February 14, 2018

CentOS Dojo @ FOSDEM: Videos

February 14, 2018 09:12 PM

For those of you who were unable to attend the CentOS Dojo in Brussels, here are all of the videos from the event.

Subscribe to our YouTube at youtube.com/TheCentOSProject 

KB's "State of CentOS"

Bert Van Vreckem - Basic troubleshooting of network services

Tomas Oulevey - Anaconda addon development

Matthias Runge - Opstools SIG

Haikel Guemar - Metrics with Gnocchi

Colin Charles - Understanding the MySQL database ecosystem

Fabian Arrotin - Content caching

Sean O'Keeffee - Foreman and Katello

Tom Callaway  - Building modern code with devtoolset

Spyros Trigazis - Practical system containers with Atomic

Kris Buytaert - Deplyong your SaaS stack OnPrem

February 06, 2018

FOSDEM 2018

February 06, 2018 08:25 PM

Another FOSDEM is history. I wanted to take a moment to thank all of the people that helped out at the CentOS table at FOSDEM, as well as at the Dojo before FOSDEM.

FOSDEM

We had about 75 people in attendance at the Dojo on Friday, with 12 presentations from various speakers. Some of these presentations are already available on YouTube, with the rest coming over the next few days.

FOSDEM

Traffic was steady at the CentOS table, from people new to Linux, all the way 15-year CentOS sysadmin veterans. A huge thank you to everyone who dropped by and chatted with us.

FOSDEM

If you missed FOSDEM and the Brussels Dojo, there's always other opportunities to meet CentOS people. This year we expect to have another 4 or 5 Dojos around the world, starting in Singapore next month, and moving on to Meyrin (Switzerland), Oak Ridge (USA), and Delhi (India). If you'd like to host a Dojo anywhere in the world, please get in touch with the Centos-Promo mailing list to see how we can help you achieve your goal. We can usually help find speakers, venues, and funding for your event.

January 20, 2018

Updated CentOS Vagrant Images Available (v1801.01)

January 20, 2018 05:27 PM

We are pleased to announce new official Vagrant images of CentOS Linux 6.9 and CentOS Linux 7.4.1708 for x86_64 (based on the sources of RHEL 7.4). All included packages have been updated to 9 January 2017 and include important fixes for the Meltdown and Spectre vulnerabilities affecting modern processors.

Known Issues

  1. The VirtualBox Guest Additions are not preinstalled; if you need them for shared folders, please install the vagrant-vbguest plugin and add the following line to your Vagrantfile:
    config.vm.synced_folder ".", "/vagrant", type: "virtualbox"

    We recommend using NFS instead of VirtualBox shared folders if possible; you can also use the vagrant-sshfs plugin, which, unlike NFS, works on all operating systems.

  2. Since the Guest Additions are missing, our images are preconfigured to use rsync for synced folders. Windows users can either use SMB for synced folders, or disable the sync directory by adding the line
    config.vm.synced_folder ".", "/vagrant", disabled: true

    to their Vagrantfile, to prevent errors on "vagrant up".

  3. Vagrant 1.8.5 is unable to create new CentOS Linux boxes due to Vagrant bug #7610
  4. Vagrant 1.8.7 is unable to download or update boxes due to Vagrant bug #7969.
  5. Vagrant 1.9.1 broke private networking, see Vagrant bug #8166
  6. Vagrant 1.9.3 doesn't work with SMB sync due to Vagrant bug #8404
  7. The vagrant-libvirt plugin is only compatible with Vagrant 1.5 to 1.8
  8. Installing open-vm-tools is not enough for enabling shared folders with Vagrant’s VMware provider. Please follow the detailed instructions in https://github.com/mvermaes/centos-vmware-tools (updated for this release).
  9. Some people reported "could not resolve host" errors when running the centos/7 image for VirtualBox on Windows hosts. Try adding the following line to your Vagrantfile:
    vb.customize ["modifyvm", :id, "--natdnshostresolver1", "off"]

Recommended Setup on the Host

Our automatic testing is running on a CentOS Linux 7 host, using Vagrant 1.9.4 with vagrant-libvirt and VirtualBox 5.1.20 (without the Guest Additions) as providers. We strongly recommend using the libvirt provider when stability is required.

Downloads

The official images can be downloaded from Vagrant Cloud. We provide images for HyperV, libvirt-kvm, VirtualBox and VMware.

If you never used our images before:

vagrant box add centos/6 # for CentOS Linux 6, or...
vagrant box add centos/7 # for CentOS Linux 7

Existing users can upgrade their images:

vagrant box update --box centos/6
vagrant box update --box centos/7

Verifying the integrity of the images

The SHA256 checksums of the images are signed with the CentOS 7 Official Signing Key. First, download and verify the checksum file:

$ curl http://cloud.centos.org/centos/7/vagrant/x86_64/images/sha256sum.txt.asc -o sha256sum.txt.asc
$ gpg --verify sha256sum.txt.asc

If the check passed, you can use the corresponding checksum when downloading the image with Vagrant:

$ export box_checksum="4440a10744855ec2819d726074958ad6cff56bb5a616f6a45b0a42d602aa1154"
$ vagrant box add --checksum-type sha256 --checksum $box_checksum --provider libvirt --box-version 1801.02 centos/7

Feedback

If you encounter any unexpected issues with the Vagrant images, feel free to ask on the centos-devel mailing list, or via IRC, in #centos on Freenode.

Ackowledgements

We would like to warmly thank Fabian Arrotin and Thomas Oulevey for their work on the build infrastructure, as well as Patrick Lang from Microsoft for testing and feedback on the Hyper-V images.

We would also like to thank the following people (listed alphabetically):

  • Graham Mainwaring, for helping with tests and validations;
  • Michael Vermaes, for testing our official images, as well as for writing the detailed guide to using them with VMware Fusion Pro and VMware Workstation Pro;
  • Kirill Kalachev, for reporting and debugging the host name errors with VirtualBox on Windows hosts.

Update : this blog post was updated on January Wednesday 24th to reflect different checksum as the image to use is 1801_02

January 18, 2018

Diagnosing nf_conntrack/nf_conntrack_count issues on CentOS mirrorlist nodes

January 18, 2018 11:00 PM

Yesterday, I got some alerts for some nodes in the CentOS Infra from both our monitoring system, but also confirmed by some folks reporting errors directly in our #centos-devel irc channel on Freenode.

The impacted nodes were the nodes we use for mirrorlist service. For people not knowing what they are used for, here is a quick overview of what happens when you run "yum update" on your CentOS node :

  • yum analyzes the .repo files contained under /etc/yum.repos.d/
  • for CentOS repositories, it knows that it has to use a list of mirrors provided by a server hosted within the centos infra (mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=updates&infra=$infra )
  • yum then contacts one of the server behind "mirrorlist.centos.org" (we have 4 nodes so far : two in Europe and two in USA, all available over IPv4 and IPv6)
  • mirrorlist checks the src ip and sends back a list of current/up2date mirrors in the country (some GeoIP checks are done)
  • yum then opens connection to those validated mirrors

We monitor the response time for those services, and average response time is usually < 1sec (with some exceptions, mostly due to network latency also for nodes in other continents). But yesterday the values where not only higher, but also even completely missing from our monitoring system, so no data received. Here is a graph from our monitoring/Zabbix server :

mirrorlist-response-time-error.png

So clearly something was happening and time to also find some patterns. Also from our monitoring we discovered that the number of tracked network connections by the kernel was also suddenly higher than usual. In fact, as soon as your node does some state tracking with netfilter (like for example -m state ESTABLISHED,RELATED ), it keeps that in memory. You can easily retrive number of actively tracked connections like this :

cat /proc/sys/net/netfilter/nf_conntrack_count 

So it's easy to guess what happens if the max (/proc/sys/net/netfilter/nf_conntrack_max) is reached : kernel drops packets (from dmesg):

nf_conntrack: table full, dropping packet

Depending on the available memory, you can get default values, which can be changed in real-time. Don't forget to also tune then the Hash size (basic rule is nf_conntrack_max / 4) On the mirrorlist nodes, we had default values of 262144 (so yeah, keeping track of that amount of connections in memory), so to get quickly the service in shape :

new_number="524288"
echo ${new_number} > /proc/sys/net/netfilter/nf_conntrack_max
echo $(( $new_number / 4 )) > /sys/module/nf_conntrack/parameters/hashsize

Other option was also to flush the table (you can do that with conntrack -F , tool from conntrack-tools package) but it's really only a temporary fix, and that will not help you getting the needed info for proper troubleshooting (see below)

Here is the Zabbix graph showing that for some nodes it was higher than default values, but now kernel wasn't dropping packets.

ip_conntrack_count.png

We could then confirm that service was then working fine (not "flapping" anymore).

So one can think that it was the only solution for the problem and stop investigation there. But what is the root cause of this ? What happened that opened so many (unclosed) connections to those mirrorlist nodes ? Let's dive into nf_conntrack table again !

