Chapter 14. Deploy RHEL instances in a public cloud

Procedure

1. Navigate to the Hybrid Cloud Console and sign in to your Red Hat account.

2. Create a connection between your Red Hat account and your cloud provider account in the Integrations application.

   1. Select the Settings icon.
   2. Click Integrations.
3. Select Amazon Web Services.
4. Enter a descriptive name for the source, for example, AWS_prod, and click Next.

5. Select the configuration mode you want to use:

   • Account Authorization: When selecting this option, you provide your AWS access key ID and secret access keys so that Red Hat can verify ownership of the cloud account. Additionally, this information is saved so that additional Red Hat services (such as cost management) can be configured.

     Note

     On the Select applications page, Red Hat Enterprise Linux (RHEL) management is selected by default. This selection is required.

   • Manual Authorization: When selecting this option, you provide an Amazon Resource Number (ARN) which is used only for this service.

Procedure

1. Use the aws ec2 describe-images command to locate gold images in the AWS CLI.

   $ aws ec2 describe-images --owners 309956199498 \
   > --filters "Name=is-public,Values=false" \>
   "Name=name,Values=RHEL*8.3*GA*Access*" \
   > --region us-east-1

Procedure

1. Click the Launch Instance button from the EC2 Dashboard section of the EC2 Management Console.
2. Select My AMIs.
3. Select the Shared with me filter.

Procedure

1. Use the Get-EC2Image command to locate gold images in the AWS PowerShell Cmdlet.

   PS > Get-EC2Image -Region us-east-1 `
   >> -Owner 309956199498 -Filter `
   >> @{ Name="name" ; Values="RHEL*8.3*" }

Procedure

1. Enter a descriptive name for the source, for example, Azure_build, and click Next.

2. Select the Red Hat Enterprise Linux (RHEL) management bundle service and click Next.

   Note

   Cost Management is only used for Red Hat OpenShift Container Platform.

3. Follow the steps to create an offline token.
4. Complete the configuration steps in Azure Lighthouse.
5. When you return to the wizard, click Next.

6. Log in to your Azure account and navigate to your subscriptions. Copy the subscription ID that you want to use and paste it into the Subscription ID field.

   Note

   All subscription IDs are now included under the tenant ID. If you have already created an integration and enrolled for a subscription ID, the respective tenant IDs are also enrolled. You will not be charged twice.

7. Click Next.
8. Review the details of your integration, and then click Add to add the integration.

9. Optional: If you want to complete registration in Azure with an Ansible script, you can run the Ansible commands on any system with package ansible-galaxy installed that also has access to an Azure instance running inside your Azure account.

   1. Follow the steps to create an offline token. See Red Hat API Tokens to generate an offline token.

      Note

      If you have generated an offline token in the last thirty days, you do not need to generate a new token.

   2. Save the offline token where it can be easily accessed for the next step.

   3. Download the Ansible playbook and run the Ansible commands remotely against a running Azure VM, substituting your Azure instance hostname or IP address and your offline token.

      [user@machine ~] ansible-galaxy collection install redhatinsights.subscriptions
      
      [user@machine ~] ansible-playbook -i <Microsoft_VM_HOSTNAME_OR_IP>, -u azureuser -b ~/.ansible/collections/ansible_collections/redhatinsights/subscriptions/playbooks/verify_account.yml -e rh_api_refresh_token=<OFFLINE_AUTH_TOKEN> --private-key ./<PEM_FILE_FOR_VM_AUTH>

      You can also run the following commands directly on a running Azure VM:

      [azureuser@vm ~]$ ansible-galaxy collection install redhatinsights.subscriptions
      
      [azureuser@vm ~]$ ansible-playbook -i <AZURE_VM_HOSTNAME>, --connection=local -b ~/.ansible/collections/ansible_collections/redhatinsights/subscriptions/playbooks/verify_account.yml -e rh_api_refresh_token=<OFFLINE)AUTH_TOKEN>

      Note

      The integration will be displayed in the Integrations service list, but will not reflect true status or resources for this integration. You cannot monitor this integration from the Integrations service in the Hybrid Cloud Console.

10. When the Ansible commands complete successfully, click Next.
11. Review the details and then click Add to finish the Azure integration creation.
12. You can use the Integrations service configuration dashboard to view, modify, or remove any of your cloud integrations. This dashboard also provides links where you can learn more about related Red Hat services, such as Red Hat Lightspeed and Subscription Services.

Procedure

1. Make sure that you are using an Azure subscription that was enabled for Cloud Access.

   az account show

2. Display the list of available RHEL gold images.

   az vm image list --publisher RedHat --offer rhel-byos --all

3. Find the gold image version you want to use and copy the URN. You need this URN to provision a VM.

Procedure

1. Use the Get-AzVMImageSku command to locate gold images in the Azure PowerShell Cmdlet.

   Get-AzVMImageSku -Location "East US" -PublisherName RedHat -Offer rhel-byos

Prerequisites

1. Make sure that you are using an Azure subscription that was enabled for Cloud Access.

   az account show

2. Display the list of available RHEL gold images.

   az vm image list --publisher RedHat --offer rhel-byos --all

3. Find the gold image version you want to use and copy the URN.

Procedure

1. Use the image URN to accept Azure terms by entering the az vm image terms accept command.

   Note

   You can only accept the terms once per Azure Subscription, per image.

   az vm image terms accept --urn RedHat:rhel-byos:rhel-lvm8-gen2:8.0.20200715

   Note

   You must have a resource group defined before you run the following command.

