Adding final ESXI deployment code

This commit is contained in:
Chris Long
2020-03-09 14:42:58 -07:00
parent e78b08a901
commit 4e850a5ee6
35 changed files with 988 additions and 168 deletions

View File

@@ -0,0 +1,6 @@
#!/bin/sh -eux
mkdir -p /etc;
cp /tmp/bento-metadata.json /etc/bento-metadata.json;
chmod 0444 /etc/bento-metadata.json;
rm -f /tmp/bento-metadata.json;

View File

@@ -0,0 +1,36 @@
#!/bin/sh -eux
case "$PACKER_BUILDER_TYPE" in
qemu) exit 0 ;;
esac
# Whiteout root
count=$(df --sync -kP / | tail -n1 | awk -F ' ' '{print $4}')
count=$(($count-1))
dd if=/dev/zero of=/tmp/whitespace bs=1M count=$count || echo "dd exit code $? is suppressed";
rm /tmp/whitespace
# Whiteout /boot
count=$(df --sync -kP /boot | tail -n1 | awk -F ' ' '{print $4}')
count=$(($count-1))
dd if=/dev/zero of=/boot/whitespace bs=1M count=$count || echo "dd exit code $? is suppressed";
rm /boot/whitespace
set +e
swapuuid="`/sbin/blkid -o value -l -s UUID -t TYPE=swap`";
case "$?" in
2|0) ;;
*) exit 1 ;;
esac
set -e
if [ "x${swapuuid}" != "x" ]; then
# Whiteout the swap partition to reduce box size
# Swap is disabled till reboot
swappart="`readlink -f /dev/disk/by-uuid/$swapuuid`";
/sbin/swapoff "$swappart";
dd if=/dev/zero of="$swappart" bs=1M || echo "dd exit code $? is suppressed";
/sbin/mkswap -U "$swapuuid" "$swappart";
fi
sync;

View File

@@ -0,0 +1,21 @@
#!/bin/sh -eux
bento='
This system is built by the Bento project by Chef Software
More information can be found at https://github.com/chef/bento'
if [ -d /etc/update-motd.d ]; then
MOTD_CONFIG='/etc/update-motd.d/99-bento'
cat >> "$MOTD_CONFIG" <<BENTO
#!/bin/sh
cat <<'EOF'
$bento
EOF
BENTO
chmod 0755 "$MOTD_CONFIG"
else
echo "$bento" >> /etc/motd
fi

View File

@@ -0,0 +1,20 @@
#!/bin/sh -eux
SSHD_CONFIG="/etc/ssh/sshd_config"
# ensure that there is a trailing newline before attempting to concatenate
sed -i -e '$a\' "$SSHD_CONFIG"
USEDNS="UseDNS no"
if grep -q -E "^[[:space:]]*UseDNS" "$SSHD_CONFIG"; then
sed -i "s/^\s*UseDNS.*/${USEDNS}/" "$SSHD_CONFIG"
else
echo "$USEDNS" >>"$SSHD_CONFIG"
fi
GSSAPI="GSSAPIAuthentication no"
if grep -q -E "^[[:space:]]*GSSAPIAuthentication" "$SSHD_CONFIG"; then
sed -i "s/^\s*GSSAPIAuthentication.*/${GSSAPI}/" "$SSHD_CONFIG"
else
echo "$GSSAPI" >>"$SSHD_CONFIG"
fi

View File

@@ -0,0 +1,19 @@
#!/bin/sh -eux
# set a default HOME_DIR environment variable if not set
HOME_DIR="${HOME_DIR:-/home/vagrant}";
pubkey_url="https://raw.githubusercontent.com/mitchellh/vagrant/master/keys/vagrant.pub";
mkdir -p $HOME_DIR/.ssh;
if command -v wget >/dev/null 2>&1; then
wget --no-check-certificate "$pubkey_url" -O $HOME_DIR/.ssh/authorized_keys;
elif command -v curl >/dev/null 2>&1; then
curl --insecure --location "$pubkey_url" > $HOME_DIR/.ssh/authorized_keys;
elif command -v fetch >/dev/null 2>&1; then
fetch -am -o $HOME_DIR/.ssh/authorized_keys "$pubkey_url";
else
echo "Cannot download vagrant public key";
exit 1;
fi
chown -R vagrant $HOME_DIR/.ssh;
chmod -R go-rwsx $HOME_DIR/.ssh;