Not only you have the number of tracked connections (through /proc/sys/net/netfilter/nf_conntrack_count) but also the whole details about those. So let's dump that into a file for full analysis and try to find a pattern :

cat /proc/net/nf_conntrack > conntrack.list
cat conntrack.list |awk '{print $7}'|sed 's/src=//g'|sort|uniq -c|sort -n -r|head

Here we go : same range of IPs on all our mirrorlist servers having thousands of ESTABLISHED connection. Not going to give you all details about this (goal of this blog post isn't "finger pointing"), but we suddenly identified the issue. So we took contact with network team behind those identified IPs to report that behaviour, still to be tracked, but wondering myself if a Firewall doing NAT wasn't closing tcp connections at all, more to come.

At least mirrorlist response time is now back at usual state :

mirrorlist-response-time.png

So you can also let your configuration management now set those parameters through dedicated .conf under /etc/systctl.d/ to ensure that they'll be applied automatically.

Meltdown and Spectre: The response from CentOS

January 18, 2018 02:53 AM

As you are no doubt well aware, the Meltdown and Spectre bugs are hardware flaws in Intel and AMD chips, and have been all over the tech news for the last few weeks. If you need to get up to speed on what they’re all about, we recommend this great blog post.

CentOS, meanwhile, has not been idle, and has rolled out new kernels for CentOS 6 and CentOS 7 in response, both of which were announced on January 4th. ISO images were made available on January 8th.

Docker containers were made available on January 9th.

EC2 cloud images typically take a few extra days, and will be announced on the centos-announce mailing list.

On January 17th, Johnny Hughes announced an update to the microcode.dat on CentOS 6. You can read more about that in his tweet, and in this mailing list message.

For more information, and further updated, watch the centos-announce mailing list, and our various social media outlets:

 

January 15, 2018

PHP 7.2 for CentOS 7 armhfp

January 15, 2018 04:22 PM

What happens when you need something that is not readily available, but you can help get it done?
In my case, start harrassing people until you get all the info you need. Enter @arrfab and @remicollet.
Fabian got the builder ready, and contacted Remi who got me to use his SRPMS, all I had to do was push the packages to the builders and wait, and wait, and wait some more....

Status:
The current status is that we have php-7.2.1 working, as you can see in the screenshot, with only basic tests done for the moment, but all successful.
Most of the packages are built, some are being a little stubborn, but we'll get it done. But here is where you come in, we need testing (heavy testing), real user case scenarios.
If you want to see a Spectre of what things are going to be, and you are not afraid your computer may have a complete Meltdown, you can keep reading.

Installing:
Currently we are focused on building only the opt-in php replacement, and all the other platform dependant packages from Remi's repo (noarch rpms are not currently the main target, so you should get it from Remi's repo).
If you don't already have a "test subject", please follow the steps on https://wiki.centos.org/SpecialInterestGroup/AltArch/Arm32 first, including  EPEL, which is done with the following command:

cat > /etc/yum.repos.d/epel.repo << EOF
[epel]
name=Epel rebuild for armhfp
baseurl=https://armv7.dev.centos.org/repodir/epel-pass-1/
enabled=1
gpgcheck=0
EOF

Then all that is left is adding the test repo like this:

cat > /etc/yum.repos.d/php72-testing.repo << EOF
[php72-testing]
name=Remi php72 rebuild for armhfp
baseurl=https://armv7.dev.centos.org/repodir/community-php72-testing/
enabled=1
gpgcheck=0
EOF

As I said before,  we aren't rebuilding noarch packages, so if you need one of those, just add remi's repo like this:

cat > /etc/yum.repos.d/remi.repo << EOF
[remi]
name=Remi's RPM repository for Enterprise Linux 7 - $basearch
mirrorlist=http://cdn.remirepo.net/enterprise/7/remi/mirror
enabled=1
gpgcheck=1
gpgkey=https://rpms.remirepo.net/RPM-GPG-KEY-remi
EOF

Feedback:
Come find us on the CentOS on ARM-Dev list at https://lists.centos.org/mailman/listinfo/arm-dev

Thanks for testing!!!
Pablo.

January 09, 2018

Using a RaspberryPI3 as Unifi AP controller with CentOS 7

January 09, 2018 11:00 PM

That's something I should have blogged about earlier, but I almost forgot about it, until I read on twitter other people having replaced their home network equipment with Ubnt/Ubiquiti gear so I realized that it was on my to 'TOBLOG' list.

During the winter holidays, the whole family was at home, and also with kids on the WiFi network. Of course I already had a different wlan for them, separated/seggregated from the main one, but plenty of things weren't really working on that crappy device. So it was time to setup something else. I had opportunity to play with some Ubiquiti devices in the past, so finding even an old Unifi UAP model was enough for my needs (just need Access Point, routing/firewall being done on something else).

If you've already played with those tools, you know that you need a controller to setup the devices up , and because it's 'only' a java/mongodb stack, I thought it would be trivial to setup on a low-end device like RaspberryPi3 (not limited to that , so all armhfp boards on which you can run CentOS would work)

After having installed CentOS 7 armhfp minimal on the device, and once logged, I just had to add the mandatory unofficial epel repository for mongodb

cat > /etc/yum.repos.d/epel.repo << EOF
[epel]
name=Epel rebuild for armhfp
baseurl=https://armv7.dev.centos.org/repodir/epel-pass-1/
enabled=1
gpgcheck=0

EOF

After that, just installed what's required to run the application :

yum install mongodb mongodb-server java-1.8.0-openjdk-headless -y

The "interesting" part is that now Ubnt only provides .deb packages , so we just have to download/extract what we need (it's all java code) and start it :

tmp_dir=$(mktemp -d)
cd $tmp_dir
curl -O http://dl.ubnt.com/unifi/5.6.26/unifi_sysvinit_all.deb
ar vx unifi_sysvinit_all.deb
tar xvf data.tar.xz
mv usr/lib/unifi/ /opt/UniFi
cd /opt/UniFi/bin
/bin/rm -Rf $tmp_dir
ln -s /bin/mongod

You can start it "by hand" but let's create a simple systemd file and use it directly :

cat > /etc/systemd/system/unifi.service << EOF
[Unit]
Description=UBNT UniFi Controller
After=syslog.target network.target

[Service]
WorkingDirectory=/opt/UniFi
ExecStart=/usr/bin/java -jar /opt/UniFi/lib/ace.jar start
ExecStop=/usr/bin/java -jar /opt/UniFi/lib/ace.jar stop

[Install]
WantedBy=multi-user.target

EOF

systemctl daemon-reload
systemctl enable unifi --now

Don't forget that :

  • it's "Java"
  • running on slow armhfp processor

So that will take time to initialize. You can follow progress in /opt/UniFi/logs/server.log and wait for the TLS port to be opened :

while true ; do sleep 1 ; ss -tanp|grep 8443 && break ; done

Dont forget to open the needed ports for firewall and you can then reach the Unifi controller running on your armhfp board.

CentOS Atomic Host 7.1712 Available for Download

January 09, 2018 06:05 PM

The CentOS Atomic SIG has released an updated version of CentOS Atomic Host (7.1712), a lean operating system designed to run Linux containers, built from standard CentOS 7 RPMs, and tracking the component versions included in Red Hat Enterprise Linux Atomic Host.

This release includes updated kernel, linux-firmware and microcode_ctl packages to address recent security advisories, alongside other minor updates that shipped during the month of December.

CentOS Atomic Host includes these core component versions:

  • atomic-1.20.1-9.git436cf5d.el7.centos.x86_64
  • cloud-init-0.7.9-9.el7.centos.2.x86_64
  • docker-1.12.6-68.gitec8512b.el7.centos.x86_64
  • etcd-3.2.9-3.el7.x86_64
  • flannel-0.7.1-2.el7.x86_64
  • kernel-3.10.0-693.11.6.el7.x86_64
  • kubernetes-node-1.5.2-0.7.git269f928.el7.x86_64
  • ostree-2017.11-1.el7.x86_64
  • rpm-ostree-client-2017.9-1.atomic.el7.x86_64

Download CentOS Atomic Host

CentOS Atomic Host is available as a VirtualBox or libvirt-formatted Vagrant box, or as an installable ISO, qcow2 or Amazon Machine image. For links to media, see the CentOS wiki.

Upgrading

If you're running a previous version of CentOS Atomic Host, you can upgrade to the current image by running the following command:

# atomic host upgrade

Release Cycle

The CentOS Atomic Host image follows the upstream Red Hat Enterprise Linux Atomic Host cadence. After sources are released, they're rebuilt and included in new images. After the images are tested by the SIG and deemed ready, we announce them.

Getting Involved

CentOS Atomic Host is produced by the CentOS Atomic SIG, based on upstream work from Project Atomic. If you'd like to work on testing images, help with packaging, documentation -- join us!

The SIG meets every two weeks as part of the Project Atomic community meeting at 16:00 UTC on Monday in the #atomic channel. You'll often find us in #atomic and/or #centos-devel if you have questions. You can also join the atomic-devel mailing list if you'd like to discuss the direction of Project Atomic, its components, or have other questions.

