Skip to content

Commit 3d916a0

Browse files
richbibbyrichbibby
authored
Merge pull request #119 from netboxlabs/rhel-additions
RHEL instructions
2 parents 4a87b19 + 5edb7f3 commit 3d916a0

File tree

3 files changed

+239
-5
lines changed

3 files changed

+239
-5
lines changed

‎docs/netbox-enterprise/nbe-ec-requirements-rhel.md

+223
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,223 @@
1+
# NetBox Enterprise Requirements for Red Hat Enterprise Linux (RHEL)
2+
3+
## Tested Versions
4+
5+
This guide was used on fresh installs of the following versions of RHEL:
6+
7+
- RHEL 9
8+
- RHEL 9.5
9+
10+
## Steps to prepare RHEL
11+
12+
### Disable Swap
13+
14+
Swap can lead to unpredictable memory behavior in Kubernetes.
15+
16+
```bash
17+
sudo swapoff -a
18+
sudo sed -i '/ swap / s/^\(.*\)$/#\1/g' /etc/fstab
19+
```
20+
21+
### Set SELinux to Permissibe mode (can be enforced later)
22+
23+
```bash
24+
sudo setenforce Permissive
25+
sudo sed -i --follow-symlinks 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/sysconfig/selinux
26+
```
27+
28+
### Configure Firewall
29+
30+
If firewalld isn't installed
31+
32+
```bash
33+
sudo dnf -y install dnf-plugins-core
34+
sudo dnf -y install firewalld
35+
sudo systemctl enable --now firewalld
36+
```
37+
38+
Open required ports for the internal kubernetes platform.
39+
40+
```bash
41+
# Kubernetes API, etcd, and control plane components
42+
sudo firewall-cmd --permanent --add-port={6443,2379,2380,10250,10251,10252,10255,5473,10257,10259}/tcp
43+
44+
# NodePort range
45+
sudo firewall-cmd --permanent --add-port=30000-32767/tcp
46+
47+
# BGP and VXLAN (optional, for Calico)
48+
sudo firewall-cmd --permanent --add-port=4789/udp
49+
sudo firewall-cmd --permanent --add-port=179/tcp
50+
51+
# Reload firewall
52+
sudo firewall-cmd --reload
53+
```
54+
55+
### Configure Kernel Modules and Parameters
56+
57+
Install kernel headers:
58+
59+
```bash
60+
sudo dnf -y install kernel-devel-$(uname -r)
61+
```
62+
63+
Load and persist modules:
64+
65+
```bash
66+
sudo modprobe br_netfilter ip_vs ip_vs_rr ip_vs_wrr ip_vs_sh overlay
67+
68+
cat <<EOF | sudo tee /etc/modules-load.d/kubernetes.conf
69+
br_netfilter
70+
ip_vs
71+
ip_vs_rr
72+
ip_vs_wrr
73+
ip_vs_sh
74+
overlay
75+
EOF
76+
77+
sudo sysctl --system
78+
```
79+
80+
### Install containerd (optional runtime)
81+
82+
```bash
83+
sudo dnf config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo
84+
sudo dnf makecache
85+
sudo dnf install containerd.io -y
86+
87+
sudo mkdir -p /etc/containerd
88+
containerd config default | sudo tee /etc/containerd/config.toml
89+
90+
sudo sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
91+
92+
sudo systemctl enable --now containerd
93+
```
94+
95+
### Reboot
96+
97+
Reboot to apply changes
98+
99+
```bash
100+
sudo reboot now
101+
```
102+
103+
### Install NetBox Enterprise
104+
105+
Run through the regular installation [here](nbe-ec-installation.md).
106+
107+
## Optional - Enable SELinux Enforcing
108+
109+
### Install SELinux Tools
110+
111+
```bash
112+
sudo dnf -y inst
113+
all setroubleshoot-server setools mcstrans
114+
```
115+
116+
### Run the suggestions from [the enterprise install for SELinux](./nbe-ec-requirements.md#selinux)
117+
118+
```bash
119+
export EC_DIR="/var/lib/embedded-cluster"
120+
export KUBE_DIR="${EC_DIR}/k0s"
121+
122+
# tell SELinux the Cluster directory is owned by Containerd
123+
sudo semanage fcontext -a -t container_var_lib_t "${EC_DIR}"
124+
sudo restorecon -R -v "${EC_DIR}"
125+
126+
# additionally, binaries should be allowed to execute
127+
sudo semanage fcontext -a -t container_runtime_exec_t "${KUBE_DIR}/bin/containerd.*"
128+
sudo semanage fcontext -a -t container_runtime_exec_t "${KUBE_DIR}/bin/runc"
129+
sudo restorecon -R -v "${KUBE_DIR}/bin"
130+
131+
# fix permissions for containerd and restrict some folders to read-only
132+
sudo semanage fcontext -a -t container_var_lib_t "${KUBE_DIR}/containerd(/.*)?"
133+
sudo semanage fcontext -a -t container_ro_file_t "${KUBE_DIR}/containerd/io.containerd.snapshotter.*/snapshots(/.*)?"
