Project

General

Profile

Fetch boot files via http instead of TFTP » History » Version 15

Lukas Zapletal, 01/03/2017 07:39 AM

1 10 Lukas Zapletal
h1. PXELinux chainboot into iPXE
2 1 Alexander Chuzhoy
3 14 Lukas Zapletal
{{toc}}
4
5 10 Lukas Zapletal
TFTP is a slow protocol on high-latency networks, but if your hardware is supported by iPXE (http://ipxe.org/appnote/hardware_drivers) or if UNDI driver of the NIC is compatible with iPXE, it is possible to configure PXELinux to chainboot iPXE and continue booting via HTTP protocol which is fast and reliable.
6 1 Alexander Chuzhoy
7 10 Lukas Zapletal
In this scenario, a system is PXE-booted into PXELinux which chainloads iPXE which continue booting via HTTP. The scenario is:
8
9
* hardware is turned on
10
* PXE driver gets network credentials from DHCP
11
* PXE driver gets PXELinux firmware from TFTP (pxelinux.0)
12
* PXELinux searches for configuration file on TFTP
13
* PXELinux chainloads iPXE (undionly-ipxe.0 or ipxe.lkrn)
14
* iPXE gets network credentials from DHCP again
15
* iPXE gets HTTP address from DHCP
16
* iPXE chainloads the iPXE template from Foreman
17
* iPXE loads kernel and init RAM disk of the installer
18
19
Requirements:
20
21
* a host entry is created in Foreman
22
* MAC address of the provisioning interface matches
23
* provisioning interface of the host has a valid DHCP reservation
24
* the host has special PXELinux template (below) associated
25
* the host has iPXE template associated
26
* hardware is capable of PXE booting
27
* hardware NIC is compatible with iPXE
28
29
The iPXE project offers two options: using PXE interface (UNDI) or using built-in linux network card driver. Both options have pros and cons and each gives different results with different hardware cards. Some NIC adapters can be slow with UNDI, some are actually faster. Not all network cards will work with either or both ways.
30
31 13 Lukas Zapletal
h2. A. Chainbooting iPXE directly
32 10 Lukas Zapletal
33 12 Lukas Zapletal
In this setup, iPXE uses build-in driver for network communication. Therefore this will only work on supported cards (see above)!
34 10 Lukas Zapletal
35 12 Lukas Zapletal
h3. TFTP setup
36 10 Lukas Zapletal
37 12 Lukas Zapletal
Copy the iPXE firmware to the TFTP root directory:
38 10 Lukas Zapletal
39 12 Lukas Zapletal
  cp /usr/share/ipxe/ipxe.lkrn /var/lib/tftpboot/
40 10 Lukas Zapletal
41 12 Lukas Zapletal
The source directory can be different on linux distributions, this is for Red Hats. The file is shipped in ipxe-bootimgs package.
42 1 Alexander Chuzhoy
43 15 Lukas Zapletal
Not all hardware is supported by iPXE drivers. In case of troubles, use latest development version build of iPXE:
44
45
  wget -O /var/lib/tftpboot/ http://boot.ipxe.org/ipxe.lkrn
46
47 12 Lukas Zapletal
Do not use symbolic links as TFTP runs in chroot. When using SELinux, remember to correct file contexts:
48 1 Alexander Chuzhoy
49 12 Lukas Zapletal
  restorecon -RvF /var/lib/tftpboot/
50 1 Alexander Chuzhoy
51 12 Lukas Zapletal
h3. Foreman setup - PXELinux template
52 1 Alexander Chuzhoy
53 12 Lukas Zapletal
Configuration involves associating PXELinux and iPXE templates.
54 1 Alexander Chuzhoy
55 12 Lukas Zapletal
In your Foreman instance, go to "Provisioning templates" and create new template of PXELinux kind with the following contents:
56 1 Alexander Chuzhoy
57 12 Lukas Zapletal
<pre><code>
58
DEFAULT linux
59
LABEL linux
60
