ການຕັ້ງຄ່າການເຂົ້າເຖິງ SSH ແລະ ການເລີ່ມຕົ້ນຄອນເທນເນີໃນຕອນບູດ (boot)

ເຮັດທຸກຂັ້ນຕອນທີ່ໄດ້ອະທິບາຍໄວ້ໃນ ໜ້າການຕັ້ງຄ່າເບື້ອງຕົ້ນ ກ່ອນທີ່ຈະເລີ່ມບົດຮຽນນີ້. ໃຫ້ແນ່ໃຈວ່າທ່ານໄດ້ສ້າງໄຟລ໌ ssh-key.pub ຕາມຄຳແນະນຳທີ່ໃຫ້ໄວ້ໃນ ເງື່ອນໄຂເບື້ອງຕົ້ນ ສຳລັບບົດຮຽນນີ້. ພວກເຮົາຈະໃຊ້ຄີ (key) ນີ້ໃນໄຟລ໌ການຕັ້ງຄ່າ Butane ທີ່ພວກເຮົາກຳລັງຈະຂຽນ.

ໃນບົດຮຽນນີ້, ພວກເຮົາຈະຕັ້ງຄ່າການເຂົ້າເຖິງ SSH ແລະ ເລີ່ມຕົ້ນຄອນເທນເນີໃນຕອນບູດ. Fedora CoreOS ເນັ້ນໃສ່ການລັນ (run) ແອັບພລິເຄຊັນ/ບໍລິການໃນຄອນເທນເນີ, ດັ່ງນັ້ນພວກເຮົາຈຶ່ງແນະນຳໃຫ້ລອງລັນຄອນເທນເນີ ແລະ ຫຼີກລ່ຽງການແກ້ໄຂໂຮສ (host) ໂດຍກົງ. ການລັນຄອນເທນເນີ ແລະ ການຮັກສາຊັ້ນຂອງໂຮສໃຫ້ສະອາດ (pristine) ຈະຊ່ວຍໃຫ້ການອັບເດດແບບອັດຕະໂນມັດມີຄວາມໜ້າເຊື່ອຖືຫຼາຍຂຶ້ນ ແລະ ຊ່ວຍໃຫ້ມີການແຍກສ່ວນຄວາມຮັບຜິດຊອບ ໂດຍທີ່ທີມ Fedora CoreOS ຈະຮັບຜິດຊອບໃນສ່ວນຂອງ OS ແລະ ຜູ້ປະຕິບັດການ/sysadmins ຈະຮັບຜິດຊອບໃນສ່ວນຂອງແອັບພລິເຄຊັນ.

ຕາມປົກກະຕິ, ພວກເຮົາຈະຕັ້ງຄ່າການເຂົ້າລະບົບຄອນໂຊນແບບອັດຕະໂນມັດ (autologin), ຊື່ໂຮສ (hostname), ການຕັ້ງຄ່າ systemd pager, ແຕ່ພວກເຮົາກໍຈະເຮັດສິ່ງເຫຼົ່ານີ້ຄືກັນ:

ເພີ່ມ SSH Key ສຳລັບຜູ້ໃຊ້ core ຈາກໄຟລ໌ ssh-key.pub ຢູ່ໃນເຄື່ອງ.
ເພີ່ມບໍລິການ systemd (failure.service) ທີ່ເຮັດວຽກຜິດພາດໃນຕອນບູດ.
ເພີ່ມຄອນເທນເນີທີ່ກຳລັງເຮັດວຽກຜ່ານ Podman ໄຟລ໌ຄອນເທນເນີ quadlet systemd.unit.
etcd-member.container ນີ້ຈະຖືກເຊື່ອມໂຍງກັບ etcd-member.service ໃນລະບົບທີ່ກຳລັງເຮັດວຽກ.
etcd-member.service ຈະເປີດໃຊ້ງານ ແລະ ຈັດການວົງຈອນຊີວິດ (lifecycle) ຂອງຄອນເທນເນີໂດຍໃຊ້ podman.