134+
sudo restorecon -R -v ${KUBE_DIR}/containerd
135+
```
136+
137+
### Check for errors
138+
139+
Run sealert to look for issues
140+
141+
```bash
142+
sealert -a /var/log/audit/audit.log
143+
```
144+
145+
Look for messages like this and run the command suggested based on confidence
146+
147+
!!! note
148+
It is important you understand these before enabling and that you can possible be creating security risks if you do not understand what you're enabling.
149+
150+
```log
151+
SELinux is preventing /usr/sbin/setfiles from 'read, append' accesses on the file /var/lib/embedded-cluster/tmp/tmph3gb9qv1.
152+
***** Plugin leaks (86.2 confidence) suggests *****************************
153+
If you want to ignore setfiles trying to read append access the tmph3gb9qv1 file, because you believe it should not need this access.
154+
Then you should report this as a bug.
155+
You can generate a local policy module to dontaudit this access.
156+
Do
157+
# ausearch -x /usr/sbin/setfiles --raw | audit2allow -D -M my-setfiles
158+
# semodule -X 300 -i my-setfiles.pp
159+
***** Plugin catchall (14.7 confidence) suggests **************************
160+
If you believe that setfiles should be allowed read append access on the tmph3gb9qv1 file by default.
161+
Then you should report this as a bug.
162+
You can generate a local policy module to allow this access.
163+
Do
164+
allow this access for now by executing:
165+
# ausearch -c 'setfiles' --raw | audit2allow -M my-setfiles
166+
# semodule -X 300 -i my-setfiles.pp
167+
Additional Information:
168+
Source Context unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c102
169+
3
170+
Target Context unconfined_u:object_r:var_lib_t:s0
171+
Target Objects /var/lib/embedded-cluster/tmp/tmph3gb9qv1 [ file ]
172+
Source setfiles
173+
Source Path /usr/sbin/setfiles
174+
Port <Unknown>
175+
Host <Unknown>
176+
Source RPM Packages policycoreutils-3.6-2.1.el9.x86_64
177+
Target RPM Packages
178+
SELinux Policy RPM selinux-policy-targeted-38.1.45-3.el9_5.noarch
179+
Local Policy RPM selinux-policy-targeted-38.1.45-3.el9_5.noarch
180+
Selinux Enabled True
181+
Policy Type targeted
182+
Enforcing Mode Permissive
183+
Host Name tom-testing-rhel
184+
Platform Linux tom-testing-rhel
185+
5.14.0-503.38.1.el9_5.x86_64 #1 SMP
186+
PREEMPT_DYNAMIC Sun Apr 13 22:01:49 EDT 2025
187+
x86_64 x86_64
188+
Alert Count 1
189+
First Seen 2025-04-24 12:39:11 EDT
190+
Last Seen 2025-04-24 12:39:11 EDT
191+
Local ID fb07cf19-dcea-4b68-8990-59a7a5ba57e8
192+
Raw Audit Messages
193+
type=AVC msg=audit(1745512751.796:1240): avc: denied { read append } for pid=62558 comm="setfiles" path="/var/lib/embedded-cluster/tmp/tmph3gb9qv1" dev="vda4" ino=209964330 scontext=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=1
194+
type=SYSCALL msg=audit(1745512751.796:1240): arch=x86_64 syscall=execve success=yes exit=0 a0=5609fe032210 a1=560a0902dfa0 a2=0 a3=19dd30 items=0 ppid=62146 pid=62558 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm=setfiles exe=/usr/sbin/setfiles subj=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64 SYSCALL=execve AUID=root UID=root GID=root EUID=root SUID=root FSUID=root EGID=root SGID=root FSGID=root
195+
Hash: setfiles,setfiles_t,var_lib_t,file,read,append
196+
```
197+
198+
### Run suggested commands
199+
200+
An example from the above log message would be:
201+
202+
```bash
203+
ausearch -x /usr/sbin/groupadd --raw | audit2allow -D -M my-groupadd
204+
semodule -X 300 -i my-groupadd.pp
205+
```
206+
207+
### Ensure no errors remain
208+
209+
Repeat the above two seteps until the following command returns nothing.
210+
211+
```bash
212+
sealert -a /var/log/audit/audit.log
213+
```
214+
215+
### Set Enforcing
216+
217+
```bash
218+
sudo setenforce Enforcing
219+
sudo sed -i --follow-symlinks 's/SELINUX=permissive/SELINUX=enforcing/g' /etc/sysconfig/selinux
220+
```
221+
222+
!!! note
223+
Enable Permissive again for any upgrades, plug-ins and changes and run through the sealert and suggestions until no errors remain before re-enabling selinux.