View File

@@ -0,0 +1,34 @@
#!/bin/sh -eux
# set a default HOME_DIR environment variable if not set
HOME_DIR="${HOME_DIR:-/home/vagrant}";
case "$PACKER_BUILDER_TYPE" in
vmware-iso|vmware-vmx)
# make sure we have /sbin in our path. RHEL systems lack this
PATH=/sbin:$PATH
export PATH
mkdir -p /tmp/vmware;
mkdir -p /tmp/vmware-archive;
mount -o loop $HOME_DIR/linux.iso /tmp/vmware;
TOOLS_PATH="`ls /tmp/vmware/VMwareTools-*.tar.gz`";
VER="`echo "${TOOLS_PATH}" | cut -f2 -d'-'`";
MAJ_VER="`echo ${VER} | cut -d '.' -f 1`";
echo "VMware Tools Version: $VER";
tar xzf ${TOOLS_PATH} -C /tmp/vmware-archive;
if [ "${MAJ_VER}" -lt "10" ]; then
/tmp/vmware-archive/vmware-tools-distrib/vmware-install.pl --default;
else
/tmp/vmware-archive/vmware-tools-distrib/vmware-install.pl --force-install;
fi
umount /tmp/vmware;
rm -rf /tmp/vmware;
rm -rf /tmp/vmware-archive;
rm -f $HOME_DIR/*.iso;
;;
esac

View File

@@ -0,0 +1,35 @@
choose-mirror-bin mirror/http/proxy string
d-i base-installer/kernel/override-image string linux-server
d-i clock-setup/utc boolean true
d-i clock-setup/utc-auto boolean true
d-i finish-install/reboot_in_progress note
d-i grub-installer/only_debian boolean true
d-i grub-installer/with_other_os boolean true
d-i mirror/country string manual
d-i mirror/http/directory string /ubuntu/
d-i mirror/http/hostname string archive.ubuntu.com
d-i mirror/http/proxy string
d-i partman-auto-lvm/guided_size string max
d-i partman-auto/choose_recipe select atomic
d-i partman-auto/method string lvm
d-i partman-lvm/confirm boolean true
d-i partman-lvm/confirm boolean true
d-i partman-lvm/confirm_nooverwrite boolean true
d-i partman-lvm/device_remove_lvm boolean true
d-i partman/choose_partition select finish
d-i partman/confirm boolean true
d-i partman/confirm_nooverwrite boolean true
d-i partman/confirm_write_new_label boolean true
d-i passwd/user-fullname string vagrant
d-i passwd/user-uid string 1000
d-i passwd/user-password password vagrant
d-i passwd/user-password-again password vagrant
d-i passwd/username string vagrant
d-i pkgsel/include string openssh-server cryptsetup build-essential libssl-dev libreadline-dev zlib1g-dev linux-source dkms nfs-common linux-headers-$(uname -r) perl cifs-utils software-properties-common rsync ifupdown
d-i pkgsel/install-language-support boolean false
d-i pkgsel/update-policy select none
d-i pkgsel/upgrade select full-upgrade
d-i time/zone string UTC
d-i user-setup/allow-password-weak boolean true
d-i user-setup/encrypt-home boolean false
tasksel tasksel/first multiselect standard, server