Getting Help

If you run into any problems with the images or components, feel free to ask on the centos-devel mailing list.

Have questions about using Atomic? See the atomic mailing list or find us in the #atomic channel on Freenode.

January 02, 2018

turn off unused GPU on the laptop

January 02, 2018 09:41 PM

Lots of us have dual graphics cards in the laptops these days, but almost everyone I know tends to use one or the other, hardly ever switching on the fly, since typical usage patterns tend to stick for periods of time.

One thing that almost no one seems to do however is turn off the unusued gpu – when on the move, this can have a significant impact on your battery life.

On CentOS Linux 7, the way to do this would be something like this :

echo ‘OFF’ > /sys/kernel/debug/vgaswitcheroo/switch

And thats it, lterally send it the OFF and the unused gpu is powered down.

You can also querry the interface as follows:

# cat /sys/kernel/debug/vgaswitcheroo/switch

On my Thinkpad T460p it looks like this :

0:IGD:+:Pwr:0000:00:02.0
1:DIS: :DynOff:0000:02:00.0

For more info on the vgaswitcheroo, take a look at your kernel document eg https://www.kernel.org/doc/html/v4.10/gpu/vga-switcheroo.html

Enjoy!

January 01, 2018

Lightweigth CentOS 7 i686 desktop on older machine

January 01, 2018 11:00 PM

So, end of the year is always when you have some "time off" and so can work on various projects that were left behind. While searching for other hardware collecting dust in my furniture (other blog post coming soon about that too) I found my old Asus Eeepc 900 and was wondering if I could resurrect it.

While it was working CentOS 5 and then 6 "just fine" I wanted to give it a try with CentOS 7.

Of course, if you remember the specs from that ~2008 small netbook, you remember that it had :

  • slow cpu (Intel(R) Celeron(R) M processor 900MHz)
  • only 1Gb of ram
  • very limited disk space (ASUS-PHISON OB SSD 4GB + additional 8GB for my model)

Setting up the full Gnome3 experience on it would be completely useless and also unusable. So let's try to setup CentOS 7 AltArch minimal (needed as cpu is only i686/32bits) and add what we need after that. So here we go :

  • Download netinstall iso image (I used "local" mirror for me , so http://mirror.nucleus.be/centos-altarch/7/isos/i386/CentOS-7-i386-NetInstall-1611.iso)
  • use dd to transfer it to usb storage key
  • starting the installed on the eeepc
  • wait .... wait .... wait ...

Once installed and up2date, one needs to add additional repositories that aren't there by default. As a reminder, there is no official Epel builds for i686 (same as for armhfp ) but Johnny started to rebuild Epel SRPMs for that specific reason, so here we go :

cat > /etc/yum.repos.d/epel.repo << EOF
[epel]
name=Epel rebuild for i686
baseurl=https://buildlogs.centos.org/c7-epel/
enabled=1
gpgcheck=0

EOF

cat > /etc/yum.repos.d/kernel.repo << EOF
[kernel]
name=LTS kernel for i686
baseurl=https://buildlogs.centos.org/c7.1708.exp.i386/
enabled=1
gpgcheck=0

EOF

If you see the other kernel repository, that's because the needed ath5k kernel module for the Wifi device in the Eeepc isn't there in the default kernel nor available through elrepo, but it works with that 4.9.x LTS kernel we build and maintain/update for AltArch so let's use it.

We can install what we need (YMMV though) :

yum update -y
yum groupinstall -y 'X Window System'
yum install -y openbox lightdm lightdm-gtk 
systemctl enable lightdm.service
yum install -y tint2 terminator firefox terminus-fonts-console terminus-fonts network-manager-applet gnome-keyring dejavu-sans-fonts dejavu-fonts-common dejavu-serif-fonts dejavu-sans-mono-fonts open-sans-fonts overpass-fonts liberation-mono-fonts liberation-serif-fonts google-crosextra-caladea-fonts google-crosextra-carlito-fonts 

echo 'tint2 &' >> /etc/xdg/openbox/autostart
echo 'nm-applet &' >> /etc/xdg/openbox/autostart
systemctl reboot

The last line with tint2 , terminator and firefox is purely optional but that's what I needed on my eeepc. Same for network-manager-applet, but once installed, it gives you easy to work with applet integrated in openbox environment.

You can then customize it, etc, but I like it so far for what I wanted to use that old netbook for :

CentOS 7 i686 running on Asus Eeepc 900

December 05, 2017

CentOS Atomic Host 7.1711 Available for Download

December 05, 2017 04:24 AM

Last week, the CentOS Atomic SIG released an updated version of CentOS Atomic Host (7.1711), a lean operating system designed to run Linux containers, built from standard CentOS 7 RPMs, and tracking the component versions included in Red Hat Enterprise Linux Atomic Host.

This release rolls up a handful of minor CentOS updates from the past month. The core Atomic component versions are unchanged from those in the previous release (7.1710).

CentOS Atomic Host includes these core component versions:

  • atomic-1.19.1-5.git48c224b.el7.centos.x86_64
  • cloud-init-0.7.9-9.el7.centos.2.x86_64
  • docker-1.12.6-61.git85d7426.el7.centos.x86_64
  • etcd-3.2.7-1.el7.x86_64
  • flannel-0.7.1-2.el7.x86_64
  • kernel-3.10.0-693.5.2.el7.x86_64
  • kubernetes-node-1.5.2-0.7.git269f928.el7.x86_64
  • ostree-2017.11-1.el7.x86_64
  • rpm-ostree-client-2017.9-1.atomic.el7.x86_64

Download CentOS Atomic Host

CentOS Atomic Host is available as a VirtualBox or libvirt-formatted Vagrant box, or as an installable ISO, qcow2 or Amazon Machine image. For links to media, see the CentOS wiki.

Upgrading

If you're running a previous version of CentOS Atomic Host, you can upgrade to the current image by running the following command:

# atomic host upgrade

Release Cycle

The CentOS Atomic Host image follows the upstream Red Hat Enterprise Linux Atomic Host cadence. After sources are released, they're rebuilt and included in new images. After the images are tested by the SIG and deemed ready, we announce them.

Getting Involved

CentOS Atomic Host is produced by the CentOS Atomic SIG, based on upstream work from Project Atomic. If you'd like to work on testing images, help with packaging, documentation -- join us!

The SIG meets every two weeks as part of the Project Atomic community meeting at 16:00 UTC on Monday in the #atomic channel. You'll often find us in #atomic and/or #centos-devel if you have questions. You can also join the atomic-devel mailing list if you'd like to discuss the direction of Project Atomic, its components, or have other questions.

Getting Help

If you run into any problems with the images or components, feel free to ask on the centos-devel mailing list.

Have questions about using Atomic? See the atomic mailing list or find us in the #atomic channel on Freenode.

November 27, 2017

SuperComputing17 Denver, #PoweredByCentOS

November 27, 2017 08:41 PM

SC17, the largest SuperComputing event in the world, was held in Denver, Colorado, November 12 through 17th. I was lucky enough to attend the event as a representative of the CentOS community. While there, I spoke with dozens of organizations that use CentOS as part of their High Performance Computing (HPC) infrastructure.

I also got to talk with all of the student teams participating in the Student Cluster Competition (SCC). The SCC is a high point of these events, for me, as you get to watch young people who are excited about technology and who have the amazing opportunity of getting to work with some of the best supercomputing hardware on the market.

Teams which compete in the competition must create a supercomputer from commercially available hardware (usually sponsored by various hardware vendors) and compete on a variety of standard benchmarks. Clusters must not exceed a specified power consumption (which varies from year to year). And a surprise application is given to the students when the on-site portion of the competition starts, to judge their ability to come up with a solution under pressure.

This year in Denver, there were 16 teams participating - 15 college teams, and, for the first time, a high school team made it to the finals. Of those, 12 teams were running CentOS, 1 Fedora, and 3 Ubuntu.

The team that won, Nanyang Technological University, Singapore (51.8 Teraflops!), was, of course, running CentOS. They told me that they chose CentOS because it's pretty much an industry standard, and thus tends to have drivers available more reliably than alternatives.

As at the event in Frankfurt, I was able to interview several of the student teams, and you can watch those videos on my YouTube channel. Unfortunately, once again, the audio quality is awful, since supercomputer clusters are really, really loud.

If you are part of a team that participated in the SCC, we would love to hear your story. Get in touch via email (rbowen AT Red Hat DOT com) or via our @centosproject account on Twitter. And hopefully we'll see you in Singapore for SC-Asia, or in Frankfurt for ISC High Performance.

 

November 17, 2017

CentOS Linux 6 to CentOS Linux 7 Upgrade Tool

November 17, 2017 05:30 PM

There is an upgrade tool that allows for in-place upgrades from CentOS Linux 6 to CentOS Linux 7.  This tool is Community Maintained, and information is available on the CentOS Wiki and on the CentOS Mailing List.

