Skip to content

Commit 421b096

Browse files
OVH-Team-GuidesOVH-Team-Guides
authored
Merge pull request #4546 from ovh/develop
Develop > Master sync
2 parents 501e520 + 1cc9638 commit 421b096

File tree

259 files changed

+7904
-5559
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

259 files changed

+7904
-5559
lines changed

‎pages/cloud/dedicated/pxe-with-full-private-dedicated/guide.en-gb.md

Lines changed: 362 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,362 @@
1+
---
2+
title: "Manage your server reboot with the OVHcloud Link Aggregation feature"
3+
slug: netboot-ola
4+
excerpt: "Find out how to reboot your OVHcloud servers, working through your active private aggregation"
5+
section: 'Advanced usage'
6+
order: 05
7+
updated: 2022-12-14
8+
---
9+
10+
**Last updated 14th December 2022**
11+
12+
## Objective
13+
14+
This guide is designed to help you deploy all of the components and services you need to launch your OVHcloud solutions successfully in a **fully private** environment.<br>
15+
Get a private infrastructure without having to change the default configuration for your [OVHcloud dedicated servers](https://www.ovhcloud.com/en-gb/bare-metal/).
16+
17+
> [!warning]
18+
>
19+
> We have already carried out all our tests, qualifications and configuration validations, based on well-defined parameters and operating criteria, in order to offer you technical environments that are best adapted to your hardware.
20+
>
21+
> Netboot (Network Boot) consists of using your network interface (in low-level mode) as a tool to select the boot of your operating system.
22+
>
23+
> You can boot any system from a network volume, such as SAN or NFS. However, the system usually boots from a local volume: local disk, CD/DVD or USB.
24+
>
25+
> As a reminder, we strongly advise against changing the default configurations: BIOS configuration, Boot Order, etc.
26+
>
27+
> We have pre-configured this startup mechanism in our solutions, and have integrated all of our tools into it: netboot, monitoring, recycling, etc.
28+
> If these settings were to be modified, our teams would no longer be able to perform the tasks dedicated to them under the conditions we have chosen, and above all, you could render the boot inoperative.
29+
>
30+
31+
With [OVHcloud dedicated servers](https://www.ovhcloud.com/en-gb/bare-metal/), you can configure/declare your own networks.<br>
32+
Each server is equipped with at least 2 network interfaces, effectively functioning as aggregated links, ensuring redundancy in the event of failure.<br>
33+
You can therefore use/declare your *public* and *private* networks via our solution [vRack](pages/cloud/dedicated/vrack_configuring_on_dedicated_server/).
34+
35+
We will present the case of [dedicated server(s)](https://www.ovhcloud.com/en-gb/bare-metal/) configured in **OLA** mode, i.e. with **only** private networks.
36+
This choice offers your infrastructure the best possible isolation/protection for your hosted service.<br>
37+
The only significant difference is that [private networks](https://docs.ovh.com/gb/en/ovhcloud-connect/overview/#private-connection) do not have access to everything that does not belong to your infrastructure.<br>
38+
As a result, a server isolated by its private network prevents the boot mechanism. This means that when systems are booted via the **Netboot** (Network Boot) method, they are based on OVHcloud’s internal network and shared services.
39+
40+
### Netboot startup overview
41+
42+
A major component exists in 2 versions:
43+
44+
- **PXE**: Using a standardised client/server environment, based on BOOTP/DHCP/TFTP protocols, to enable boot/deployment through the client system network.<br>
45+
- **iPXE**: Using a more advanced, standardised client/server environment, based on HTTP, iSCSI, AoE, FCoE, Wi-Fi protocols to enable client system network boot/deployment.
46+
47+
### A quick overview of Netboot startup at OVHcloud
48+
49+
List of components involved during startup:
50+
51+
- A **DHCP** server: Assigns a network configuration (lease with IP address) for a client machine that is attempting to boot.