View File

@@ -0,0 +1,81 @@
#!/bin/sh -eux
# Delete all Linux headers
dpkg --list \
| awk '{ print $2 }' \
| grep 'linux-headers' \
| xargs apt-get -y purge;
# Remove specific Linux kernels, such as linux-image-3.11.0-15-generic but
# keeps the current kernel and does not touch the virtual packages,
# e.g. 'linux-image-generic', etc.
dpkg --list \
| awk '{ print $2 }' \
| grep 'linux-image-.*-generic' \
| grep -v `uname -r` \
| xargs apt-get -y purge;
# Delete Linux source
dpkg --list \
| awk '{ print $2 }' \
| grep linux-source \
| xargs apt-get -y purge;
# Delete development packages
dpkg --list \
| awk '{ print $2 }' \
| grep -- '-dev$' \
| xargs apt-get -y purge;
# delete docs packages
dpkg --list \
| awk '{ print $2 }' \
| grep -- '-doc$' \
| xargs apt-get -y purge;
# Delete X11 libraries
apt-get -y purge libx11-data xauth libxmuu1 libxcb1 libx11-6 libxext6;
# Delete obsolete networking
apt-get -y purge ppp pppconfig pppoeconf;
# Delete oddities
apt-get -y purge popularity-contest installation-report command-not-found friendly-recovery bash-completion fonts-ubuntu-font-family-console laptop-detect;
# 19.10+ don't have this package so fail gracefully
apt-get -y purge command-not-found-data || true;
# Exlude the files we don't need w/o uninstalling linux-firmware
echo "==> Setup dpkg excludes for linux-firmware"
cat <<_EOF_ | cat >> /etc/dpkg/dpkg.cfg.d/excludes
#BENTO-BEGIN
path-exclude=/lib/firmware/*
path-exclude=/usr/share/doc/linux-firmware/*
#BENTO-END
_EOF_
# Delete the massive firmware packages
rm -rf /lib/firmware/*
rm -rf /usr/share/doc/linux-firmware/*
apt-get -y autoremove;
apt-get -y clean;
# Remove docs
rm -rf /usr/share/doc/*
# Remove caches
find /var/cache -type f -exec rm -rf {} \;
# truncate any logs that have built up during the install
find /var/log -type f -exec truncate --size=0 {} \;
# Blank netplan machine-id (DUID) so machines get unique ID generated on boot.
truncate -s 0 /etc/machine-id
# remove the contents of /tmp and /var/tmp
rm -rf /tmp/* /var/tmp/*
# clear the history so our install isn't there
export HISTSIZE=0
rm -f /root/.wget-hsts

View File

@@ -0,0 +1,25 @@
#!/bin/sh -eux
ubuntu_version="`lsb_release -r | awk '{print $2}'`";
major_version="`echo $ubuntu_version | awk -F. '{print $1}'`";
if [ "$major_version" -ge "18" ]; then
echo "Create netplan config for eth0"
cat <<EOF >/etc/netplan/01-netcfg.yaml;
network:
version: 2
ethernets:
eth0:
dhcp4: true
EOF
else
# Adding a 2 sec delay to the interface up, to make the dhclient happy
echo "pre-up sleep 2" >> /etc/network/interfaces;
fi
if [ "$major_version" -ge "16" ]; then
# Disable Predictable Network Interface names and use eth0
sed -i 's/en[[:alnum:]]*/eth0/g' /etc/network/interfaces;
sed -i 's/GRUB_CMDLINE_LINUX="\(.*\)"/GRUB_CMDLINE_LINUX="net.ifnames=0 biosdevname=0 \1"/g' /etc/default/grub;
update-grub;
fi

View File

@@ -0,0 +1,7 @@
#!/bin/sh -eux
sed -i -e '/Defaults\s\+env_reset/a Defaults\texempt_group=sudo' /etc/sudoers;
# Set up password-less sudo for the vagrant user
echo 'vagrant ALL=(ALL) NOPASSWD:ALL' >/etc/sudoers.d/99_vagrant;
chmod 440 /etc/sudoers.d/99_vagrant;

View File

@@ -0,0 +1,40 @@
#!/bin/sh -eux
export DEBIAN_FRONTEND=noninteractive
ubuntu_version="`lsb_release -r | awk '{print $2}'`";
major_version="`echo $ubuntu_version | awk -F. '{print $1}'`";
# Disable release-upgrades
sed -i.bak 's/^Prompt=.*$/Prompt=never/' /etc/update-manager/release-upgrades;
# Disable systemd apt timers/services
if [ "$major_version" -ge "16" ]; then
systemctl stop apt-daily.timer;
systemctl stop apt-daily-upgrade.timer;
systemctl disable apt-daily.timer;
systemctl disable apt-daily-upgrade.timer;
systemctl mask apt-daily.service;
systemctl mask apt-daily-upgrade.service;
systemctl daemon-reload;
fi
# Disable periodic activities of apt to be safe
cat <<EOF >/etc/apt/apt.conf.d/10periodic;
APT::Periodic::Enable "0";
APT::Periodic::Update-Package-Lists "0";
APT::Periodic::Download-Upgradeable-Packages "0";
APT::Periodic::AutocleanInterval "0";
APT::Periodic::Unattended-Upgrade "0";
EOF
# Clean and nuke the package from orbit
rm -rf /var/log/unattended-upgrades;
apt-get -y purge unattended-upgrades;
# Update the package list
apt-get -y update;
# Upgrade all installed packages incl. kernel and kernel headers
apt-get -y dist-upgrade -o Dpkg::Options::="--force-confnew";
reboot