KERNEL ipxe.lkrn
61
APPEND dhcp && chain <%= foreman_url('iPXE') %>
62
IPAPPEND 2
63
</code></pre>
64 1 Alexander Chuzhoy
65 12 Lukas Zapletal
Recent version of Foreman ships with this template already under name "PXELinux chain iPXE".
66 1 Alexander Chuzhoy
67 12 Lukas Zapletal
h3. Foreman setup - iPXE template
68 1 Alexander Chuzhoy
69 12 Lukas Zapletal
Associate iPXE template which ships with Foreman which is named 'Kickstart default iPXE' or 'Preseed default iPXE' containing something like:
70 1 Alexander Chuzhoy
71 12 Lukas Zapletal
<pre><code>#!ipxe
72
kernel <%= "#{@host.url_for_boot(:kernel)}" %> ks=<%= foreman_url("provision")%>
73
initrd <%= "#{@host.url_for_boot(:initrd)}" %>
74
boot
75
</code></pre>
76 10 Lukas Zapletal
77 12 Lukas Zapletal
If there was a host associated with PXELinux templates, you may need to exit and re-enter Build state for the TFTP configuration to be redeployed. Recent versions of Foreman do this automatically on template save.
78
79 13 Lukas Zapletal
h2. B. Chainbooting iPXE via UNDI
80 12 Lukas Zapletal
81
In this setup, iPXE uses UNDI for network communication. The hardware must support that.
82
83
h3. TFTP setup
84
85
Copy the iPXE firmware to the TFTP root directory and rename it:
86
87
  cp /usr/share/ipxe/undionly.kpxe /var/lib/tftpboot/undionly-ipxe.0
88
89
The source directory can be different on linux distributions, this is for Red Hats. The file is shipped in ipxe-bootimgs package.
90
91 1 Alexander Chuzhoy
Do not use symbolic links as TFTP runs in chroot. When using SELinux, remember to correct file contexts:
92 10 Lukas Zapletal
93 9 Lukas Zapletal
  restorecon -RvF /var/lib/tftpboot/
94 1 Alexander Chuzhoy
95 12 Lukas Zapletal
h3. TFTP setup (gPXELinux alternative)
96 10 Lukas Zapletal
97 12 Lukas Zapletal
This is alternative approach if none of the above configurations work or packages are not available.
98 10 Lukas Zapletal
99 12 Lukas Zapletal
Copy the gPXE firmware to the TFTP root directory:
100 10 Lukas Zapletal
101 12 Lukas Zapletal
  cp /usr/share/syslinux/gpxelinuxk.0 /var/lib/tftpboot/
102
103
The source directory can be different on linux distributions, this is for Red Hats. The file is shipped in syslinux package.
104
105
Do not use symbolic links as TFTP runs in chroot. When using SELinux, remember to correct file contexts:
106
107
  restorecon -RvF /var/lib/tftpboot/
108
109
h3. Foreman setup - PXELinux template
110
111 9 Lukas Zapletal
In your Foreman instance, go to "Provisioning templates" and create new template of PXELinux kind with the following contents:
112
113 1 Alexander Chuzhoy
<pre><code>
114
DEFAULT undionly-ipxe
115 9 Lukas Zapletal
LABEL undionly-ipxe
116 1 Alexander Chuzhoy
MENU LABEL iPXE UNDI
117
KERNEL undionly-ipxe.0
118 10 Lukas Zapletal
IPAPPEND 2
119 9 Lukas Zapletal
</code></pre>
120 1 Alexander Chuzhoy
121
Recent version of Foreman ships with this template already under name "PXELinux chain iPXE UNDI".
122
123 12 Lukas Zapletal
h3. Foreman setup - iPXE template
124 1 Alexander Chuzhoy
125 12 Lukas Zapletal
Associate iPXE template which ships with Foreman which is named 'Kickstart default iPXE' or 'Preseed default iPXE' containing something like:
126 1 Alexander Chuzhoy
127
<pre><code>#!ipxe
128
kernel <%= "#{@host.url_for_boot(:kernel)}" %> ks=<%= foreman_url("provision")%>
129
initrd <%= "#{@host.url_for_boot(:initrd)}" %>
130
boot
131
</code></pre>
132
133