52+
- A **TFTP** service: Resources available across the network that will be queried by PXE and iXPE.
53+
- The **rEFInd** solution, in the form of a **BootLoader**, was chosen because it was perfectly adapted. It will allow the search of boot sectors of client machines: local disk, USB, etc.
54+
55+
Here is a (logical) Netboot boot schema:
56+
57+
![Netboot in action](images/netboot_steps.png)
58+
59+
|Description/Details|
60+
|---|
61+
|1. Sending a discover request to DHCP from the client machine (in broadcast)|
62+
|2. DHCP assigns an IP address to the client machine (offer/request/ack). iPXE binary recovery request|
63+
|3. iPXE binary TFTP recovery|
64+
|4. Loading iPXE binary as firmware|
65+
|5. iPXE firmware recovery request|
66+
|6. Retrieving the associated iPXE script in TFTP|
67+
|7. Running the iPXE script. Retrieving rEFInd resources: required binary and configuration file|
68+
|8. Running and loading the rEFInd binary|
69+
|9. rEFInd launches its scan task to identify boot sectors for local disks|
70+
71+
> [!primary]
72+
>
73+
> This description is as generic as possible, in order to remain clear, and so as not to add technical elements or constraints that go beyond our example. The aim of this scheme is to provide an overall view of the operating principle.
74+
>
75+
76+
## Requirements
77+
78+
> [!warning]
79+
>
80+
> This article is intended for experienced users who have at least basic knowledge of the open-source world, as well as knowledge of system and network administration.
81+
>
82+
83+
- Access to the [OVHcloud Control Panel](https://www.ovh.com/manager/#/dedicated/configuration).
84+
- At least one [dedicated server](https://www.ovhcloud.com/en-gb/bare-metal/) with an operating system **already installed**.
85+
- An additional dedicated server with the default network interfaces configured, namely public and private network access. This server will host all services (**DHCP** and **TFTP**). The operating system will be one of your choice.
86+
- You must have all of the network interfaces for this server in **private** mode, which implies that you have already configured [our OLA feature](pages/cloud/dedicated/ola-enable-manager/).<br>
87+
88+
>
89+
> To check that your machine is eligible for our procedure, log in to the [OVHcloud Control Panel](https://www.ovh.com/auth/?action=gotomanager&from=https://www.ovh.co.uk/&ovhSubsidiary=GB) and click on the `Bare Metal Cloud`{.action} tab.
90+
>
91+
> Select your server and check that it is eligible for `OLA: OVHcloud Link Aggregation` in the `Network interfaces`{.action} tab.
92+
>
93+
> ![OLA1](images/Scr_OLA1.png){.thumbnail}
94+
>
95+
> ![OLA2](images/Scr_OLA2.png){.thumbnail}
96+
97+
## Instructions
98+
99+
### Deploy your DHCP and TFTP services
100+
101+
1. Install the packages for DHCP/TFTP services.
102+
2. Perform the basic configuration for each service.
103+
3. Turn on your server.
104+
105+
Below is an example of a basic private infrastructure (layer 2 diagram):
106+
107+
![Schema](images/schema_basic_en.png)
108+
109+
**Example:**
110+
111+
- Services hosted/shared on **Node 0**.
112+
- Only one **Node 1** client machine with active OLA.
113+
114+
115+
> [!primary]
116+
>
117+
> After booting the systems, and in order for DHCP services and optional services (DNS and NTP) to be fully functional, consider declaring/adding rules in the local firewall, via the private network interface of the machine hosting the services.
118+
>
119+
120+
#### DHCP service
121+
122+
Below is a sample configuration file for your **DHCP** service.<br>
123+
Depending on your distribution, the tree may be different (`dhcpd.conf`).
124+
125+
In general, it is sufficient to:
126+
127+
- Declare a network interface for listening (waiting for requests).
128+
- Specify the IP protocol version (v4 or v6).
129+
- Enter a primary configuration file (as an example, see file below).
130+
131+
```bash
132+
default-lease-time 7200;
133+
max-lease-time 7200;
134+
135+
allow booting;
136+
allow bootp;
137+