We currently do not have anyone from the Community maintaining the package, and in its current state it no longer works.

We really need someone from the CentOS Community to step up and maintain this Upgrade Tool, or we are going to have to remove it from the downloads area, since in it current state it can break people's machines if they try to use it.

If anyone would like to maintain the Upgrade Tool, please reply to the thread on the general CentOS Mailing List. (or you can contact me directly at johnny AT centos DOT org

 

November 14, 2017

CentOS Atomic Host (7.1710) Now Available for Download

November 14, 2017 02:19 AM

The CentOS Atomic SIG has released an updated version of CentOS Atomic Host (7.1710), a lean operating system designed to run Linux containers, built from standard CentOS 7 RPMs, and tracking the component versions included in Red Hat Enterprise Linux Atomic Host.

This release includes an updated version of rpm-ostree that allows for more flexibility when using rpm-ostree's package layering features.

CentOS Atomic Host includes these core component versions:

  • atomic-1.19.1-5.git48c224b.el7.centos.x86_64
  • cloud-init-0.7.9-9.el7.centos.2.x86_64
  • docker-1.12.6-61.git85d7426.el7.centos.x86_64
  • etcd-3.2.7-1.el7.x86_64
  • flannel-0.7.1-2.el7.x86_64
  • kernel-3.10.0-693.5.2.el7.x86_64
  • kubernetes-node-1.5.2-0.7.git269f928.el7.x86_64
  • ostree-2017.11-1.el7.x86_64
  • rpm-ostree-client-2017.9-1.atomic.el7.x86_64

Package Layering with rpm-ostree

Using rpm-ostree package layering, it is possible to dynamically add more packages onto the system that are not part of the commit composed on the server. These additional "layered" packages are persistent across upgrades, rebases, and deploys. If a package you wish to layer conflicts with a package already in the atomic host image, a set of recently-added "override" commands can help resolve the conflict.

For instance, the "origin-clients" package can be used to quickly stand up an OpenShift Origin install using the command oc cluster up, but this package conflicts with the "kubernetes-client" package that comes baked into the CentOS Atomic Host image. You can use package layering to configure the repository containing the "origin-clients" rpm, to remove the conflicting kubernetes packages, and to install "origin-clients."

# rpm-ostree install centos-release-openshift-origin36
# rpm-ostree ex livefs
# rpm-ostree ex override remove kubernetes-client kubernetes-node
# rpm-ostree install origin-clients -r

Download CentOS Atomic Host

CentOS Atomic Host is available as a VirtualBox or libvirt-formatted Vagrant box, or as an installable ISO, qcow2 or Amazon Machine image. For links to media, see the CentOS wiki.

Upgrading

If you're running a previous version of CentOS Atomic Host, you can upgrade to the current image by running the following command:

# atomic host upgrade

Release Cycle

The CentOS Atomic Host image follows the upstream Red Hat Enterprise Linux Atomic Host cadence. After sources are released, they're rebuilt and included in new images. After the images are tested by the SIG and deemed ready, we announce them.

Getting Involved

CentOS Atomic Host is produced by the CentOS Atomic SIG, based on upstream work from Project Atomic. If you'd like to work on testing images, help with packaging, documentation -- join us!

The SIG meets every two weeks as part of the Project Atomic community meeting at 16:00 UTC on Monday in the #atomic channel. You'll often find us in #atomic and/or #centos-devel if you have questions. You can also join the atomic-devel mailing list if you'd like to discuss the direction of Project Atomic, its components, or have other questions.

Getting Help

If you run into any problems with the images or components, feel free to ask on the centos-devel mailing list.

Have questions about using Atomic? See the atomic mailing list or find us in the #atomic channel on Freenode.

November 01, 2017

Community contributed Kickstarts for CentOS Linux

November 01, 2017 12:25 PM

hi,

At https://github.com/CentOS/Community-Kickstarts we’ve been collecting community contributed kickstarts for various roles, deployments and versions. If you are writing and/or using kickstarts in your setup, it would be awesome to have them hosted here as well, please feel free to send PR’s. Just keep in mind a few basic things:

  • Kickstarts should end in .cfg or .ks
  • Generally should install from mirror.centos.org unless otherwise noted
  • If a hashed password is provided, include the plaintext version in a comment. Since these kickstarts are for example purposes, please use password or centos as the passwords as needed.
  • Kickstart names should provide a version and brief description, for example centos5-raid5.cfg or centos7-workstation.ks

Take a look at the README that has a few more pieces of info about this repository https://github.com/CentOS/Community-Kickstarts/blob/master/README.md

October 30, 2017

YUM 4 is available for testing

October 30, 2017 02:01 PM

I am pleased to announce that YUM 4, based on DNF technology, is available for testing on CentOS Linux 7/x86_64. Our limited testing indicates no major problems, but I would love to find out how it fits into your existing YUM 3 workflows. So please consider filling out the short survey - your feedback helps us all get better.

YUM 4 provides significant improvements such as fast dependency resolution and a stable, documented API. See the references below for detailed improvements. We have made every effort to preserve the existing end-user experience that is available with YUM 3. This is the primary reason for making YUM 4 available for testing now.

“So, what all has changed?”

The documentation does a great job explaining the differences in great detail. In short, your existing experience using yum to install, remove, and update are identical. However, there are changes such as some of the plugins and yum utilities are now consolidated into `dnf-plugins-core`. Some of the yum CLI options changed and are either converted for you automatically or silently ignored when that behavior is automatically included. Existing custom plugins written for YUM 3 will not work with YUM 4. Please reference the DNF API Reference and Changes in DNF hook API compared to YUM 3 links for further information.

“I found a bug, what should I do?”

Please report any found bugs on Red Hat Bugzilla against Fedora/dnf component (make sure to mention versions and that you use package from CentOS).

And remember to submit feedback in the short survey.

“Three step install, get started right away”

  1. # yum install centos-release-yum4
  2. # yum --enablerepo=centos-yum4-testing install yum4
  3. # yum4 --enablerepo=centos-yum4-testing install dnf-plugins-core

“I used DNF from EPEL, how do I move from it?”

Similar to clean installation: enable repository and update. YUM 4 is based on a newer version of DNF and should update properly.

  1. # yum install centos-release-yum4
  2. # yum --enablerepo=centos-yum4-testing update

NOTE: packages in testing repositories are not signed.

Many thanks to the CentOS Project team for their assistance in making this happen!

October 29, 2017

Updated CentOS Vagrant Images Available (v1710.01)

October 29, 2017 09:54 PM

We are pleased to announce new official Vagrant images of CentOS Linux 6.9 and CentOS Linux 7.4.1708 for x86_64 (based on the sources of RHEL 7.4). All included packages have been updated to 28 October 2017 and the centos/7 images no longer include the package documentation installed by default, reducing the image size by around 70MB (you can reinstall the packages whose documentation you need).

Known Issues

  1. The VirtualBox Guest Additions are not preinstalled; if you need them for shared folders, please install the vagrant-vbguest plugin and add the following line to your Vagrantfile:
    config.vm.synced_folder ".", "/vagrant", type: "virtualbox"

    We recommend using NFS instead of VirtualBox shared folders if possible; you can also use the vagrant-sshfs plugin, which, unlike NFS, works on all operating systems.

  2. Since the Guest Additions are missing, our images are preconfigured to use rsync for synced folders. Windows users can either use SMB for synced folders, or disable the sync directory by adding the line
    config.vm.synced_folder ".", "/vagrant", disabled: true

    to their Vagrantfile, to prevent errors on "vagrant up".

  3. Vagrant 1.8.5 is unable to create new CentOS Linux boxes due to Vagrant bug #7610
  4. Vagrant 1.8.7 is unable to download or update boxes due to Vagrant bug #7969.
  5. Vagrant 1.9.1 broke private networking, see Vagrant bug #8166
  6. Vagrant 1.9.3 doesn't work with SMB sync due to Vagrant bug #8404
  7. The vagrant-libvirt plugin is only compatible with Vagrant 1.5 to 1.8
  8. Installing open-vm-tools is not enough for enabling shared folders with Vagrant’s VMware provider. Please follow the detailed instructions in https://github.com/mvermaes/centos-vmware-tools (updated for this release).

Recommended Setup on the Host

Our automatic testing is running on a CentOS Linux 7 host, using Vagrant 1.9.4 with vagrant-libvirt and VirtualBox 5.1.20 (without the Guest Additions) as providers. We strongly recommend using the libvirt provider when stability is required.

We also performed additional manual testing with Vagrant 2.0.0 on OS X 10.11.6, with VirtualBox 5.1.30.

Downloads

The official images can be downloaded from Vagrant Cloud. We provide images for HyperV, libvirt-kvm, VirtualBox and VMware.