If there was a host associated with PXELinux templates, you may need to exit and re-enter Build state for the TFTP configuration to be redeployed. Recent versions of Foreman do this automatically on template save.
134
135 12 Lukas Zapletal
h3. DHCP setup
136 1 Alexander Chuzhoy
137
The above configuration will lead to an endless loop of chainbooting iPXE firmware. To break this loop, configure DHCP server to hand over correct URL to iPXE to continue booting. In the /etc/dhcp/dhcpd.conf file change the "filename" global or subnet configuration as follows:
138
139 10 Lukas Zapletal
<pre><code>
140 9 Lukas Zapletal
if exists user-class and option user-class = "iPXE" {
141 13 Lukas Zapletal
  filename "https://foreman:443/unattended/iPXE";
142 1 Alexander Chuzhoy
} else {
143
  filename "pxelinux.0";
144
}
145
</code></pre>
146
147 12 Lukas Zapletal
On isolated networks, use Smart Proxy URL instead of Foreman when templates feature is enabled. If there are existing leases on the DHCP server, let them expire and restart the DHCP service. This can be also forced with
148 1 Alexander Chuzhoy
149 10 Lukas Zapletal
<pre><code>
150 1 Alexander Chuzhoy
truncate /var/lib/dhcpd/dhcpd.leases
151 10 Lukas Zapletal
service dhcpd restart
152
</code></pre>
153 11 Lukas Zapletal
154 13 Lukas Zapletal
h2. C. Chainbooting virtual machines
155 10 Lukas Zapletal
156 12 Lukas Zapletal
Since most virtualization hypervisors use iPXE as the primary firmware for PXE booting, the above configuration will directly work without TFTP and PXELinux involved. This is known to work with libvirt, oVirt and RHEV. If the hypervisor is capable of replacing PXE firmware, it will work too (e.g. VMWare is documented at http://ipxe.org/howto/vmware). The workflow is simplified in this case:
157 10 Lukas Zapletal
158
* VM is turned on
159 11 Lukas Zapletal
* iPXE gets network credentials from DHCP again
160 10 Lukas Zapletal
* iPXE gets HTTP address from DHCP
161 1 Alexander Chuzhoy
* iPXE chainloads the iPXE template from Foreman
162
* iPXE loads kernel and init RAM disk of the installer
163 11 Lukas Zapletal
164 12 Lukas Zapletal
To configure this, make sure your hypervisor is using iPXE, configure iPXE template for your host(s) and DHCP server to return valid URL:
165
166
h3. Foreman setup - iPXE template
167
168
Associate iPXE template which ships with Foreman which is named 'Kickstart default iPXE' or 'Preseed default iPXE'. The contents is the same as in the workflows above. If there was a host associated with PXELinux templates, you may need to exit and re-enter Build state for the TFTP configuration to be redeployed. Recent versions of Foreman do this automatically on template save.
169
170
h3. DHCP setup
171
172
Similarly to UNDI configuration, this will lead to an endless loop of chainbooting iPXE firmware. To break this loop, configure DHCP server to hand over correct URL to iPXE to continue booting. In the /etc/dhcp/dhcpd.conf file change the "filename" global or subnet configuration as follows:
173
174
<pre><code>
175
if exists user-class and option user-class = "iPXE" {
176 13 Lukas Zapletal
  filename "https://foreman:443/unattended/iPXE";
177 12 Lukas Zapletal
} else {
178
  filename "pxelinux.0";
179
}
180
</code></pre>
181
182
On isolated networks, use Smart Proxy URL instead of Foreman when templates feature is enabled. If there are existing leases on the DHCP server, let them expire and restart the DHCP service (see above).