allow unknown-clients;
138+
139+
###PXE###
140+
141+
option space PXE;
142+
option PXE.mtftp-ip code 1 = ip-address;
143+
option PXE.mtftp-cport code 2 = unsigned integer 16;
144+
option PXE.mtftp-sport code 3 = unsigned integer 16;
145+
option PXE.mtftp-tmout code 4 = unsigned integer 8;
146+
option PXE.mtftp-delay code 5 = unsigned integer 8;
147+
option arch code 93 = unsigned integer 16;
148+
149+
option space ipxe;
150+
option ipxe-encap-opts code 175 = encapsulate ipxe;
151+
option ipxe.priority code 1 = signed integer 8;
152+
option ipxe.keep-san code 8 = unsigned integer 8;
153+
option ipxe.skip-san-boot code 9 = unsigned integer 8;
154+
option ipxe.syslogs code 85 = string;
155+
option ipxe.cert code 91 = string;
156+
option ipxe.privkey code 92 = string;
157+
option ipxe.crosscert code 93 = string;
158+
option ipxe.no-pxedhcp code 176 = unsigned integer 8;
159+
option ipxe.bus-id code 177 = string;
160+
option ipxe.san-filename code 188 = string;
161+
option ipxe.bios-drive code 189 = unsigned integer 8;
162+
option ipxe.username code 190 = string;
163+
option ipxe.password code 191 = string;
164+
option ipxe.reverse-username code 192 = string;
165+
option ipxe.reverse-password code 193 = string;
166+
option ipxe.version code 235 = string;
167+
option iscsi-initiator-iqn code 203 = string;
168+
169+
# Feature indicators
170+
option ipxe.pxeext code 16 = unsigned integer 8;
171+
option ipxe.iscsi code 17 = unsigned integer 8;
172+
option ipxe.aoe code 18 = unsigned integer 8;
173+
option ipxe.http code 19 = unsigned integer 8;
174+
option ipxe.https code 20 = unsigned integer 8;
175+
option ipxe.tftp code 21 = unsigned integer 8;
176+
option ipxe.ftp code 22 = unsigned integer 8;
177+
option ipxe.dns code 23 = unsigned integer 8;
178+
option ipxe.bzimage code 24 = unsigned integer 8;
179+
option ipxe.multiboot code 25 = unsigned integer 8;
180+
option ipxe.slam code 26 = unsigned integer 8;
181+
option ipxe.srp code 27 = unsigned integer 8;
182+
option ipxe.nbi code 32 = unsigned integer 8;
183+
option ipxe.pxe code 33 = unsigned integer 8;
184+
option ipxe.elf code 34 = unsigned integer 8;
185+
option ipxe.comboot code 35 = unsigned integer 8;
186+
option ipxe.efi code 36 = unsigned integer 8;
187+
option ipxe.fcoe code 37 = unsigned integer 8;
188+
option ipxe.vlan code 38 = unsigned integer 8;
189+
option ipxe.menu code 39 = unsigned integer 8;
190+
option ipxe.sdi code 40 = unsigned integer 8;
191+
option ipxe.nfs code 41 = unsigned integer 8;
192+
193+
subnet 192.168.1.0 netmask 255.255.255.240 {
194+
195+
range 192.168.1.2 192.168.1.5;
196+
option broadcast-address 192.168.1.15;
197+
option routers 192.168.1.1;
198+
ping-check = 1;
199+
next-server 192.168.1.1; # Determines the IP of your tftp server
200+
201+
if option arch = 00:07 { # Determines the architecture type, here 64 bits
202+
if exists user-class and option user-class = "iPXE" {
203+
filename "refind.pxe"; # Determines the script called by the binary
204+
} else {
205+
filename "ipxe.efi"; # Determines iPXE binary
206+
}
207+
208+
} else if option arch = 00:06 { # Determines the architecture type, here 32 bits
209+
if exists user-class and option user-class = "iPXE" {
210+
filename "refind.pxe"; # Determines the script called by the binary
211+
} else {
212+
filename "ipxe32.efi"; # Determines iPXE binary
213+
}
214+
}
215+
}
216+
217+
# Declare each host here
218+
host node_1 {
219+
hardware ethernet xx:xx:xx:xx:xx:xx;
220+
server-name "node_1";
221+
}
222+
```
223+
224+
**Details:**
225+
226+
- Private network (e.g. 192.168.1.0/28)
227+
- `subnet_mask`: 255.255.255.240
228+
- `broadcast_address`: 192.168.1.15
229+
- `dns_servers`: See optional chapter
230+
- `ntp_servers`: See optional chapter
231+
- `default_router` : 192.168.1.1
232+
- `next-server`: 192.168.1.1
233+
- `host`: Client machine name
234+
- `hardware ethernet`: Client machine hardware address (MAC)
235+
- `server-name`: Client hostname machine
236+
237+
238+
239+
#### TFTP service
240+
241+
Depending on your distribution, there are several packages performing the TFTP server function.<br>
