.redhat.com/show_bug.cgi?id=2024102
if [ "$(uname -m)" == "s390x" ]; then
[ "$(stat -c '%a' /usr/lib/s390-tools/cpictl)" == "755" ] && echo "Permission for /usr/lib/s390-tools/cpictl is fixed, remove temporary hack"
chmod 755 /usr/lib/s390-tools/cpictl
fi
# Nuke network.service from orbit
# https://github.com/openshift/os/issues/117
rm -rf /etc/rc.d/init.d/network /etc/rc.d/rc*.d/*network
# We're not using resolved yet
rm -f /usr/lib/systemd/system/systemd-resolved.service
- |
#!/usr/bin/env bash
set -xeuo pipefail
# manually modify SELinux booleans that are needed for OCP use cases
semanage boolean --modify --on container_use_cephfs # RHBZ#1694045
semanage boolean --modify --on virt_use_samba # RHBZ#1754825
# https://gitlab.cee.redhat.com/coreos/redhat-coreos/merge_requests/812
# https://bugzilla.redhat.com/show_bug.cgi?id=1796537
- |
#!/usr/bin/bash
mkdir -p /usr/share/containers/oci/hooks.d
# This is part of e.g. fedora-repos in Fedora; we now want to include it by default
# so that the MCO can use it by default and not trip over SELinux issues trying
# to create it.
- |
#!/usr/bin/bash
mkdir -p /etc/yum.repos.d
# These enable librhsm which enables host subscriptions to work in containers
# https://github.com/rpm-software-management/librhsm/blob/fcd972cbe7c8a3907ba9f091cd082b1090231492/rhsm/rhsm-context.c#L30
- |
#!/usr/bin/bash
ln -sr /run/secrets/etc-pki-entitlement /etc/pki/entitlement-host
ln -sr /run/secrets/rhsm /etc/rhsm-host
# This updates the PAM configuration to reference all of the SSSD modules.
# Removes the `authselect` binary afterwards since `authselect` does not play well with `nss-altfiles`
# (https://github.com/pbrezina/authselect/issues/48).
# https://bugzilla.redhat.com/show_bug.cgi?id=1774154
# NOTE: This is a temporary hack which should be updated after switching to systemd-sysusers
- |
#!/usr/bin/env bash
set -xeuo pipefail
# use `authselect test` since `authselect select` wants to copy to `/var` too
authselect test sssd --nsswitch | tail -n +2 > /etc/nsswitch.conf
for pam_file in system-auth password-auth smartcard-auth fingerprint-auth postlogin; do
authselect test sssd --${pam_file} | tail -n +2 > /etc/pam.d/${pam_file}
done
rm -f $(which authselect)
etc-group-members:
- wheel
- sudo
- systemd-journal
- adm
ignore-removed-users:
- root
ignore-removed-groups:
- root
check-passwd:
type: "file"
filename: "passwd"
check-groups:
type: "file"
filename: "group"
exclude-packages:
# https://bugzilla.redhat.com/show_bug.cgi?id=1798278
- subscription-manager
# And this one shouldn't come in
- dnf
# https://github.com/coreos/rpm-ostree/pull/1789/files/a0cd999a8acd5b40ec1024a794a642916fbc8ff8#diff-fc2076dc46933204a7a798f544ce3734
# People need to use `rpm-ostree kargs` instead.
- grubby
# udisks2 is a fwupd recommends only need for encrypted swap checks
- udisks2
# dhcp-client is recommended by chrony for handling NTP servers given out via
# DHCP, but we have a NM dispatcher script that is doing that
# See: https://bugzilla.redhat.com/show_bug.cgi?id=1930468
# See: https://bugzilla.redhat.com/show_bug.cgi?id=1800901
- dhcp-client
# Try to maintain this list ordering by "in RHEL, then not in RHEL".
# To verify, disable all repos except the ootpa ones and then comment
# out the bottom and run `coreos-assembler build`.
# A lof of packages are inherited by the manifests included at the top.
packages:
# Contains SCTP (https://bugzilla.redhat.com/show_bug.cgi?id=1718049)
# and it's not really going to be worth playing the "where's my kernel module"
# game long term. If we ship it we support it, etc.
- kernel-modules-extra
# Audit
- audit
# Containers
- containernetworking-plugins
# Pinned due to cosa on Fedora not honoring RHEL 8 modules as expected
- container-selinux
# Needed for newer rpm-ostree
- "'skopeo >= 2:1.7.0'"
- cri-o cri-tools
# Not yet in RHEL, dev preview in Openshift
- conmon-rs
# Networking
- nfs-utils
- dnsmasq
- NetworkManager-ovs
# needed for rpm-ostree today
- polkit
# Extra runtime
- sssd
# Common tools used by scripts and admins interactively
- rsync tmux
- nmap-ncat strace
# Editors
- nano
# Red Hat CA certs
- subscription-manager-rhsm-certificates
# Used on the bootstrap node
- systemd-journal-remote
# Extras
- systemd-journal-gateway
# Used to update PAM configuration to work with SSSD
# https://bugzilla.redhat.com/show_bug.cgi?id=1774154
- authselect
# https://bugzilla.redhat.com/show_bug.cgi?id=1900759
- qemu-guest-agent
# BELOW HERE ARE PACKAGES NOT IN RHEL
# OpenShift OKD
#- origin-node origin-hyperkube origin-clients
# OpenShift
- openshift-hyperkube openshift-clients
# Gluster - Used for Openshift e2e gluster testcases
# Reverts https://gitlab.cee.redhat.com/coreos/redhat-coreos/merge_requests/367 and add it for all arches
- glusterfs-fuse
# Needed for kernel-devel extension: https://bugzilla.redhat.com/show_bug.cgi?id=1885408
# x86_64 and s390x have these packages installed as dependencies of other packages, ppc64le does not
# FIXME: once the below BZs have been resolved to remove perl dependencies, this can be done in the extensions script
# https://bugzilla.redhat.com/show_bug.cgi?id=1877905
# https://bugzilla.redhat.com/show_bug.cgi?id=1886201
- perl-interpreter
# https://github.com/coreos/fedora-coreos-tracker/issues/404
# https://bugzilla.redhat.com/show_bug.cgi?id=1925698
# https://github.com/openshift/machine-config-operator/pull/2421
- conntrack-tools
# Upstream PR https://github.com/coreos/fedora-coreos-config/pull/786
- WALinuxAgent-udev
# Provide fips-mode-setup which is needed by rhcos-fips.sh
- crypto-policies-scripts
packages-x86_64:
# Temporary add of open-vm-tools. Should be removed when containerized
- open-vm-tools
- irqbalance
# Until we sort out 4.2 -> 4.3 upgrades, we need to carry this.
# See also https://github.com/ostreedev/ostree/pull/1929
- ostree-grub2
# rdma-core cleanly covers some key bare metal use cases
- rdma-core
packages-ppc64le:
- irqbalance
- librtas
- powerpc-utils-core
- ppc64-diag-rtas
- rdma-core
packages-s390x:
# Required for IBM Secure Execution. Now is part of s390utils-base.rpm
# https://github.com/coreos/fedora-coreos-tracker/issues/1217
- /usr/bin/genprotimg
remove-from-packages:
- - filesystem
- "/usr/share/backgrounds"
# https://bugzilla.redhat.com/show_bug.cgi?id=1762509
# https://bugzilla.redhat.com/show_bug.cgi?id=1727058
- - initscripts
- "/"
# Remove the systemd unit; we only want the binary to be used
# by MCD or kubelet. See above.
- - conntrack-tools
- /usr/lib/systemd/system