If you never used our images before:

vagrant box add centos/6 # for CentOS Linux 6, or...
vagrant box add centos/7 # for CentOS Linux 7

Existing users can upgrade their images:

vagrant box update --box centos/6
vagrant box update --box centos/7

Verifying the integrity of the images

The SHA256 checksums of the images are signed with the CentOS 7 Official Signing Key. First, download and verify the checksum file:

$ curl http://cloud.centos.org/centos/7/vagrant/x86_64/images/sha256sum.txt.asc -o sha256sum.txt.asc
$ gpg --verify sha256sum.txt.asc

If the check passed, you can use the corresponding checksum when downloading the image with Vagrant:

$ vagrant box add --checksum-type sha256 --checksum aabcfe77a08b72bacbd6f05e5f26b67983b29314ee0039d0db4c9b28b4909fcd --provider libvirt --box-version 1710.01 centos/7

Unfortunately, vagrant box update doesn't accept a --checksum argument. Since there's no binary diffing involved in updating (the download size is the same, whether you have a previous version of the box or not), you can first issue vagrant box remove centos/7 and then download the box as described above.

Feedback

If you encounter any unexpected issues with the Vagrant images, feel free to ask on the centos-devel mailing list, or via IRC, in #centos on Freenode.

Ackowledgements

We would like to warmly thank Fabian Arrotin and Thomas Oulevey for their work on the build infrastructure, as well as Patrick Lang from Microsoft for testing and feedback on the Hyper-V images.

We would also like to thank the following people (listed alphabetically):

  • Graham Mainwaring, for helping with tests and validations
  • Michael Vermaes, for testing our official images, as well as for writing the detailed guide to using them with VMware Fusion Pro and VMware Workstation Pro.

October 28, 2017

Feb 2, 2018: CentOS Dojo at FOSDEM

October 28, 2017 06:53 AM

Once again we'll be holding our annual CentOS Dojo in Brussels, the day before FOSDEM. The event will be held at the same venue as last year - at the Marriott Grand Place - and will run from 9am until 5pm. After 5, we'll join the traditional FOSDEM party at Delirium.

The CFP for this event is now open. Please submit proposals on any topic related to CentOS development or community. We particularly request talks on the following topics:

  • Progress of a particular CentOS SIG
  • Case study: Your infrastructure, powered by CentOS
  • CentOS on altarch
  • Cloud computing on CentOS
  • CentOS DevOps
  • CentOS Containers

You can also look at last year's schedule for inspiration.

We've extended the CFP deadline to December 1st in order to give you time to get your proposals in.

More details about the event will be posted in the wiki as they become available. Please contact Rich, or ask on the centos-devel mailing list, if you have any questions.

October 21, 2017

CentOS Dojo at CERN

October 21, 2017 01:45 PM

Yesterday we held our first - hopefully of many - dojo at CERN. We had around 70 people in attendance, representing many organizations and nations. And we had presentations from many different projects within the CentOS ecosystem.

If you're not familiar with CentOS Dojos, you can read more about them here: https://wiki.centos.org/Events/Dojo/

And if you're not familiar with CERN, you can read about it on Wikipedia, or on CERN's own website.

The dojo was in two parts.

On Thursday, a small group of CentOS SIG leaders and board members gathered to discuss plans for tackling some of the challenges in the CentOS project. You can read more about what was discussed on the centos-devel mailing list.

On Friday, we had the main event, with presentations from the CentOS board, SIG leaders, and organizations using CentOS. This included a presentation from CERN on their use of CentOS, Ceph, and OpenStack to process the data from the LHC - The Large Hadron Collider - as they analyze the nature of subatomic particles, and of the world.

We were very pleased with the day, and intend to do more event in the future, both at CERN, and at other organizations. If you're interested in hosting a dojo at your organization, get in touch with Rich Bowen to get started. Also, watch this site for a blog post about what's involved in running a dojo.

For more about what happened at the dojo, see Rich's blog posts. Also, watch this space for video and slides from the event.

 

October 12, 2017

Upcoming Dojo at CERN, FOSDEM

October 12, 2017 12:51 PM

Next week, we're holding a Dojo at CERN, in Meyrin, Switzerland. This will feature content from various of our Special Interest Groups (SIGs), and an overview of how CERN is using CentOS in their work to unravel the secrets of the universe.

We still have a little space, if you are interested in coming. You can find out more details about the event, and register, at http://cern.ch/centos

In the weeks following the event, video of the presentations, will be appearing here. Follow us on Twitter (@CentOSProject) to find out when they're posted.

Meanwhile, we're also planning a Dojo in Brussels, on the Friday before FOSDEM, as we've been doing this for a number of years now. The CFP is now open, if you're interested in presenting. We're looking for any talks about work that you're doing on CentOS, or anything that you're doing using CentOS. The CFP closes October 30th.

October 11, 2017

Four years later with CentOS and Red Hat

October 11, 2017 07:00 AM

After 4 years of being at Red Hat, I still occasionally get questions that show not everyone understands what Red Hat means to CentOS, or what CentOS provides to Red Hat. They tend to think in terms of competition, like there’s an either or choice. Reality just doesn’t bear that out.

First and foremost, CentOS is about integration, and its important to know who the community is. We’re your sysadmins and operations teams. We’re your SREs, the OPS in your devops. We’re a force multiplier to developers, the angry voice that says “stop disabling SELinux” and “show me your unit tests”. We’re the community voice encouraging you to do things the right way, rather than taking an easy shortcut we know from experience will come back to bite you.

What we’re not is developers. We may pull in kernel patches, but we’re not kernel developers. We can help you do the root cause analysis to figure out why your app is suddenly not performing, but we aren’t the ones to write the code to fix it. We don’t determine priority for what does or doesn’t get fixed, that’s what Red Hat does.

The core distribution of CentOS is and has always been based on code written by Red Hat. This doesn’t mean it’s a choice of “either CentOS or RHEL,” because we’re in this together. CentOS provides Red Hat a community platform for building and testing things like OpenStack with RDO. We build new ecosystems around ARM servers. We provide a base layer for others to innovate around emerging technologies like NFV. But none of this would be possible without the work of RH’s engineering teams.

The community can build, organize and deliver tools in any number of creative ways, but ultimately the code behind them is being developed by engineers paid to address the needs of Red Hat’s customers. You can bet that RH is keeping an eye on what the CentOS community is using and building, but that doesn’t necessarily translate to business need.

We’re here to empower operators who want to experiment on top of the enterprise base lifespan. We’re here to bring tools and technology to those for whom it may be otherwise be out of reach. We’re here to take use cases and lessons learned from the community back to Red Hat as advocates. We’re happy to serve both audiences in this capacity, but let’s not forget how we buy the ‘free as in beer’.

After 4 years of being at Red Hat, I still occasionally get questions that show not everyone understands what Red Hat means to CentOS, or what CentOS provides to Red Hat. They tend to think in terms of competition, like there’s an either or choice. Reality just doesn’t bear that out.

October 10, 2017

Using Ansible Openstack modules on CentOS 7

October 10, 2017 10:00 PM

Suppose that you have a RDO/Openstack cloud already in place, but that you'd want to automate some operations : what can you do ? On my side, I already mentioned that I used puppet to deploy initial clouds, but I still prefer Ansible myself when having to launch ad-hoc tasks, or even change configuration[s]. It's particulary true for our CI environment where we run "agentless" so all configuration changes happen through Ansible.

The good news is that Ansible has already some modules for Openstack but it has some requirements and a little bit of understanding before being able to use those.

First of all, all the ansible os_ modules need "shade" on the host included in the play, and that will be responsible of all os_ modules launch. At the time of writing this post, it's not yet available on mirror.centos.org, (a review is open so that will be soon available directly) but you can find the pkg on our CBS builders

Once installed, a simple os_image task was directly failing, despite the fact that auth: was present, and that's due to a simple reason : Ansible os_ modules still want to use v2 API, while it's now defaulting to v3 in Pike release. There is no way to force ansible itself to use v3, but as it uses shade behind the scene, there is a way to force this through os-client-config

That means that you just have to use a .yaml file (does that sound familiar for ansible ?) that will contain everything you need to know about specific cloud, and then just in ansible declare which cloud you're configuring.

That clouds.yaml file can be under $current_directory, ~/.config/openstack or /etc/openstack so it's up to you to decide where you want to temporary host it, but I selected /etc/openstack/ :

- name: Ensuring we have required pkgs for ansible/openstack
  yum:
    name: python2-shade
    state: installed

- name: Ensuring local directory to hold the os-client-config file
  file:
    path: /etc/openstack
    state: directory
    owner: root
    group: root

- name: Adding clouds.yaml for os-client-config for further actions
  template:
    src: clouds.yaml.j2
    dest: /etc/openstack/clouds.yaml
    owner: root
    group: root
    mode: 0700

Of course such clouds.yaml file is itself a jinja2 template distributed by ansible on the host in the play before using the os_* modules :

clouds:
  {{ cloud_name }}:
    auth:
      username: admin
      project_name: admin
      password: {{ openstack_admin_pass }}
      auth_url: http://{{ openstack_controller }}:5000/v3/
      user_domain_name: default
      project_domain_name: default
    identity_api_version: 3

You just have to adapt to your needs (see doc for this) but the interesting part is the identity_api_version to force v3.