ການຂຽນການຕັ້ງຄ່າ Butane ແລະ ການແປງເປັນ Ignition

ເຊັ່ນດຽວກັບທີ່ພວກເຮົາໄດ້ເຮັດໃນສະຖານະການການຈັດຕຽມ (provisioning) ທີສອງ, ພວກເຮົາຈະຂຽນການຕັ້ງຄ່າ Butane ຕໍ່ໄປນີ້ໃນໄຟລ໌ທີ່ມີຊື່ວ່າ containers.bu:

ຕົວຢ່າງທີ່ມີການເຂົ້າລະບົບຜ່ານ serial console ແບບອັດຕະໂນມັດ, SSH key, ແລະ ຫຼາຍ systemd units

variant: fcos
version: 1.7.0
passwd:
  users:
    - name: core
      ssh_authorized_keys_local:
        - ssh-key.pub
systemd:
  units:
    - name: serial-getty@ttyS0.service
      dropins:
      - name: autologin-core.conf
        contents: |
          [Service]
          # Override Execstart in main unit
          ExecStart=
          # Add new Execstart with `-` prefix to ignore failure
          ExecStart=-/usr/sbin/agetty --autologin core --noclear %I $TERM
          TTYVTDisallocate=no
    - name: failure.service
      enabled: true
      contents: |
        [Service]
        Type=oneshot
        ExecStart=/usr/bin/false
        RemainAfterExit=yes

        [Install]
        WantedBy=multi-user.target
storage:
  files:
    - path: /etc/hostname
      mode: 0644
      contents:
        inline: |
          tutorial
    - path: /etc/profile.d/systemd-pager.sh
      mode: 0644
      contents:
        inline: |
          # Tell systemd to not use a pager when printing information
          export SYSTEMD_PAGER=cat
    - path: /etc/containers/systemd/etcd-member.container
      mode: 0644
      contents:
        inline: |
          [Unit]
          Description=Run a single node etcd
          After=network-online.target
          Wants=network-online.target

          [Container]
          ContainerName=etcd
          Image=quay.io/coreos/etcd:v3.5.21
          Network=host
          Volume=etcd-data:/etcd-data
          Exec=/usr/local/bin/etcd                                \
              --name node1 --data-dir /etcd-data                  \
              --initial-advertise-peer-urls http://127.0.0.1:2380 \
              --listen-peer-urls http://127.0.0.1:2380            \
              --advertise-client-urls http://127.0.0.1:2379       \
              --listen-client-urls http://127.0.0.1:2379          \
              --initial-cluster node1=http://127.0.0.1:2380

          [Install]
          WantedBy=multi-user.target

ລັນ (Run) Butane ເພື່ອແປງໄຟລ໌ນັ້ນໃຫ້ເປັນການຕັ້ງຄ່າ Ignition:

butane --pretty --strict --files-dir=./ containers.bu --output containers.ign

ຕອນນີ້ພວກເຮົາລອງມາຈັດຕຽມ (provision) ມັນ:

# Setup the correct SELinux label to allow access to the config
chcon --verbose --type svirt_home_t containers.ign

# Start a Fedora CoreOS virtual machine
virt-install --name=fcos --vcpus=2 --ram=2048 --os-variant=fedora-coreos-stable \
    --import --network=bridge=virbr0 --graphics=none \
    --qemu-commandline="-fw_cfg name=opt/com.coreos/config,file=${PWD}/containers.ign" \
    --disk="size=20,backing_store=${PWD}/fedora-coreos.qcow2"

ໃນຄອນໂຊນ (console) ທ່ານຈະເຫັນ:

Fedora CoreOS 38.20230709.3.0
Kernel 6.3.11-200.fc38.x86_64 on an x86_64 (ttyS0)

SSH host key: SHA256:T5V4oXMZ0UJ7WRGzNiUOkggO7p5yojTVBUxa6N3vIoQ (ECDSA)
SSH host key: SHA256:oBAvj2kaKKKK++gnchTbxpp/iphvX6EHr0EynwXZ19c (ED25519)
SSH host key: SHA256:Yg2fdA7GC1eoHtIjawDA+WffTKTuNy5ZhQHUJx5GRHk (RSA)
enp1s0: 192.168.124.119 fe80::9b5c:330d:2020:1c9e
Ignition: ran on 2023/08/03 18:17:45 UTC (this boot)
Ignition: user-provided config was applied
Ignition: wrote ssh authorized keys file for user: core
tutorial login: core (automatic login)

