OSBuild Composer

The osbuild-composer GCE RHEL Guest image is specifically designed for the Google Compute Engine environment.

Core Characteristics:

• Import Method: Built as a RAW image in a tarball archive and imported via the manual import process.
• Default Size: 20 GB.
• Partitioning: Uses the default x86_64 partition table.
• Google Guest Tools: Includes google-compute-engine, google-osconfig-agent, and gce-disk-expand. These services are enabled by default for initial instance setup (user creation, SSH keys, disk resizing).
• Note on cloud-init: cloud-init is not installed on this image.
• Networking: dhcp-client is not installed because NetworkManager uses its internal DHCP implementation.
• Subscription Model: Built as a Bring Your Own Subscription (BYOS) image. It does not include the Google RHUI client; users must register via subscription-manager.

The osbuild-composer implementation for GCE RHEL Guest images includes several automated configuration steps during the %post phase of the image build:

• GPG Keys: Imports Google's RPM and Yum package keys.
• Networking: Sets the firewall default zone to trusted and reduces the dhclient retry interval to 10 seconds.
• DNF Configuration: Disables IPv6 for DNF (ip_resolve=4) and configures dnf-automatic to apply security updates automatically.
• GCE Guest Tools: Installs google-compute-engine, google-osconfig-agent, gce-disk-expand, and google-cloud-sdk.
• SSH Hardening: Disables password authentication and root login via SSH, and sets ServerAliveInterval/ClientAliveInterval to 420 to prevent disconnections.
• Cleanup: Removes installer-specific files (like ens4 network configs and boto.cfg) and cleans the DNF cache to minimize image size.

For RHEL images intended for SAP HANA workloads on Google Compute Engine, you must install the google-rhui-client-rhel8-sap client and a specific set of SAP-related packages. This ensures the environment is correctly tuned and has the necessary resource agents for GCE.

Required packages include:

• compat-sap-c++-9
• fence-agents-gce
• resource-agents-sap-hana
• tuned-profiles-sap-hana
• (and others listed in the implementation snippet)

%post --erroronfail
set -x
exec &> /dev/ttyS0
dnf -y install google-rhui-client-rhel8-sap
%end

%post --erroronfail
set -x
exec &> /dev/ttyS0

# Configure SAP HANA packages.
SAP_PKGS="
compat-sap-c++-9
fence-agents-gce
libatomic
libtool-ltdl
lvm2
numactl
numactl-libs
nfs-utils
pacemaker
pcs
resource-agents
resource-agents-gcp
resource-agents-sap
resource-agents-sap-hana
rhel-system-roles-sap
tuned-profiles-sap
tuned-profiles-sap-hana
"

dnf install -y ${SAP_PKGS}
%end

The built AMI requires a configuration file located at /tmp/cloud_init_vars to function. This file must contain specific key-value pairs for authentication, cloud provider credentials, and logging. The simplest way to provide this file is using the cloud-init write_files directive.

#cloud-config

write_files:
  - path: /tmp/cloud_init_vars
    content: |
      COMPOSER_HOST=api.stage.openshift.com
      COMPOSER_PORT=443 
      OFFLINE_TOKEN_ARN=arn:aws:secretsmanager:us-east-1:123456789012:secret:offline-token-abcdef
      SUBSCRIPTION_MANAGER_COMMAND_ARN=arn:aws:secretsmanager:us-east-1:123456789012:secret:subscription-manager-command-abcdef
      GCP_SERVICE_ACCOUNT_IMAGE_BUILDER_ARN=arn:aws:secretsmanager:us-east-1:123456789012:secret:gcp_service_account_image_builder-abcdef
      AZURE_ACCOUNT_IMAGE_BUILDER_ARN=arn:aws:secretsmanager:us-east-1:123456789012:secret:azure_account_image_builder-abcdef
      AWS_ACCOUNT_IMAGE_BUILDER_ARN=arn:aws:secretsmanager:us-east-1:123456789012:secret:aws_account_image_builder-abcdef
      SYSTEM_HOSTNAME_PREFIX=staging-worker-aoc
      SECRETS_MANAGER_ENDPOINT_URL=https://secretsmanager.us-east-1.amazonaws.com/
      CLOUDWATCH_LOGS_ENDPOINT_URL=https://logs.us-east-1.amazonaws.com/
      CLOUDWATCH_LOG_GROUP=staging_workers_aoc
      TOKEN_URL="https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/token"

To secure the image for GCE deployment, apply these SSH and user settings:

• Root User: Lock the root account and set an invalid password.
• SSH Password Auth: Disable password authentication in /etc/ssh/sshd_config.
• SSH Root Login: Disable root login via SSH.
• SSH Timeouts: Set ServerAliveInterval and ClientAliveInterval to 420 to prevent disconnections.

Example SSH hardening commands:

sed -i -e '/^PasswordAuthentication /s/ yes$/ no/' /etc/ssh/sshd_config
sed -i -e $'/^	ServerAliveInterval/d' /etc/ssh/ssh_config
sed -i -e $'/^Host \*$/a \	ServerAliveInterval 420' /etc/ssh/ssh_config
sed -i '/ClientAliveInterval/s/^.*/ClientAliveInterval 420/' /etc/ssh/sshd_config
sed -i '/PermitRootLogin yes/s/^.*/PermitRootLogin no/' /etc/ssh/sshd_config

# Disable password authentication by default.
sed -i -e '/^PasswordAuthentication /s/ yes$/ no/' /etc/ssh/sshd_config
# Set ServerAliveInterval and ClientAliveInterval to prevent SSH disconnections.
sed -i -e $'/^	ServerAliveInterval/d' /etc/ssh/ssh_config
sed -i -e $'/^Host \*$/a \	ServerAliveInterval 420' /etc/ssh/ssh_config
sed -i '/ClientAliveInterval/s/^.*/ClientAliveInterval 420/' /etc/ssh/sshd_config
# Disable root login via SSH by default.
sed -i '/PermitRootLogin yes/s/^.*/PermitRootLogin no/' /etc/ssh/sshd_config