2. Provision a VM by using the az vm create command.

   az vm create -n my-rhel-byos-vm -g my-rhel-byos-group --image RedHat:rhel-byos:rhel-lvm8-gen2:8.0.20200715

3. Optional: You can create VM instances in the Azure portal.

   1. View the private offers in the Azure Portal.
   2. Click the Create drop-down menu to select the Red Hat Enterprise Linux (RHEL) gold image version that you want to use. The remaining provisioning steps are the same as any other RHEL Marketplace image.

Procedure

1. Sign in to the Google Cloud Platform console at Google Cloud using a Google group or account that has been enabled for Cloud Access.
2. Create or select the project where you want to deploy the Red Hat Enterprise Linux (RHEL) VM.

3. Verify you can see the RHEL gold images.

   1. Open a Cloud Shell.

   2. Enter the following command to list all of the available RHEL gold images:

      gcloud compute images list --project rhel-byos-cloud --no-standard-images

Procedure

1. Make sure that you are using a Google group or account that has been enabled for cloud access:

   gcloud info | grep account

2. Display the list of available Red Hat gold images:

   gcloud compute images list --project rhel-byos-cloud --no-standard-images

3. View details of a specific image:

   gcloud compute images describe rhel-8-byos-v20210916 --project rhel-byos-cloud

Procedure

1. Navigate to Google Cloud Console>Home>Dashboard.
2. From the Navigation menu, select Compute Engine>VM Instances.
3. Click Create Instances.
4. Find the Boot Disk section on the VM instance configuration page and click Change.
5. Select the Custom Images tab.
6. Click Select A Project and select the rhel-byos-cloud project.
7. From the Images dropdown list, choose the gold image that you want to use and click Select.
8. Change any other VM instance configuration settings and then click Create.
9. For the Google Cloud Platform shell or gcloud CLI, use the following steps to create and inspect a VM from a gold image.
10. Use the gcloud compute images list command to find the name of the gold image that you want to use.

11. Create a new RHEL VM:

    gcloud compute instances create my-rhel8-byos --image rhel-8-byos-v20210916 --image-project rhel-byos-cloud --zone us-east1-b

12. View details of the new RHEL VM:

    gcloud compute instances describe my-rhel8-byos --zone us-east1-b

Procedure

1. Purchase an eligible marketplace subscription, which are images sold by Red Hat of:

   • RHEL 9.6
   • RHEL 10
   • RHEL 9.7
   • RHEL 10.1

   • Later versions of RHEL

     Note

     These versions specifically support the enhancements of automatic registration process.

2. After the purchase is complete, follow the link to connect your cloud provider account and your Red Hat account. You have two options to complete this step:

   • Option 1: Locate the post-purchase email from the cloud provider that is sent to the email address associated with your cloud account. This email is sent soon after the purchase is complete. Included in that email is a link to help you configure the connection between accounts. Click that link and follow the instructions from your cloud provider.
   • Option 2: In your cloud provider management tools, locate the purchases for this account. Find the new RHEL purchase, click the setup option, and follow the instructions from your cloud provider.

3. Either of the previous two options opens a page to log in to the Red Hat Hybrid Cloud Console, if you are not already logged in. Enter your Red Hat account credentials to proceed. The Complete your account connection page of the Hybrid Cloud Console opens.

   Note

   From the page to log in to the Red Hat Hybrid Cloud Console, you can also follow the instructions to create a Red Hat account if you do not have one.

4. Review the terms and conditions for connecting cloud provider accounts and Red Hat accounts and select the Terms and conditions checkbox to agree. To complete the connection between your accounts, click Connect accounts.

5. For RHEL 9.7, RHEL 10.1, and later versions, add the following IP addresses and URLs to your allow-list:

   • Hosted Candlepin https://subscription.rhsm.redhat.com:443
   • CDN https://cdn.redhat.com

   • Instance Metadata Service 169.254.169.254

     Important

     Adding these IP addresses to your allow-list enables system access to content from the CDN.

     Warning

     If the firewall is blocking these IP addresses when your system is launched, the system cannot automatically register. You must update the firewall rules by adding the IP addresses to your allow-list, then restart the rhsmcertd service to enable auto registration.