Fedora CoreOS 38.20230709.3.0
[systemd]
Failed Units: 1
  failure.service
[core@tutorial ~]$

ຖ້າທ່ານຕ້ອງການເຊື່ອມຕໍ່ຜ່ານ SSH, ໃຫ້ຕັດການເຊື່ອມຕໍ່ຈາກ serial console ໂດຍການກົດ CTRL + ] ແລ້ວໃຊ້ທີ່ຢູ່ IP ທີ່ສະແດງຂອງ NIC ຈາກ serial console ເພື່ອເຂົ້າລະບົບໂດຍໃຊ້ຜູ້ໃຊ້ core ຜ່ານ SSH:

$ ssh core@192.168.124.119
The authenticity of host '192.168.124.119 (192.168.124.119)' can't be established.
ED25519 key fingerprint is SHA256:oBAvj2kaKKKK++gnchTbxpp/iphvX6EHr0EynwXZ19c.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.124.119' (ED25519) to the list of known hosts.
Fedora CoreOS 38.20230709.3.0
Tracker: https://github.com/coreos/fedora-coreos-tracker
Discuss: https://discussion.fedoraproject.org/tag/coreos

Last login: Thu Aug  3 18:18:06 2023
[systemd]
Failed Units: 1
  failure.service

ຂໍ້ຄວາມ Failed Units ແມ່ນມາຈາກ console login helper messages. ໂຕຊ່ວຍນີ້ຈະສະແດງໃຫ້ພວກເຮົາເຫັນເມື່ອ systemd ມີບໍລິການທີ່ຢູ່ໃນສະຖານະທີ່ເຮັດວຽກຜິດພາດ. ໃນກໍລະນີນີ້ນີ້ ພວກເຮົາໄດ້ສ້າງ failure.service ດ້ວຍ ExecStart=/usr/bin/false, ດັ່ງນັ້ນພວກເຮົາຈຶ່ງຕັ້ງໃຈສ້າງບໍລິການທີ່ຈະເຮັດວຽກຜິດພາດສະເໝີ ເພື່ອສະແດງໃຫ້ເຫັນຂໍ້ຄວາມຂອງໂຕຊ່ວຍ.

ຕອນນີ້ລະບົບເຮັດວຽກແລ້ວ ແລະ ບໍ່ມີຂໍ້ຜິດພາດທີ່ແທ້ຈິງໃດໆ, ພວກເຮົາສາມາດກວດສອບສະຖານະຂອງ etcd-member.service ໄດ້, ເຊິ່ງຖືກສ້າງຂຶ້ນມາຈາກໄຟລ໌ etcd-member.container ຂອງພວກເຮົາ.

[core@tutorial ~]$ systemctl status --full etcd-member.service
● etcd-member.service - Run a single node etcd
     Loaded: loaded (/etc/containers/systemd/etcd-member.container; generated)
    Drop-In: /usr/lib/systemd/system/service.d
             └─10-timeout-abort.conf
     Active: active (running) since Thu 2023-08-03 18:17:57 UTC; 2min 24s ago
   Main PID: 1553 (conmon)
      Tasks: 10 (limit: 2238)
     Memory: 86.5M
        CPU: 3.129s
     CGroup: /system.slice/etcd-member.service
             ├─libpod-payload-31af97b0ef902b3b3b3d717bd98947b209701b9585db2129ca53f4b33962415e
             │ └─1555 /usr/local/bin/etcd ...
             └─runtime
               └─1553 /usr/bin/conmon ...

