118 lines
5.3 KiB
Plaintext
118 lines
5.3 KiB
Plaintext
---
|
|
title: Preparing our high side
|
|
exercise: 3
|
|
date: '2023-12-19'
|
|
tags: ['openshift','containers','kubernetes','disconnected']
|
|
draft: false
|
|
authors: ['default']
|
|
summary: "Setting up a bastion server and transferring content"
|
|
---
|
|
|
|
In this exercise, we'll prepare the **High side**. This involves creating a bastion server on the **High side** that will host our mirror registry.
|
|
|
|
> Note: We have an interesting dilemma for this excercise: the Amazon Machine Image we used for the prep system earlier does not have `podman` installed. We need `podman`, since it is a key dependency for `mirror-registry`.
|
|
>
|
|
> We could rectify this by running `sudo dnf install -y podman` on the bastion system, but the bastion server won't have Internet access, so we need another option for this lab. To solve this problem, we need to build our own RHEL image with podman pre-installed. Real customer environments will likely already have a solution for this, but one approach is to use the [Image Builder](https://console.redhat.com/insights/image-builder) in the Hybrid Cloud Console, and that's exactly what has been done for this lab.
|
|
>
|
|
> [workshop](/workshops/static/images/disconnected/image-builder.png)
|
|
>
|
|
> In the home directory of your web terminal you will find an `ami.txt` file containng our custom image AMI which will be used by the command that creates our bastion ec2 instance.
|
|
|
|
|
|
## 3.1 - Creating a bastion server
|
|
|
|
First up for this exercise we'll grab the ID of one of our **High side** private subnets as well as our ec2 security group.
|
|
|
|
Copy the commands below into your web terminal:
|
|
|
|
```bash
|
|
PRIVATE_SUBNET=$(aws ec2 describe-subnets | jq '.Subnets[] | select(.Tags[].Value=="Private Subnet - disco").SubnetId' -r)
|
|
echo $PRIVATE_SUBNET
|
|
|
|
SG_ID=$(aws ec2 describe-security-groups --filters "Name=tag:Name,Values=disco-sg" | jq -r '.SecurityGroups[0].GroupId')
|
|
echo $SG_ID
|
|
```
|
|
|
|
Once we know our subnet and security group ID's we can spin up our **High side** bastion server. Copy the commands below into your web terminal to complete this:
|
|
|
|
```bash
|
|
aws ec2 run-instances --image-id $(cat ami.txt) \
|
|
--count 1 \
|
|
--instance-type t3.large \
|
|
--key-name disco-key \
|
|
--security-group-ids $SG_ID \
|
|
--subnet-id $PRIVATE_SUBNET \
|
|
--tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=disco-bastion-server}]" \
|
|
--block-device-mappings "DeviceName=/dev/sdh,Ebs={VolumeSize=50}"
|
|
```
|
|
|
|
<Zoom>
|
|
| |
|
|
|:-----------------------------------------------------------------------------:|
|
|
| *Launching bastion ec2 instance* |
|
|
</Zoom>
|
|
|
|
|
|
## 3.2 - Accessing the high side
|
|
|
|
Now we need to access our bastion server on the high side. In real customer environments, this might entail use of a VPN, or physical access to a workstation in a secure facility such as a SCIF.
|
|
|
|
To make things a bit simpler for our lab, we're going to restrict access to our bastion to its private IP address. So we'll use the prep system as a sort of bastion-to-the-bastion.
|
|
|
|
Let's get access by grabbing the bastion's private IP.
|
|
|
|
```bash
|
|
HIGHSIDE_BASTION_IP=$(aws ec2 describe-instances --filters "Name=tag:Name,Values=disco-bastion-server" | jq -r '.Reservations[0].Instances[0].PrivateIpAddress')
|
|
echo $HIGHSIDE_BASTION_IP
|
|
```
|
|
|
|
Our next step will be to `exit` back to our web terminal and copy our private key to the prep system so that we can `ssh` to the bastion from there. You may have to wait a minute for the VM to finish initializing:
|
|
|
|
```bash
|
|
PREP_SYSTEM_IP=$(aws ec2 describe-instances --filters "Name=tag:Name,Values=disco-prep-system" | jq -r '.Reservations[0].Instances[0].PublicIpAddress')
|
|
|
|
scp -i disco_key disco_key ec2-user@$PREP_SYSTEM_IP:/home/ec2-user/disco_key
|
|
```
|
|
|
|
To make life a bit easier down the track let's set an environment variable on the prep system so that we can preserve the bastion's IP:
|
|
|
|
```bash
|
|
ssh -i disco_key ec2-user@$PREP_SYSTEM_IP "echo HIGHSIDE_BASTION_IP=$(echo $HIGHSIDE_BASTION_IP) > highside.env"
|
|
```
|
|
|
|
Finally - Let's now connect all the way through to our **High side** bastion 🚀
|
|
|
|
```bash
|
|
ssh -t -i disco_key ec2-user@$PREP_SYSTEM_IP "ssh -t -i disco_key ec2-user@$HIGHSIDE_BASTION_IP"
|
|
```
|
|
|
|
<Zoom>
|
|
| |
|
|
|:-----------------------------------------------------------------------------:|
|
|
| *Connecting to our bastion ec2 instance* |
|
|
</Zoom>
|
|
|
|
|
|
## 3.3 - Sneakernetting content to the high side
|
|
|
|
We'll now deliver the **High side** gift basket to the bastion server. Start by mounting our EBS volume on the bastion server to ensure that we don't run out of space:
|
|
|
|
```bash
|
|
sudo mkfs -t xfs /dev/nvme1n1
|
|
sudo mkdir /mnt/high-side
|
|
sudo mount /dev/nvme1n1 /mnt/high-side
|
|
sudo chown ec2-user:ec2-user /mnt/high-side
|
|
```
|
|
|
|
With the mount in place we can exit back to our base web terminal and send over our gift basket at `/mnt/high-side` using `rsync`.
|
|
|
|
```bash
|
|
ssh -t -i disco_key ec2-user@$PREP_SYSTEM_IP "rsync -avP -e 'ssh -i disco_key' /mnt/high-side ec2-user@$HIGHSIDE_BASTION_IP:/mnt"
|
|
```
|
|
|
|
<Zoom>
|
|
| |
|
|
|:-----------------------------------------------------------------------------:|
|
|
| *Initiating the sneakernet transfer via rsync* |
|
|
</Zoom>
|