Hardened Repository on VIA: kickstart not working

[fabbar]

Hi,
we are deploying some hardened repository using last available VIA ISO.
Since those repos are not so many, but also not so few we would like to do an unattended installation, also according to official documentation. But it does not work as expected.
First of all: repos are network connected via LACP, but this line does not actually work:

Code: Select all

network --bootproto=static --device=bond0 --gateway=a.b.c.d --hostname=repo.internal.domain --ip a.b.c.e --nameserver=z.y.x.w,z.y.x.w --netmask=q.w.e.r --onboot=yes --noipv6 --activate --bondslaves=ens3f1np1,ens1f1np1 --bondopts=mode=802.3ad,miimon=100 --ipv4-dns-search=internal.domain

It does not work even if I add also these lines:

Code: Select all

network --device=ens3f1np1 --nodns --onboot=yes --activate
network --device=ens1f1np1 --nodns --onboot=yes --activate

Please consider this kickstart is used on our regular RHEL9 installations, even if last 2 lines might be not necessary (according to Gemini).

Post reboot wizard got error in network configuration, with message:

Code: Select all

Failed to get network adapters: Failed to convert [bond0] to UUID.
Failed to enumerate network manager devices.
Failed to enumerate ethernet adapters.
Failed to enumerate adapters.

[Ok]

Also answer file is not working. Our kickstart was added of this:

Code: Select all

log "Veeam post install commands"

touch /etc/veeam/host_management_disable_init

### original kickstart content

## safe remove .upgrade dir if exists
rm -rf /var/lib/veeam/.upgrade || true


### custom kickstart 

cat << EOF >> /etc/veeam/vbr_init.cfg
veeamadmin.password=Ex@mp13C0mpl3xP@ssw0rd # I've pasted the config example so I don't have to anonymize my snippet
veeamadmin.mfaSecretKey=JVDECICTMVRXEZLU
veeamadmin.isMfaEnabled=false
veeamso.password=Ex@mp13C0mpl3xP@ssw0rd2 # I've pasted the config example so I don't have to anonymize my snippet
veeamso.mfaSecretKey=JVDECICTMVRXEZLU
veeamso.isMfaEnabled=true
veeamso.recoveryToken={8*}-{4*}-{4*}-{4*}-{12*} # of course a regular uid, I've pasted the config example so I don't have to anonymize my snippet
veeamso.isEnabled=false # I've changed only this
ntp.servers=myntp01.example.local
ntp.runSync=true
applianceRole.role=veeam-lhr
EOF

cat << EOF > /etc/veeam/veeam-init.sh
#!/bin/bash
set -eE -u -o pipefail
/opt/veeam/hostmanager/veeamhostmanager --apply_init_config /etc/veeam/vbr_init.cfg
systemctl disable veeam-init
EOF

chmod +x /etc/veeam/veeam-init.sh

cat << EOF > /etc/systemd/system/veeam-init.service
[Unit]
Description=One-shot daemon to run /opt/veeam/hostmanager/veeamhostmanager at next boot
[Service]
Type=oneshot
ExecStart=/etc/veeam/veeam-init.sh
RemainAfterExit=no
[Install]
WantedBy=multi-user.target
EOF

systemctl enable veeam-init.service

# post end
%end

But wizard starts and in the first screen it was asked to me the role of server and hardened repository is not selected.

I don't know if my settings are too complicated, but I don't think so. But if kickstart does not work properly hardened repository would be good only for small businesses (1 or 2 physical servers maximum).

I also think opening a support case would take longer than install all repositories in a non-unattended manner.

[HannesK]

Hello,
In general, kickstart is expected to work same as for regular Rocky / RHEL. We use that heavily internally and also service providers use that a lot.

Do you have a working configuration with one network card / IP without LACP with the Veeam Infrastructure Appliance and can you maybe paste the full kickstart file? I would also suggest to start without Veeam Backup & Replication initialization and see that networking works first.

I remember from tests I did longer time ago, that I had to activate the network cards explicitly except the "first one", but that was without kickstart. One colleague also built a graphical to modify the Kickstart settings. I believe it does not have LACP, but maybe it gives you some hints. See here

Best regards
Hannes