Procedure

1. Run the subscription-manager config command:

   $ subscription-manager config --list

2. Review the /etc/rhsm/rhsm.conf file.

   • Example /etc/rhsm/rhsm.conf file for automatic registration

     [server]
     
     hostname = [subscription.rhsm.redhat.com]
     insecure = [0]
     no_proxy = []
     port = [443]
     prefix = [/subscription]
     proxy_hostname = []
     proxy_password = []
     proxy_port = []
     proxy_scheme = [http]
     proxy_user = []
     server_timeout = [180]
     ssl_verify_depth = [3]
     
     [rhsm]
     
     auto_enable_yum_plugins = [1]
     baseurl = [https://cdn.redhat.com]
     ca_cert_dir = [/etc/rhsm/ca/]
     consumercertdir = [/etc/pki/consumer]
     entitlementcertdir = [/etc/pki/entitlement]
     full_refresh_on_yum = [0]
     inotify = [1]
     manage_repos = 0
     package_profile_on_trans = [0]
     pluginconfdir = [/etc/rhsm/pluginconf.d]
     plugindir = [/usr/share/rhsm-plugins]
     productcertdir = [/etc/pki/product]
     repo_ca_cert = /etc/rhsm/ca/redhat-uep.pem
     repomd_gpg_url = []
     report_package_profile = [1]
     
     [rhsmcertd]
     
     auto_registration = 1
     auto_registration_interval = [60]
     autoattachinterval = [1440]
     certcheckinterval = [240]
     disable = [0]
     splay = [1]
     
     [logging]
     default_log_level = [INFO]
     
     [] - Default value in use

     where

   • General settings for automatic registration

     auto_registration = 1

     This setting determines whether subscription-manager attempts to register through automatic registration. The default value for this setting is 0, where no automatic registration is attempted. For a value of 1, automatic registration is attempted. The value of this setting is changed to a value of 1 during the production of cloud images for the cloud marketplaces that support automatic registration.

     splay = 1

     This setting applies a random offset during registration to randomize the check-in of systems. This random offset distributes workload so that a large number of systems that are started at approximately the same time do not check in at the same time.

   • Settings for the version of automatic registration associated with eligible subscriptions of RHEL provided by Red Hat on AWS, Azure, and Google Cloud Platform cloud marketplaces, including RHEL 7.9.z, RHEL 8.3.1, RHEL 9.0, and later versions

     auto_registration_interval = 60

     This setting defines the interval by which automatic registration is attempted. automatic registration is attempted three times per invocation of the rhsmcertd service, with each instance occurring at this interval. For example, if this value is set to 60, a system will attempt to auto-register three times, 60 minutes apart. If automatic registration is unsuccessful after three tries, the rhsmcertd service issues no further registration attempts until the service is restarted. In cloud images, rhsmcertd service is configured to run at boot time, so a restart of the instance also restarts the rhsmcertd service and the automatic registration attempts.

     manage_repos = 0

     This setting determines how subscription-manager manages the Red Hat Content Delivery Network provided code content in the /etc/yum.repos.d/redhat.repo file. The default value is 1, which allows Red Hat Enterprise Linux systems to use content from either the CDN or a Red Hat Satellite Server. Content in public clouds is generally delivered through Red Hat Update Infrastructure (RHUI), so this value is set to 0 for automatic registration. A hybrid approach that uses both RHUI and the CDN for updates is uncommon, but can be supported by setting this value back to its default value of 1.

   • Settings for the versions of automatic registration associated with eligible subscriptions of RHEL provided by Red Hat on AWS and Azure cloud marketplaces, including RHEL 9.6, RHEL 9.7, RHEL 10, RHEL 10.1, and later versions of RHEL

     auto_registration_interval = 1

     This configuration applies to Red Hat Enterprise Linux 9.6, Red Hat Enterprise Linux 10, and later versions. When auto_registration=1 and rhsmcertd is started, the auto_registration_interval is a maximum time delay to wait before attempting to register the system automatically. When splay=1, the attempt to register happens at a random point in time within the auto_registration_interval. When splay=0, the attempt to register happens immediately following the start of rhsmcertd. The format for this value can be either hours, minutes, seconds (when using the HH:MM:SS format), or an integer number of minutes. The default value is 1.

     auto_registration_identity_interval = 10

     This configuration applies to Red Hat Enterprise Linux 9.7, Red Hat Enterprise Linux 10.1, and later versions. When auto_registration=1 and the attempt to register within the auto_registration_interval results in an anonymous registration, which is a temporary entitlement is granted without an identity certificate, the auto_registration_identity_interval is used as a maximum time delay to wait following the anonymous registration before attempting to get a proper identity certificate (or a non-temporary entitlement certificate) from the entitlement server. When splay=1, the actual time delay to wait before getting the identity certificate is random within the auto_registration_identity_interval. When splay=0, the attempt to get an identity certificate happens immediately following the anonymous registration. The format for this value can be either hours, minutes, seconds (when using the HH:MM:SS format), or an integer number of minutes. The default is 10.

     manage_repos = 1

     This setting determines how subscription-manager manages the CDN provided code content in the /etc/yum.repos.d/redhat.repo file. The default value is 1, which allows Red Hat Enterprise Linux systems to use content from the CDN.