View File

@@ -0,0 +1,14 @@
#!/bin/bash -eux
pubkey_url="https://raw.githubusercontent.com/mitchellh/vagrant/master/keys/vagrant.pub";
mkdir -p $HOME_DIR/.ssh;
if command -v wget >/dev/null 2>&1; then
wget --no-check-certificate "$pubkey_url" -O $HOME_DIR/.ssh/authorized_keys;
elif command -v curl >/dev/null 2>&1; then
curl --insecure --location "$pubkey_url" > $HOME_DIR/.ssh/authorized_keys;
else
echo "Cannot download vagrant public key";
exit 1;
fi
chown -R vagrant $HOME_DIR/.ssh;
chmod -R go-rwsx $HOME_DIR/.ssh;

View File

@@ -0,0 +1,10 @@
#!/bin/sh -eux
case "$PACKER_BUILDER_TYPE" in
vmware-iso|vmware-vmx)
apt-get install -y open-vm-tools;
mkdir /mnt/hgfs;
systemctl enable open-vm-tools
systemctl start open-vm-tools
echo "platform specific vmware.sh executed";
esac

View File

@@ -0,0 +1,105 @@
{
"builders": [
{
"boot_command": [
"<esc><wait>",
"<esc><wait>",
"<enter><wait>",
"/install/vmlinuz<wait>",
" auto<wait>",
" console-setup/ask_detect=false<wait>",
" console-setup/layoutcode=us<wait>",
" console-setup/modelcode=pc105<wait>",
" debconf/frontend=noninteractive<wait>",
" debian-installer=en_US.UTF-8<wait>",
" fb=false<wait>",
" initrd=/install/initrd.gz<wait>",
" kbd-chooser/method=us<wait>",
" keyboard-configuration/layout=USA<wait>",
" keyboard-configuration/variant=USA<wait>",
" locale=en_US.UTF-8<wait>",
" netcfg/get_domain=vm<wait>",
" netcfg/get_hostname=vagrant<wait>",
" grub-installer/bootdev=/dev/sda<wait>",
" preseed/url=http://{{ .HTTPIP }}:{{ .HTTPPort }}/preseed.cfg<wait>",
" -- <wait>",
"<enter><wait>"
],
"boot_wait": "10s",
"keep_registered": true,
"remote_datastore": "{{user `esxi_datastore`}}",
"remote_host": "{{user `esxi_host`}}",
"remote_username": "{{user `esxi_username`}}",
"remote_password": "{{user `esxi_password`}}",
"remote_type": "esx5",
"vnc_disable_password": true,
"vnc_port_min": 5900,
"vnc_port_max": 5980,
"disk_size": "{{user `disk_size`}}",
"guest_os_type": "ubuntu-64",
"http_directory": "{{user `http_directory`}}",
"iso_checksum": "{{user `iso_checksum`}}",
"iso_checksum_type": "{{user `iso_checksum_type`}}",
"iso_url": "{{user `mirror`}}/{{user `mirror_directory`}}/{{user `iso_name`}}",
"shutdown_command": "echo 'vagrant' | sudo -S shutdown -P now",
"ssh_password": "vagrant",
"ssh_port": 22,
"ssh_username": "vagrant",
"ssh_wait_timeout": "10000s",
"tools_upload_flavor": "linux",
"type": "vmware-iso",
"vm_name": "Ubuntu1804",
"memory": "{{ user `memory` }}",
"cpus": "{{ user `cpus` }}",
"vmx_data": {
"ethernet0.networkName": "{{ esxi_network_with_dhcp_and_internet }}",
"cpuid.coresPerSocket": "1",
"ethernet0.pciSlotNumber": "32"
}
}
],
"provisioners": [
{
"environment_vars": [
"HOME_DIR=/home/vagrant"
],
"execute_command": "echo 'vagrant' | {{.Vars}} sudo -S -E sh -eux '{{.Path}}'",
"expect_disconnect": true,
"scripts": [
"{{template_dir}}/scripts/update.sh",
"{{template_dir}}/_common/motd.sh",
"{{template_dir}}/_common/sshd.sh",
"{{template_dir}}/scripts/networking.sh",
"{{template_dir}}/scripts/sudoers.sh",
"{{template_dir}}/scripts/vagrant.sh",
"{{template_dir}}/scripts/vmware.sh",
"{{template_dir}}/scripts/cleanup.sh"
],
"type": "shell"
}
],
"variables": {
"box_basename": "ubuntu-18.04",
"http_directory": "{{template_dir}}/http",
"build_timestamp": "{{isotime \"20060102150405\"}}",
"cpus": "2",
"disk_size": "65536",
"esxi_datastore": "",
"esxi_host": "",
"esxi_username": "",
"esxi_password": "",
"headless": "false",
"guest_additions_url": "",
"iso_checksum": "e2ecdace33c939527cbc9e8d23576381c493b071107207d2040af72595f8990b",
"iso_checksum_type": "sha256",
"iso_name": "ubuntu-18.04.4-server-amd64.iso",
"memory": "4096",
"mirror": "http://cdimage.ubuntu.com",
"mirror_directory": "ubuntu/releases/18.04.4/release",
"name": "ubuntu-18.04",
"no_proxy": "{{env `no_proxy`}}",
"preseed_path": "preseed.cfg",
"template": "ubuntu-18.04-amd64",
"version": "TIMESTAMP"
}
}