Then, you can use all that in a simple way through ansible tasks, in this case adding users to a project :

- name: Configuring OpenStack user[s]
  os_user:
    cloud: "{{ cloud_name }}"
    default_project: "{{ item.0.name }}"
    domain: "{{ item.0.domain_id }}"
    name: "{{ item.1.login }}"
    email: "{{ item.1.email }}"
    password: "{{ item.1.password }}"           
  with_subelements:
    - "{{ cloud_projects }}"
    - users  
  no_log: True

From a variables point of view, I decided to just have a simple structure to host project/users/roles/quotas like this :

cloud_projects:
  - name: demo
    description: demo project
    domain_id: default
    quota_cores: 20
    quota_instances: 10
    quota_ram: 40960
    users:
      - login: demo_user
        email: demo@centos.org
        password: Ch@ngeM3
        role: admin # can be _member_ or admin
      - login: demo_user2
        email: demo2@centos.org
        password: Ch@ngeMe2

Now that it works, you can explore all the other os_* modules and I'm already using those to :

  • Import cloud images in glance
  • Create networks and subnets in neutron
  • Create projects/users/roles in keystone
  • Change quotas for those projects

I'm just discovering how powerful those tools are, so I'll probably discover much more interesting things to do with those later.

September 28, 2017

Using CentOS 7 armhfp VM on CentOS 7 aarch64

September 28, 2017 10:00 PM

Recently we got our hands on some aarch64 (aka ARMv8 / 64Bits) nodes running in a remote DC. On my (already too long) TODO/TOTEST list I had the idea of testing armhfp VM on top of aarch64. Reason is that when I need to test our packages, using my own Cubietruck or RaspberryPi3 is time consuming : removing the sdcard, reflashing with the correct CentOS 7 image and booting/testing the pkg/update/etc ...

So is that possible to just automate this through available aarch64 node as hypervisor ? Sure ! and it's just pretty straightforward if you have already played with libvirt. Let's so start with a CentOS 7 aarch64 minimal setup and then :

yum install qemu-kvm-tools qemu-kvm virt-install libvirt libvirt-python libguestfs-tools-c
systemctl enable libvirtd --now

That's pretty basic but for armhfp we'll have to do some extra steps : qemu normally tries to simulate a bios/uefi boot, which armhfp doesn't support, and qemu doesn't emulate the mandatory uboot to just chainload to the RootFS from the guest VM.

So here is just what we need :

  • Import the RootFS from an existing image
curl http://mirror.centos.org/altarch/7/isos/armhfp/CentOS-Userland-7-armv7hl-Minimal-1708-CubieTruck.img.xz|unxz >/var/lib/libvirt/images/CentOS-Userland-7-armv7hl-Minimal-1708-CubieTruck.img
  • Convert image to qcow2 (that will give us more flexibility) and extend it a little bit
qemu-img convert -f raw -O qcow2 /var/lib/libvirt/images/CentOS-Userland-7-armv7hl-Minimal-1708-CubieTruck.img /var/lib/libvirt/images/CentOS-Userland-7-armv7hl-Minimal-1708-guest.qcow2
qemu-img resize /var/lib/libvirt/images/CentOS-Userland-7-armv7hl-Minimal-1708-guest.qcow2 +15G
  • Extract kernel+initrd as libvirt will boot that directly for the VM
mkdir /var/lib/libvirt/armhfp-boot
virt-copy-out -a /var/lib/libvirt/images/CentOS-Userland-7-armv7hl-Minimal-1708-guest.qcow2 /boot/ /var/lib/libvirt/armhfp-boot/

So now that we have a RootFS, and also kernel/initrd, we can just use virt-install to create the VM (pointing to existing backend qcow2) :

virt-install \
 --name centos7_armhfp \
 --memory 4096 \
 --boot kernel=/var/lib/libvirt/armhfp-boot/boot/vmlinuz-4.9.40-203.el7.armv7hl,initrd=/var/lib/libvirt/armhfp-boot/boot/initramfs-4.9.40-203.el7.armv7hl.img,kernel_args="console=ttyAMA0 rw root=/dev/sda3" \
 --disk /var/lib/libvirt/images/CentOS-Userland-7-armv7hl-Minimal-1708-guest.qcow2 \
 --import \
 --arch armv7l \
 --machine virt \

And here we go : we have a armhfp VM that boots really fast (compared to a armhfp board using a microsd card of course)

At this stage, you can configure the node, etc.. The only thing you have to remember is that of course kernel will be provided from outside the VM, so just extract it from an updated VM to boot on that kernel. Let's show how to do that, as in the above example, we configured the VM to run with 4Gb of ram, but only 3 are really seen inside (remember the 32bits mode and so the need for PAE on i386 ?)

So let's use this example to show how to switch kernel : From the armhfp VM :

# Let extend first as we have bigger disk
growpart /dev/sda 3
resize2fs /dev/sda3
yum update -y
yum install kernel-lpae
systemctl poweroff # we'll modify libvirt conf file for new kernel

Back to the hypervisor we can again extract needed files :

virt-copy-out -a /var/lib/libvirt/images/CentOS-Userland-7-armv7hl-Minimal-1708-guest.qcow2 /boot/vmlinuz-4.9.50-203.el7.armv7hl+lpae /var/lib/libvirt/armhfp-boot/boot/
virt-copy-out -a /var/lib/libvirt/images/CentOS-Userland-7-armv7hl-Minimal-1708-guest.qcow2 /boot/initramfs-4.9.50-203.el7.armv7hl+lpae.img /var/lib/libvirt/armhfp-boot/boot/

And just virsh edit centos7_armhfp so that kernel and armhfp are pointing to correct location:

<kernel>/var/lib/libvirt/armhfp-boot/boot/vmlinuz-4.9.50-203.el7.armv7hl+lpae</kernel>
<initrd>/var/lib/libvirt/armhfp-boot/boot/initramfs-4.9.50-203.el7.armv7hl+lpae.img</initrd>

Now that we have a "gold" image, we can even use exiting tools to provision quickly other nodes on that hypervisor ! :

time virt-clone --original centos7_armhfp --name armhfp_guest1 --file /var/lib/libvirt/images/armhfp_guest1.qcow2
Allocating 'armhfp_guest1.qcow2'                                               |  18 GB  00:00:02     

Clone 'armhfp_guest1' created successfully.

real    0m2.809s
user    0m0.473s
sys 0m0.062s

time virt-sysprep --add /var/lib/libvirt/images/armhfp_guest1.qcow2 --operations defaults,net-hwaddr,machine-id,net-hostname,ssh-hostkeys,udev-persistent-net --hostname guest1

virsh start armhfp_guest1

As simple as that. Of course, in the previous example we were just using the default network from libvirt, and not any bridge, but you get the idea : all the rest with well-known concept for libvirt on linux.

September 26, 2017

Status update for CentOS Container Pipeline

September 26, 2017 10:12 AM

The goal of CentOS Container Pipeline project is to let any open-source project build container images on the CentOS Linux and additionally provide them with:

  • Dockerfile lint report
  • Container scanner reports that:
    • Scan the image for RPM updates
    • Scan the image’s RUN label for capabilities that resulting container might have when started
    • Scan the image to verify installed RPM packages
    • Scan the image for possible updates to third party packages installed via npm, pip or gem
  • Cause of build whenever an image is built/rebuilt.

In this article we’d like to summarize the features provided by the Pipeline and current state of the project. To get an idea of container images already available via registry.centos.org, please check the wiki page of Container Pipeline.

How does the CentOS Container Pipeline work?

Let’s say you have an open-source project that you’d like to containerize on CentOS platform. The source code is hosted on one of the various web-based Git version control repositories like GitHub, Bitbucket, GitLab, etc accessible over the Internet. You have a Dockerfile that uses CentOS base image to build the container (we can help you here if your existing Dockerfile is based on Alpine, Debian, Ubuntu, etc.)

Now all you need to do is create cccp.yml file in the repo at same location as your Dockerfile and open a pull request on CentOS/container-index repository to get started (more on the yaml file and how to open PR later in the post.) The generated container image can then be pulled via:

$ docker pull registry.centos.org/<app-id>/<job-id>:<desired_tag>

The cccp.yml or cccp.yaml, that’s required in your Git repository, must contain value for job-id at the very least. This is generally the name of the image like httpd for an Apache web server image or nginx for an NGINX image, so on and so forth.

