Hardened Repository on VIA: kickstart not working

[fabbar]

Hi,
we are deploying some hardened repository using last available VIA ISO.
Since those repos are not so many, but also not so few we would like to do an unattended installation, also according to official documentation. But it does not work as expected.
First of all: repos are network connected via LACP, but this line does not actually work:

Code: Select all

network --bootproto=static --device=bond0 --gateway=a.b.c.d --hostname=repo.internal.domain --ip a.b.c.e --nameserver=z.y.x.w,z.y.x.w --netmask=q.w.e.r --onboot=yes --noipv6 --activate --bondslaves=ens3f1np1,ens1f1np1 --bondopts=mode=802.3ad,miimon=100 --ipv4-dns-search=internal.domain

It does not work even if I add also these lines:

Code: Select all

network --device=ens3f1np1 --nodns --onboot=yes --activate
network --device=ens1f1np1 --nodns --onboot=yes --activate

Please consider this kickstart is used on our regular RHEL9 installations, even if last 2 lines might be not necessary (according to Gemini).

Post reboot wizard got error in network configuration, with message:

Code: Select all

Failed to get network adapters: Failed to convert [bond0] to UUID.
Failed to enumerate network manager devices.
Failed to enumerate ethernet adapters.
Failed to enumerate adapters.

[Ok]

Also answer file is not working. Our kickstart was added of this:

Code: Select all

log "Veeam post install commands"

touch /etc/veeam/host_management_disable_init

### original kickstart content

## safe remove .upgrade dir if exists
rm -rf /var/lib/veeam/.upgrade || true


### custom kickstart 

cat << EOF >> /etc/veeam/vbr_init.cfg
veeamadmin.password=Ex@mp13C0mpl3xP@ssw0rd # I've pasted the config example so I don't have to anonymize my snippet
veeamadmin.mfaSecretKey=JVDECICTMVRXEZLU
veeamadmin.isMfaEnabled=false
veeamso.password=Ex@mp13C0mpl3xP@ssw0rd2 # I've pasted the config example so I don't have to anonymize my snippet
veeamso.mfaSecretKey=JVDECICTMVRXEZLU
veeamso.isMfaEnabled=true
veeamso.recoveryToken={8*}-{4*}-{4*}-{4*}-{12*} # of course a regular uid, I've pasted the config example so I don't have to anonymize my snippet
veeamso.isEnabled=false # I've changed only this
ntp.servers=myntp01.example.local
ntp.runSync=true
applianceRole.role=veeam-lhr
EOF

cat << EOF > /etc/veeam/veeam-init.sh
#!/bin/bash
set -eE -u -o pipefail
/opt/veeam/hostmanager/veeamhostmanager --apply_init_config /etc/veeam/vbr_init.cfg
systemctl disable veeam-init
EOF

chmod +x /etc/veeam/veeam-init.sh

cat << EOF > /etc/systemd/system/veeam-init.service
[Unit]
Description=One-shot daemon to run /opt/veeam/hostmanager/veeamhostmanager at next boot
[Service]
Type=oneshot
ExecStart=/etc/veeam/veeam-init.sh
RemainAfterExit=no
[Install]
WantedBy=multi-user.target
EOF

systemctl enable veeam-init.service

# post end
%end

But wizard starts and in the first screen it was asked to me the role of server and hardened repository is not selected.

I don't know if my settings are too complicated, but I don't think so. But if kickstart does not work properly hardened repository would be good only for small businesses (1 or 2 physical servers maximum).

I also think opening a support case would take longer than install all repositories in a non-unattended manner.

[HannesK]

Hello,
In general, kickstart is expected to work same as for regular Rocky / RHEL. We use that heavily internally and also service providers use that a lot.

Do you have a working configuration with one network card / IP without LACP with the Veeam Infrastructure Appliance and can you maybe paste the full kickstart file? I would also suggest to start without Veeam Backup & Replication initialization and see that networking works first.