View File

@@ -0,0 +1,7 @@
{
"esxi_host": "",
"esxi_datastore": "",
"esxi_username": "",
"esxi_password": "",
"esxi_network_with_dhcp_and_internet": "",
}

View File

@@ -0,0 +1,102 @@
{
"builders": [
{
"vnc_disable_password": true,
"keep_registered": true,
"remote_datastore": "{{user `esxi_datastore`}}",
"remote_host": "{{user `esxi_host`}}",
"remote_username": "{{user `esxi_username`}}",
"remote_password": "{{user `esxi_password`}}",
"remote_type": "esx5",
"type": "vmware-iso",
"vm_name":"Windows10",
"communicator": "winrm",
"iso_url": "{{user `iso_url`}}",
"iso_checksum_type": "{{user `iso_checksum_type`}}",
"iso_checksum": "{{user `iso_checksum`}}",
"headless": false,
"boot_wait": "6m",
"boot_command": "",
"winrm_username": "vagrant",
"winrm_password": "vagrant",
"winrm_timeout": "4h",
"shutdown_timeout": "2h",
"shutdown_command": "a:/sysprep.bat",
"guest_os_type": "windows9-64",
"disk_size": "{{user `disk_size`}}",
"vnc_port_min": 5900,
"vnc_port_max": 5980,
"version": 11,
"floppy_files": [
"{{user `autounattend`}}",
"../../Packer/floppy/WindowsPowershell.lnk",
"../../Packer/floppy/PinTo10.exe",
"../../Packer/scripts/fixnetwork.ps1",
"../../Packer/scripts/rearm-windows.ps1",
"../../Packer/scripts/disable-screensaver.ps1",
"../../Packer/scripts/disable-winrm.ps1",
"../../Packer/scripts/enable-winrm.ps1",
"../../Packer/scripts/microsoft-updates.bat",
"../../Packer/scripts/win-updates.ps1",
"../../Packer/scripts/unattend.xml",
"../../Packer/scripts/sysprep.bat"
],
"vmx_data": {
"ethernet0.networkName": "{{ esxi_network_with_dhcp_and_internet }}",
"memsize": "2048",
"numvcpus": "2",
"scsi0.virtualDev": "lsisas1068"
}
}
],
"provisioners": [
{
"type": "windows-shell",
"remote_path": "/tmp/script.bat",
"execute_command": "{{ .Vars }} cmd /c \"{{ .Path }}\"",
"scripts": [
"../../Packer/scripts/vm-guest-tools.bat",
"../../Packer/scripts/enable-rdp.bat"
]
},
{
"type": "powershell",
"scripts": [
"../../Packer/scripts/debloat-windows.ps1"
]
},
{
"type": "windows-restart"
},
{
"type": "powershell",
"scripts": [
"../../Packer/scripts/set-powerplan.ps1",
"../../Packer/scripts/docker/disable-windows-defender.ps1"
]
},
{
"type": "windows-shell",
"remote_path": "/tmp/script.bat",
"execute_command": "{{ .Vars }} cmd /c \"{{ .Path }}\"",
"scripts": [
"../../Packer/scripts/pin-powershell.bat",
"../../Packer/scripts/compile-dotnet-assemblies.bat",
"../../Packer/scripts/set-winrm-automatic.bat",
"../../Packer/scripts/dis-updates.bat"
]
}
],
"variables": {
"esxi_datastore": "",
"esxi_host": "",
"esxi_username": "",
"esxi_password": "",
"iso_checksum": "ab4862ba7d1644c27f27516d24cb21e6b39234eb3301e5f1fb365a78b22f79b3",
"iso_checksum_type": "sha256",
"iso_url": "https://software-download.microsoft.com/download/pr/18362.30.190401-1528.19h1_release_svc_refresh_CLIENTENTERPRISEEVAL_OEMRET_x64FRE_en-us.iso",
"autounattend": "../../Packer/answer_files/10/Autounattend.xml",
"disk_size": "61440"
}
}