 

For the pull request to be opened on CentOS/container-index, you’ll need to:

  • Fork the repository under your GitHub username
  • Clone it onto your system
  • Add a yml entry under `index.d` directory. Name of this yml file is recommended to be same as appid that you want in the aforementioned `docker pull` command.
  • Contents of this yaml file should be like the example below:
    Projects
        - id: 1
          app-id: centos
          job-id: centos
          git-url: https://github.com/CentOS/sig-cloud-instance-images
          git-branch: CentOS-7
          git-path: docker
          target-file: Dockerfile
          desired-tag: latest
          notify-email: you@example.com
          depends-on: null

    id should be an integer and shouldn’t repeat in the yml file.
    app-id is the namespace of your container images. This should be same as filename
    job-id is the name you want for your container image
    git-url is the complete URL to your Git repo
    git-branch is the branch within your repo. Default is `master`
    target-file is the name of Dockerfile to be used to build container image
    desired-tag is the tag you’d like to apply to resulting container image
    notify-email is the email address you’d like to be notified upon
    depends-on is the container image that your resulting image is dependent on. Generally the one used in FROM statement in Dockerfile. Image mentioned here must exist in the container-index.

    For more info on the yml file, we recommend you refer its dedicated section in README. For more examples on writing the yml file, we recommend you refer the index.d directory which contains yml files for various open-source projects as well as individual users.

Once the pull request is merged, Container Pipeline Service hosted on CentOS infrastructure picks it up and lints the Dockerfile, builds the container image, tests it, scans it using various atomic scanners and sends the result of these processes to email address you mentioned as `notify-email`. If it detects any issue at any of the above stages, it’ll stop right there and send you an email along with logs.

Once the image is built for the first time, every time you push a change to the Git repository’s (`git-url` variable) branch being tracked via the container-index (`git-branch` variable), a new image is built and lint-build-test-scan processes are re-executed. This provides the developer with a feedback on the changes (s)he pushed.

Weekly image scanning, RPM tracking and parent image update

Besides the one-time image scanning that happens when the image is built for the first time, CentOS Container Pipeline service does a weekly scanning and sends the results to the developer. This email only contains the information generated by the atomic scanners, albeit from a fresh run.

The Pipeline service also tracks the RPM repositories enabled in the container image. It checks these repositories once everyday to find if there’s any update available from any of the repos. If it finds an update, the container images which have those repositories enabled, will be re-built and re-scanned.

If the parent image of the project (`depends-on` variable) is updated, the child image automatically gets re-built and re-scanned.

Work in Progress features

Besides the features mentioned above, we are working on providing the ability to build images for aarch64 architecture.

We are also working on saving data-points that will store state of the Pipeline to database and help us churn useful metrics out of it. One thing where we'll be able to use it is to generate a real-time view of the build process.

Feature to let user know what is the current status of their build.

We are working on providing a brief summary of errors/warnings that scanners found in the container image.

Known issues

There are a few issues we’re working on right now and hope to get them fixed soon

  • Monitoring the overall service is in its nascent stages and we need to improve it to know of an issue before the users point them towards it. We use Sentry for monitoring the Pipeline service
  • Although we have a UI for the registry at https://registry.centos.org/, we need to tweak it to be more useful for the end-user to:
    • Have a quick look at the Dockerfile used to build the image
    • Access the logs for historic builds
  • RPM tracking issues wherein a project removed/updated from CentOS/container-index doesn’t get deleted/modified in the underlying database and hence triggers rebuild for incorrect image when it finds any of the various enabled repositories updated.

Have questions or suggestions?

We are always looking forward to community participation and community feedback. The project is open-source from day one. If you have any queries around how to get started or, why certain things works in certain way or, you would like to see a feature or, anything else, feel free to ping us on #centos-devel IRC channel on Freenode network.

Dharmit Shah ( dharmit on irc )

September 20, 2017

New CentOS Atomic Host with OverlayFS Storage

September 20, 2017 10:26 PM

The CentOS Atomic SIG has released an updated version of CentOS Atomic Host (7.1708), a lean operating system designed to run Docker containers, built from standard CentOS 7 RPMs, and tracking the component versions included in Red Hat Enterprise Linux Atomic Host.

This release, which is based on the RHEL 7.4 source code, includes an updated kernel that supports overlayfs container storage, among other enhancements.

CentOS Atomic Host includes these core component versions:

  • atomic-1.18.1-3.1.git0705b1b.el7.x86_64
  • cloud-init-0.7.9-9.el7.centos.2.x86_64
  • docker-1.12.6-48.git0fdc778.el7.centos.x86_64
  • etcd-3.1.9-2.el7.x86_64
  • flannel-0.7.1-2.el7.x86_64
  • kernel-3.10.0-693.2.2.el7.x86_64
  • kubernetes-node-1.5.2-0.7.git269f928.el7.x86_64
  • ostree-2017.7-1.el7.x86_64
  • rpm-ostree-client-2017.6-6.atomic.el7.x86_64

OverlayFS Storage

In previous releases of CentOS Atomic Host, SELinux had to be in permissive or disabled mode for OverlayFS storage to work. Now you can run the OverlayFS file system with SELinux in enforcing mode. CentOS Atomic Host still defaults to devicemapper storage, but you can switch to OverlayFS using the following commands:

$ systemctl stop docker
$ atomic storage reset
  # Reallocate space to the root VG - tweak how much to your liking
$ lvm lvextend -r -l +50%FREE atomicos/root
$ atomic storage modify --driver overlay2
$ systemctl start docker

For more information on storage management options, see the upstream RHEL documentation.

Containerized Master

CentOS Atomic Host ships without the kubernetes-master package built into the image. For information on how to run these kubernetes components as system containers, consult the CentOS wiki.

If you prefer to run Kubernetes from installed rpms, you can layer the master components onto your Atomic Host image using rpm-ostree package layering with the command: atomic host install kubernetes-master -r.

Download CentOS Atomic Host

CentOS Atomic Host is available as a VirtualBox or libvirt-formatted Vagrant box, or as an installable ISO, qcow2 or Amazon Machine image. For links to media, see the CentOS wiki.

Upgrading

If you're running a previous version of CentOS Atomic Host, you can upgrade to the current image by running the following command:

$ sudo atomic host upgrade

Release Cycle

The CentOS Atomic Host image follows the upstream Red Hat Enterprise Linux Atomic Host cadence. After sources are released, they're rebuilt and included in new images. After the images are tested by the SIG and deemed ready, we announce them.

Getting Involved

CentOS Atomic Host is produced by the CentOS Atomic SIG, based on upstream work from Project Atomic. If you'd like to work on testing images, help with packaging, documentation -- join us!

The SIG meets every two weeks on Tuesday at 04:00 UTC in #centos-devel, and on the alternating weeks, meets as part of the Project Atomic community meeting at 16:00 UTC on Monday in the #atomic channel. You'll often find us in #atomic and/or #centos-devel if you have questions. You can also join the atomic-devel mailing list if you'd like to discuss the direction of Project Atomic, its components, or have other questions.

Getting Help

If you run into any problems with the images or components, feel free to ask on the centos-devel mailing list.

Have questions about using Atomic? See the atomic mailing list or find us in the #atomic channel on Freenode.

Boosting CentOS server performance

September 20, 2017 07:00 AM

Last week I spent entirely too much time trying to track down a performance issue for the AArch64/ARM64 build of CentOS. While we don’t and won’t do performance comparisons or optimizations, this was fully in the realm of “something’s wrong here”. After a bit of digging, this issued turns out to impact just about everyone running CentOS on their servers who isn’t doing custom performance tuning.

The fix

I know most people who found this don’t care about the details, so we’ll get right to the good stuff. Check your active tuned profile. If your output looks like the example below, you probably want to change it.

[root@centos ~]# tuned-adm active
Current active profile: balanced

The ‘balanced’ profile means the CPU governor is set to powersave, which won’t do your server any favors. You can validate this by running cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor. To fix it, run the command below:

[root@centos ~]# tuned-adm profile throughput-performance

That’s it. This changes the governor to performance which should give you a pretty decent performance bump without any additional changes, and across all hardware platforms.If you’re interested in figuring out why the default setting is set this way, I’ll explain.

Why the default is “wrong”

The tuned package is installed and enabled by default. When it runs for the first time, it tries to automatically select the best performance profile for the system by running a couple of comparisons. It does this by checking virt-what output, and using the contents of /etc/system-release-cpe. The tuned file /usr/lib/tuned/recommend.conf is then used as the rulebook to see what matches and what doesn’t.

This starts to unravel a bit with CentOS, because the packages are derived from RHEL(Red Hat Enterprise Linux), and while RHEL may differentiate between server, workstation, etc CentOS does not. If you look carefully at the recommends.conf check for the throughput-performance profile, you’ll see that they check to see if the strings computenode or server exist in /etc/system-release-cpe. On CentOS, neither one does, because the distribution doesn’t make that distinction. Because these strings aren’t found, the fallback option of balanced is chosen.

Last week I spent entirely too much time trying to track down a performance issue for the AArch64/ARM64 build of CentOS. While we don’t and won’t do performance comparisons or optimizations, this was fully in the realm of “something’s wrong here”. After a bit of digging, this issued turns out to impact just about everyone running CentOS on their servers who isn’t doing custom performance tuning.

September 13, 2017

Updated CentOS Vagrant Images Available (v1708.01)

September 13, 2017 08:12 PM

We are pleased to announce new official Vagrant images of CentOS Linux 6.9 and CentOS Linux 7.4.1708 for x86_64 (based on the sources of RHEL 7.4). All included packages have been updated to 12 September 2017.