Aug 03 18:17:58 tutorial etcd[1553]: 2023-08-03 18:17:58.745207 I | raft: b71f75320dc06a6c became candidate at term 2
Aug 03 18:17:58 tutorial etcd[1553]: 2023-08-03 18:17:58.745372 I | raft: b71f75320dc06a6c received MsgVoteResp from b71f75320dc06a6c at term 2
Aug 03 18:17:58 tutorial etcd[1553]: 2023-08-03 18:17:58.745499 I | raft: b71f75320dc06a6c became leader at term 2
Aug 03 18:17:58 tutorial etcd[1553]: 2023-08-03 18:17:58.745628 I | raft: raft.node: b71f75320dc06a6c elected leader b71f75320dc06a6c at term 2
Aug 03 18:17:58 tutorial etcd[1553]: 2023-08-03 18:17:58.746402 I | etcdserver: setting up the initial cluster version to 3.3
Aug 03 18:17:58 tutorial etcd[1553]: 2023-08-03 18:17:58.747906 N | etcdserver/membership: set the initial cluster version to 3.3
Aug 03 18:17:58 tutorial etcd[1553]: 2023-08-03 18:17:58.748211 I | etcdserver/api: enabled capabilities for version 3.3
Aug 03 18:17:58 tutorial etcd[1553]: 2023-08-03 18:17:58.748384 I | etcdserver: published {Name:node1 ClientURLs:[http://127.0.0.1:2379]} to cluster 1c45a069f3a1d796
Aug 03 18:17:58 tutorial etcd[1553]: 2023-08-03 18:17:58.748510 I | embed: ready to serve client requests
Aug 03 18:17:58 tutorial etcd[1553]: 2023-08-03 18:17:58.750778 N | embed: serving insecure client requests on 127.0.0.1:2379, this is strongly discouraged!

ພວກເຮົາກໍສາມາດກວດສອບສະຖານະຂອງຄອນເທນເນີທີ່ຖືກລັນໂດຍບໍລິການ systemd ໄດ້ຄືກັນ:

[core@tutorial ~]$ sudo podman ps -a
CONTAINER ID  IMAGE                       COMMAND               CREATED        STATUS        PORTS       NAMES
31af97b0ef90  quay.io/coreos/etcd:latest  /usr/local/bin/et...  4 minutes ago  Up 4 minutes              etcd

ແລະ ພວກເຮົາສາມາດກຳນົດຄູ່ key/value ໃນ etcd ໄດ້. ສຳລັບຕອນນີ້ ລອງຕັ້ງຄ່າ key fedora ໃຫ້ເປັນ value fun ເບິ່ງ:

[core@tutorial ~]$ curl -L http://127.0.0.1:2379/v3/kv/put -X POST -d '{"key": "ZmVkb3Jh", "value": "ZnVu"}'
{"header":{"cluster_id":"2037210783374497686","member_id":"13195394291058371180","revision":"4","raft_term":"2"}}
[core@tutorial ~]$ curl -sL http://127.0.0.1:2379/v3/kv/range -X POST -d '{"key": "AA==", "range_end": "AA=="}' | jq
{
  "header": {
    "cluster_id": "2037210783374497686",
    "member_id": "13195394291058371180",
    "revision": "4",
    "raft_term": "2"
  },
  "kvs": [
    {
      "key": "ZmVkb3Jh",
      "create_revision": "2",
      "mod_revision": "4",
      "version": "2",
      "value": "ZnVu"
    }
  ],
  "count": "2"
}

ເບິ່ງຄືວ່າທຸກຢ່າງເຮັດວຽກໄດ້ແລ້ວ!

ການລຶບລ້າງຂໍ້ມູນ

ຕອນນີ້ລອງມາປິດ instance ສຳລັບການທົດສອບຄັ້ງຕໍ່ໄປ. ຕັດການເຊື່ອມຕໍ່ຈາກ serial console ໂດຍການກົດ CTRL + ] ຫຼື ຈາກ SSH ແລ້ວທຳລາຍ (destroy) ເຄື່ອງນັ້ນ:

virsh destroy fcos
virsh undefine --remove-all-storage fcos

ຕອນນີ້ທ່ານສາມາດໄປທີ່ ບົດຮຽນຕໍ່ໄປ ໄດ້ເລີຍ.

Want to help? Learn how to contribute to Fedora Docs ›