View File

@@ -0,0 +1,88 @@
{
"builders": [
{
"vnc_disable_password": true,
"keep_registered": true,
"remote_datastore": "{{user `esxi_datastore`}}",
"remote_host": "{{user `esxi_host`}}",
"remote_username": "{{user `esxi_username`}}",
"remote_password": "{{user `esxi_password`}}",
"remote_type": "esx5",
"vm_name":"WindowsServer2016",
"type": "vmware-iso",
"communicator": "winrm",
"iso_url": "{{user `iso_url`}}",
"iso_checksum_type": "{{user `iso_checksum_type`}}",
"iso_checksum": "{{user `iso_checksum`}}",
"headless": false,
"boot_wait": "2m",
"winrm_username": "vagrant",
"winrm_password": "vagrant",
"winrm_timeout": "4h",
"shutdown_timeout": "2h",
"shutdown_command": "a:/sysprep.bat",
"guest_os_type": "windows8srv-64",
"disk_size": 61440,
"version": 11,
"floppy_files": [
"{{user `autounattend`}}",
"../../Packer/floppy/WindowsPowershell.lnk",
"../../Packer/floppy/PinTo10.exe",
"../../Packer/scripts/unattend.xml",
"../../Packer/scripts/sysprep.bat",
"../../Packer/scripts/disable-screensaver.ps1",
"../../Packer/scripts/disable-winrm.ps1",
"../../Packer/scripts/enable-winrm.ps1",
"../../Packer/scripts/microsoft-updates.bat",
"../../Packer/scripts/win-updates.ps1"
],
"vmx_data": {
"ethernet0.networkName": "{{ esxi_network_with_dhcp_and_internet }}",
"memsize": "2048",
"numvcpus": "2",
"scsi0.virtualDev": "lsisas1068"
}
}
],
"provisioners": [
{
"type": "windows-shell",
"execute_command": "{{ .Vars }} cmd /c \"{{ .Path }}\"",
"scripts": [
"../../Packer/scripts/vm-guest-tools.bat",
"../../Packer/scripts/enable-rdp.bat"
]
},
{
"type": "powershell",
"scripts": [
"../../Packer/scripts/debloat-windows.ps1"
]
},
{
"type": "windows-restart"
},
{
"type": "windows-shell",
"execute_command": "{{ .Vars }} cmd /c \"{{ .Path }}\"",
"scripts": [
"../../Packer/scripts/pin-powershell.bat",
"../../Packer/scripts/set-winrm-automatic.bat",
"../../Packer/scripts/compile-dotnet-assemblies.bat",
"../../Packer/scripts/uac-enable.bat",
"../../Packer/scripts/compact.bat"
]
}
],
"variables": {
"esxi_datastore": "",
"esxi_host": "",
"esxi_username": "",
"esxi_password": "",
"iso_url": "https://software-download.microsoft.com/download/pr/Windows_Server_2016_Datacenter_EVAL_en-us_14393_refresh.ISO",
"iso_checksum_type": "md5",
"iso_checksum": "70721288BBCDFE3239D8F8C0FAE55F1F",
"autounattend": "../../Packer/answer_files/2016/Autounattend.xml"
}
}