Known Issues

  1. The VirtualBox Guest Additions are not preinstalled; if you need them for shared folders, please install the vagrant-vbguest plugin and add the following line to your Vagrantfile:
    config.vm.synced_folder ".", "/vagrant", type: "virtualbox"

    We recommend using NFS instead of VirtualBox shared folders if possible; you can also use the vagrant-sshfs plugin, which, unlike NFS, works on all operating systems.

  2. Since the Guest Additions are missing, our images are preconfigured to use rsync for synced folders. Windows users can either use SMB for synced folders, or disable the sync directory by adding the line
    config.vm.synced_folder ".", "/vagrant", disabled: true

    to their Vagrantfile, to prevent errors on "vagrant up".

  3. Vagrant 1.8.5 is unable to create new CentOS Linux boxes due to Vagrant bug #7610
  4. Vagrant 1.8.7 is unable to download or update boxes due to Vagrant bug #7969.
  5. Vagrant 1.9.1 broke private networking, see Vagrant bug #8166
  6. Vagrant 1.9.3 doesn't work with SMB sync due to Vagrant bug #8404
  7. The vagrant-libvirt plugin is only compatible with Vagrant 1.5 to 1.8
  8. Installing open-vm-tools is not enough for enabling shared folders with Vagrant’s VMware provider. Please follow the detailed instructions in https://github.com/mvermaes/centos-vmware-tools (updated for this release).

Recommended Setup on the Host

Our automatic testing is running on a CentOS Linux 7 host, using Vagrant 1.9.4 with vagrant-libvirt and VirtualBox 5.1.20 (without the Guest Additions) as providers. We strongly recommend using the libvirt provider when stability is required.

We also performed additional manual testing with Vagrant 2.0.0 on OS X 10.11.6, with VirtualBox 5.1.26.

Downloads

The official images can be downloaded from Vagrant Cloud. We provide images for HyperV, libvirt-kvm, VirtualBox and VMware.

If you never used our images before:

vagrant box add centos/6 # for CentOS Linux 6, or...
vagrant box add centos/7 # for CentOS Linux 7

Existing users can upgrade their images:

vagrant box update --box centos/6
vagrant box update --box centos/7

Verifying the integrity of the images

The SHA256 checksums of the images are signed with the CentOS 7 Official Signing Key. First, download and verify the checksum file:

$ curl http://cloud.centos.org/centos/7/vagrant/x86_64/images/sha256sum.txt.asc -o sha256sum.txt.asc
$ gpg --verify sha256sum.txt.asc

If the check passed, you can use the corresponding checksum when downloading the image with Vagrant:

$ vagrant box add --checksum-type sha256 --checksum aabcfe77a08b72bacbd6f05e5f26b67983b29314ee0039d0db4c9b28b4909fcd --provider libvirt --box-version 1705.01 centos/7

Unfortunately, vagrant box update doesn't accept a --checksum argument. Since there's no binary diffing involved in updating (the download size is the same, whether you have a previous version of the box or not), you can first issue vagrant box remove centos/7 and then download the box as described above.

Feedback

If you encounter any unexpected issues with the Vagrant images, feel free to ask on the centos-devel mailing list, or via IRC, in #centos on Freenode.

Ackowledgements

We would like to warmly thank Fabian Arrotin and Thomas Oulevey for their work on the build infrastructure, as well as Patrick Lang from Microsoft for testing and feedback on the Hyper-V images.

We would also like to thank the following people (listed alphabetically):

  • Graham Mainwaring, for helping with tests and validations
  • Michael Vermaes, for testing our official images, as well as for writing the detailed guide to using them with VMware Fusion Pro and VMware Workstation Pro.

September 02, 2017

Battery and power status on your CentOS Linux laptop

September 02, 2017 07:06 PM

The upower cli tool will get you a ton of great info for the battery ( and other things related to power ). Make sure you have it installed ( rpm -q upower ), and give it a shot like this :

$ upower -i /org/freedesktop/UPower/devices/battery_BAT0
  native-path:          BAT0
  vendor:               SMP
  model:                45N1703
  serial:               5616
  power supply:         yes
  updated:              Sat 02 Sep 2017 19:43:02 BST (39 seconds ago)
  has history:          yes
  has statistics:       yes
  battery
    present:             yes
    rechargeable:        yes
    state:               fully-charged
    warning-level:       none
    energy:              21.84 Wh
    energy-empty:        0 Wh
    energy-full:         21.9 Wh
    energy-full-design:  45.02 Wh
    energy-rate:         0.00219125 W
    voltage:             16.237 V
    percentage:          99%
    capacity:            48.645%
    technology:          lithium-polymer
    icon-name:          'battery-full-charged-symbolic'

As you can see after ~ 3 years of extensive use, I should really look for a replacement battery for this laptop, at 48% capacity, its not really doing very well.

To enumerate device paths, use the -e flag like this :

$ upower -e 
/org/freedesktop/UPower/devices/line_power_AC
/org/freedesktop/UPower/devices/battery_BAT0
/org/freedesktop/UPower/devices/keyboard_0003o046DoC52Bx0004
/org/freedesktop/UPower/devices/mouse_0003o046DoC52Bx0005
/org/freedesktop/UPower/devices/DisplayDevice

Now we can check how that external keyboards battery’s is doing

  native-path:          /sys/devices/pci0000:00/0000:00:14.0/usb2/2-1/2-1:1.2/0003:046D:C52B.0003/0003:046D:C52B.0004
  vendor:               Logitech, Inc.
  model:                K750
  serial:               D9ED612B
  power supply:         no
  updated:              Sat 02 Sep 2017 19:59:15 BST (29 seconds ago)
  has history:          yes
  has statistics:       no
  keyboard
    present:             yes
    rechargeable:        yes
    state:               discharging
    warning-level:       none
    luminosity:          80 lx
    percentage:          55%
    icon-name:          'battery-good-symbolic'
  History (charge):
    1504378755	55.000	discharging


Clearly the light in this room, right now, isnt bright enough to be charging the keyboard via its solar cells. Might leave it closer to the window tomorrow.

As you can see from the enumerated list, there is line_power_AC as well as the mouse ( which is actually a trackpad I used ). And if you are so inclined ( I wasent, but just did this for all my laptops.. ) you can track this info and graph it, push it to your monitoring service etc.

from the readme file:
UPower is an abstraction for enumerating power devices,
listening to device events and querying history and statistics.
Any application or service on the system can access the
org.freedesktop.UPower service via the system message bus.

Give it a shot.

August 31, 2017

Come help build duffy2 for CiCo

August 31, 2017 10:36 AM

When I came onboard with Red Hat, one of the key impacts that I wanted to be able to use Red Hat resources for was to help the wider opensource community write, manage and deliver better code. It was with that goal that I conceptualised, bootstrapped, argued for and then got the https://ci.centos.org/ project started up. Using well established industry standards ( Jenkins ! ) I was able to rapidly build out the provising infra around it, with copious amounts of Fabian’s help. My focus, at the time, was that it should be simple enough to just-work, but capable enough to keep working. There were many hacks involved, making it impossible to really adapt and grow outside of the service.

100’s of thousands of CI jobs later, I think we can call that bootstrap a success.

Today, as we move forward to adding more machine types, extending support for what we have – It gives me great pleasure to start talking about how the pieces come together, and how the service backend works – and open the entire stack up for folks to come help us get better, faster, better-tested and deliver duffy as a running service built on modern service development methodologies.

Come join me at https://github.com/kbsingh/duffy2 as we bootstrap the next instance of this service. Everyone’s welcome!

I also want to remind people that https://ci.centos.org is open to any open source project that can benefit from it ( including the access to bare metal hosts on demand ).

regards,

Git 2 on CentOS Linux 7

August 31, 2017 12:56 AM

The distro shipped git is still at version 1.8, but if you need or want a newer git version there are a few options. The CentOS SCL SIG {https://wiki.centos.org/SpecialInterestGroup/SCLo} publishes a git212 collection that hosts git version 2.12.2 ( at the moment, it will get updates as updates become avaialble ). There is a collection for git 2.5 as well ( Called sclo-git25 ), should you want that version.

In order to get setup, first get the centos-release-scl package on the machine, that will setup the scl yum repo’s and the sig’s RPM Signing key.
yum install centos-release-scl

With that in place, you should be able to check what scl collections are available for git with a yum command like this :
yum list sclo-git\*

And then install the version you want with :
yum install sclo-git212.x86_64

Once that completes, you can check that the scl is installed and working with something like this :
$ scl enable sclo-git212 /bin/bash
$ git --version
git version 2.12.2

This is good, but I find it a pain to need to enable scl’s all the time, so I use a line in my bashrc like this :
source scl_source enable sclo-git212

With that in place, every shell now has git version 2. And any other apps you run, in the shell would have this ver of git as well.


Powered by Planet!
Last updated: February 20, 2018 09:00 AM