242+
For example: *tftp-server*, *tftpd*, *tftpd-hpa* or *atftpd*.
243+
244+
> [!primary]
245+
>
246+
> The installation tree may be different depending on the version of the package and the operating system you are using.
247+
>
248+
249+
What you need to know:
250+
251+
- This service uses port 69 (UDP).
252+
- It is mandatory to declare a "target" directory, corresponding to a local tree that will be used for receiving and downloading files.
253+
254+
Configuration example with `tftpd-hpa` software:
255+
256+
```bash
257+
# /etc/default/tftpd-hpa
258+
TFTP_USERNAME="tftp"
259+
TFTP_DIRECTORY="/srv/tftp"
260+
TFTP_ADDRESS="TFTP_server_address:69"
261+
TFTP_OPTIONS="--secure"
262+
```
263+
264+
We will use the path `/srv/tftp` as an example, and upload the necessary files:
265+
266+
```bash
267+
root@node_0:/srv/tftp# tree
268+
.
269+
|-- ipxe.efi
270+
|-- ipxe32.efi
271+
|-- refind.conf
272+
|-- refind.pxe
273+
`-- refind_x64.efi
274+
```
275+
276+
#### The rEFInd bootloader
277+
278+
- File contents `refind.pxe`:
279+
280+
```bash
281+
#!ipxe
282+
283+
echo Boot to local disk
284+
285+
iseq ${platform} efi && goto is_efi_x86_64 || goto end
286+
287+
:is_efi_x86_64
288+
echo EFI boot mode
289+
290+
# Retrieve configuration file
291+
imgfetch --name refind.conf tftp://${next-server}/refind.conf
292+
293+
# Load rEFIND binary
294+
imgfetch --name refind tftp://${next-server}/refind_x64.efi
295+
chain refind
296+
297+
:end
298+
echo Chain on hard drive failed
299+
sleep 10
300+
exit 1
301+
```
302+
303+
- File contents `refind.conf`:
304+
305+
*This involves integrating the minimum guidelines for proper integration with OVHcloud SI.*
306+
307+
```bash
308+
309+
timeout 1
310+
default_selection 1
311+
hideui hwtest
312+
hideui hints
313+
banner_scale
314+
textonly
315+
scanfor internal
316+
uefi_deep_legacy_scan
317+
scan_delay 0
318+
319+
```
320+
321+
### Getting started
322+
323+
Below is a preview of what you get when displaying a UEFI Netboot (default):<br>
324+
*Corresponds to steps 1 through 8.*<br>
325+
326+
![iPXE in action](images/animation.gif){.thumbnail}
327+
328+
*Corresponds to the result of steps 8 and 9.*<br>
329+
330+
![rEFInd en action](images/rEFInd.png){.thumbnail}<br>
331+
332+
Above, we have the **rEFInd** bootloader loaded on a machine with a *debian* system installed.
333+
334+
You will find on <a href="https://raw.githubusercontent.com/ovh/docs/develop/pages/cloud/dedicated/pxe-with-full-private-dedicated/files/src.zip" download>this link</a> the resources used to develop our tests and examples throughout this presentation. They can be used as templates, depending on your needs.
335+
336+
#### Optional
337+
338+
We also recommend deploying DNS and NTP services.
339+
340+
These are not necessary for the system startup phases, so not imposed in this procedure. They are, however, among the services that will be important in the future, especially for the stability of your infrastructure.
341+
342+
##### **Service DNS**
343+
344+
You can use the local table for each *Node*, i.e. the `/etc/hosts` file, or you can use a service like [dnsmasq](https://en.wikipedia.org/wiki/Dnsmasq).
345+
346+
##### **Service NTP**
347+
348+
It is strongly recommended that you use an NTP service, especially if your infrastructure includes several machines.
349+
350+
- List of ports to authorise on your local firewall (on the machine hosting the services):
351+
- NTP port 123
352+
- DNS port 53
353+
354+
## Go further
355+
356+
[Understanding and customising your DHCP service](https://wiki.debian.org/DHCP_Server)<br>
357+
[Understanding and customising your iPXE service](https://ipxe.org/docs)<br>
358+
[Understanding and customising your rEFInd service](https://en.wikipedia.org/wiki/REFInd)<br>
359+
[Discovering and understanding NTP](https://en.wikipedia.org/wiki/Network_Time_Protocol)<br>
360+
[Discovering and understanding Dnsmasq](https://wiki.debian.org/dnsmasq)<br>
361+
362+
Join our community of users on <https://community.ovh.com/en/>.

0 commit comments

Comments
 (0)