‎docs/netbox-enterprise/nbe-ec-requirements.md

+13-4
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ The following are the _recommended_ system requirements for a **production** dep
99
- 8 Virtual CPU (vCPU)
1010
- 24 GB Memory (RAM)
1111
- 100 GB SSD free disk space in `/var/lib`
12+
- disable swap if enabled
1213

1314
!!! note
1415
For **non-production** deployments of NetBox Enterprise, the _minimum_ system requirements can be reduced to 4 Virtual CPU (vCPU) and 16 GB Memory (RAM). All other requirements remain the same.
@@ -17,6 +18,9 @@ The following are the _recommended_ system requirements for a **production** dep
1718

1819
- Linux (Kernel versions 4.3 and above)
1920

21+
!!! note
22+
For **Red Hat Enterprise Linux (RHEL)** deployments please see additional requirements [here](./nbe-ec-requirements-rhel.md).
23+
2024
### Architecture
2125

2226
- x86-64
@@ -75,7 +79,8 @@ If you are using Firewalld (commonly found on RHEL installations), you will need
7579

7680
1. Determine any host IP addresses or networks (external or otherwise) that might need access to the cluster.
7781
2. Create a file called `/etc/firewalld/zones/netbox-enterprise.xml` with the following contents:
78-
```xml
82+
83+
3. ```xml
7984
<?xml version="1.0" encoding="utf-8"?>
8085
<zone target="ACCEPT">
8186
<short>netbox-enterprise</short>
@@ -96,13 +101,16 @@ If you are using Firewalld (commonly found on RHEL installations), you will need
96101
<port protocol="tcp" port="22"/>
97102
</zone>
98103
```
99-
3. In the spot where it says `<!-- HOST IP ADDRESSES GO HERE -->`, add a `<source />` tag for each host or network you want to allow.
104+
105+
4. In the spot where it says `<!-- HOST IP ADDRESSES GO HERE -->`, add a `<source />` tag for each host or network you want to allow.
100106
For example, if your external IP is `1.2.3.4`, and you also have a private class C network `192.168.123.0`, you would add two lines:
107+
101108
```xml
102109
<source address="1.2.3.4/32" />
103110
<source address="192.168.123.0/24" />
104111
```
105-
4. Run `sudo firewall-cmd --reload` to load the zone configuration.
112+
113+
5. Run `sudo firewall-cmd --reload` to load the zone configuration.
106114

107115
Then you can follow the [basic installation instructions](./nbe-ec-installation.md) as normal.
108116

@@ -111,6 +119,7 @@ Then you can follow the [basic installation instructions](./nbe-ec-installation.
111119
There are two steps to installing with SELinux enabled with enforcement turned on.
112120

113121
First, before you install NetBox Enterprise, run:
122+
114123
```bash
115124
sudo setenforce 0
116125
```
@@ -140,4 +149,4 @@ sudo semanage fcontext -a -t container_ro_file_t "${KUBE_DIR}/containerd/io.cont
140149
sudo restorecon -R -v ${KUBE_DIR}/containerd
141150
```
142151

143-
You can then reboot, or run `sudo setenforce 1` to put your system back into a normal state.
152+
You can then reboot, or run `sudo setenforce 1` to put your system back into a normal state.

‎mkdocs.yml

+3-1
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ markdown_extensions:
5151
custom_fences:
5252
- name: mermaid
5353
class: mermaid
54-
format: !!python/name:pymdownx.superfences.fence_code_format
54+
format: pymdownx.superfences.fence_code_format
5555
plugins:
5656
- search
5757
nav:
@@ -100,6 +100,8 @@ nav:
100100
- Overview: "netbox-enterprise/nbe-overview.md"
101101
- NetBox Enterprise Installer:
102102
- Requirements: "netbox-enterprise/nbe-ec-requirements.md"
103+
- Distribution Specific Requirements:
104+
- RHEL: "netbox-enterprise/nbe-ec-requirements-rhel.md"
103105
- Linux System Changes: "netbox-enterprise/nbe-ec-linux-changes.md"
104106
- Installation: "netbox-enterprise/nbe-ec-installation.md"
105107
- Custom Plugin Installation: "netbox-enterprise/nbe-ec-custom-plugins.md"

0 commit comments

Comments
 (0)