I remember from tests I did longer time ago, that I had to activate the network cards explicitly except the "first one", but that was without kickstart. One colleague also built a graphical to modify the Kickstart settings. I believe it does not have LACP, but maybe it gives you some hints. See here

Best regards
Hannes

[fabbar]

first of all the work of Baptiste is great, and surely I'll use it for new VSA deployments.
btw it seems not consider link aggregation and similar stuff in wizard.

it would be quite difficult to install via unattended deployment with only nic, because:

1. network team has to disable LACP in switches
2. generate new ISO, install
3. network team configures LACP on switches
4. set up via OOBM link aggregation

but if I would setup a kickstart, I set up it for do not attend the install.

this is a snippet working I use in a regular rhel9 install:

Code: Select all

network --bootproto=static --device=bond0 --gateway=a.b.c.d --hostname=repo.internal.domain --ip a.b.c.e --nameserver=z.y.x.w,z.y.x.w --netmask=q.w.e.r --onboot=yes --noipv6 --activate --bondslaves=ens3f1np1,ens1f1np1 --bondopts=mode=802.3ad,miimon=100 --ipv4-dns-search=internal.domain
network --device=ens3f1np1 --nodns --onboot=yes --activate
network --device=ens1f1np1 --nodns --onboot=yes --activate

[HannesK]

for testing I would suggest using VMs instead of physical machines. instead of LACP, one could use active / passive just to see that the kickstart file is correct. if active / passive bond works and LACP fails, then a support case is needed.

All kickstart options are expected to work and the only thing I can do on a forum is to help narrowing down the root cause. Beyond that, a support case would be needed, but my current assumption is, that the Kickstart file that is currently used with that snippet is broken.

[fabbar]

I'm sorry, but when you write

All kickstart options are expected to work

and you are suggesting

using VMs instead of physical machines. instead of LACP, one could use active / passive just to see that the kickstart file is correct.

It means that Veeam did not test kickstart for physical machines with link aggregation and it's asking a customer to do it.

[HannesK]

Hello,
No, it doesn't mean that we did not test LACP. It means that it's expected to work and I expect a misconfiguration. And to figure out that misconfiguration and I see the following options:
1. you go directly to support
2. you narrow down the root cause before you go to support
3. you paste the full configuration and maybe I (or someone else) can see an issue.

Please remember that this is not a support forum (these rules are highlighted when creating a new forum thread).

Of course you can test with physical machines. But I personally prefer fast booting VMs. But this is up to you of course.

Best regards
Hannes

[fabbar]

HannesK,
please apologize me if I appear unpleasant and pendant, and also sorry because English is not my mother tongue and I can misunderstand, but

it doesn't mean that we did not test LACP

so, you have a working configuration of kickstart, since this is the actual topic. I already know LACP is working with physical servers, I'm sorry but I have never written that, but we have many repository based on VIA ISO with LACP configured and working fine. LACP (more precisely, the whole installation) was configured by hand with wizard. I think you are saying this, LACP is fine for VIA-deployed physical servers, don't you? Or, if you have tested kickstart with LACP, you do have a working kickstart file and related snipped should appear in official documentation.

It means that it's expected to work and I expect a misconfiguration

so nobody have test a kickstart network LACP/any link aggregation configuration, because this is implicit in your sentence (if it's expected to work, it means nobody checked that).

I know this is not a support forum and I think my issue would need a support case, I've posted here hoping someone else faced this issue, since many people and professionals could have shared their experience in forum and Veeam community.

Please consider that opening a support case for us could take longer than install systems by hand. And, after your posts I think I would have to do several tests for troubleshooting with support, and it seems that those test cases we not checked by Veeam.

[HannesK]

Hello,
don't worry, I'm also non-native

No, it means that I did not ask anyone whether we tested LACP. Because there any many people working in the QA department and it's vacation season and the first question to me would be "do you have logs, do you have a support case?". That means, we have two options... either I test it (that will take time, because I'm sure about a misconfiguration because it's just regular kickstart) or you provide the required information.

Sure, the community can answer.

Best regards
Hannes