Project

General

Profile

Fetch boot files via http instead of TFTP » History » Version 13

Lukas Zapletal, 02/16/2016 06:31 AM

1 10 Lukas Zapletal
h1. PXELinux chainboot into iPXE
2 1 Alexander Chuzhoy
3 10 Lukas Zapletal
TFTP is a slow protocol on high-latency networks, but if your hardware is supported by iPXE (http://ipxe.org/appnote/hardware_drivers) or if UNDI driver of the NIC is compatible with iPXE, it is possible to configure PXELinux to chainboot iPXE and continue booting via HTTP protocol which is fast and reliable.
4 1 Alexander Chuzhoy
5 10 Lukas Zapletal
In this scenario, a system is PXE-booted into PXELinux which chainloads iPXE which continue booting via HTTP. The scenario is:
6
7
* hardware is turned on
8
* PXE driver gets network credentials from DHCP
9
* PXE driver gets PXELinux firmware from TFTP (pxelinux.0)
10
* PXELinux searches for configuration file on TFTP
11
* PXELinux chainloads iPXE (undionly-ipxe.0 or ipxe.lkrn)
12
* iPXE gets network credentials from DHCP again
13
* iPXE gets HTTP address from DHCP
14
* iPXE chainloads the iPXE template from Foreman
15
* iPXE loads kernel and init RAM disk of the installer
16
17
Requirements:
18
19
* a host entry is created in Foreman
20
* MAC address of the provisioning interface matches
21
* provisioning interface of the host has a valid DHCP reservation
22
* the host has special PXELinux template (below) associated
23
* the host has iPXE template associated
24
* hardware is capable of PXE booting
25
* hardware NIC is compatible with iPXE
26
27
The iPXE project offers two options: using PXE interface (UNDI) or using built-in linux network card driver. Both options have pros and cons and each gives different results with different hardware cards. Some NIC adapters can be slow with UNDI, some are actually faster. Not all network cards will work with either or both ways.
28
29 13 Lukas Zapletal
h2. A. Chainbooting iPXE directly
30 10 Lukas Zapletal
31 12 Lukas Zapletal
In this setup, iPXE uses build-in driver for network communication. Therefore this will only work on supported cards (see above)!
32 10 Lukas Zapletal
33 12 Lukas Zapletal
h3. TFTP setup
34 10 Lukas Zapletal
35 12 Lukas Zapletal
Copy the iPXE firmware to the TFTP root directory:
36 10 Lukas Zapletal
37 12 Lukas Zapletal
  cp /usr/share/ipxe/ipxe.lkrn /var/lib/tftpboot/
38 10 Lukas Zapletal
39 12 Lukas Zapletal
The source directory can be different on linux distributions, this is for Red Hats. The file is shipped in ipxe-bootimgs package.
40 1 Alexander Chuzhoy
41 12 Lukas Zapletal
Do not use symbolic links as TFTP runs in chroot. When using SELinux, remember to correct file contexts:
42 1 Alexander Chuzhoy
43 12 Lukas Zapletal
  restorecon -RvF /var/lib/tftpboot/
44 1 Alexander Chuzhoy
45 12 Lukas Zapletal
h3. Foreman setup - PXELinux template
46 1 Alexander Chuzhoy
47 12 Lukas Zapletal
Configuration involves associating PXELinux and iPXE templates.
48 1 Alexander Chuzhoy
49 12 Lukas Zapletal
In your Foreman instance, go to "Provisioning templates" and create new template of PXELinux kind with the following contents:
50 1 Alexander Chuzhoy
51 12 Lukas Zapletal
<pre><code>
52
DEFAULT linux
53
LABEL linux
54
KERNEL ipxe.lkrn
55
APPEND dhcp && chain <%= foreman_url('iPXE') %>
56
IPAPPEND 2
57
</code></pre>
58 1 Alexander Chuzhoy
59 12 Lukas Zapletal
Recent version of Foreman ships with this template already under name "PXELinux chain iPXE".
60 1 Alexander Chuzhoy
61 12 Lukas Zapletal
h3. Foreman setup - iPXE template
62 1 Alexander Chuzhoy
63 12 Lukas Zapletal
Associate iPXE template which ships with Foreman which is named 'Kickstart default iPXE' or 'Preseed default iPXE' containing something like:
64 1 Alexander Chuzhoy
65 12 Lukas Zapletal
<pre><code>#!ipxe
66
kernel <%= "#{@host.url_for_boot(:kernel)}" %> ks=<%= foreman_url("provision")%>
67
initrd <%= "#{@host.url_for_boot(:initrd)}" %>
68
boot
69
</code></pre>
70 10 Lukas Zapletal
71 12 Lukas Zapletal
If there was a host associated with PXELinux templates, you may need to exit and re-enter Build state for the TFTP configuration to be redeployed. Recent versions of Foreman do this automatically on template save.
72
73 13 Lukas Zapletal
h2. B. Chainbooting iPXE via UNDI
74 12 Lukas Zapletal
75
In this setup, iPXE uses UNDI for network communication. The hardware must support that.
76
77
h3. TFTP setup
78
79
Copy the iPXE firmware to the TFTP root directory and rename it:
80
81
  cp /usr/share/ipxe/undionly.kpxe /var/lib/tftpboot/undionly-ipxe.0
82
83
The source directory can be different on linux distributions, this is for Red Hats. The file is shipped in ipxe-bootimgs package.
84
85 1 Alexander Chuzhoy
Do not use symbolic links as TFTP runs in chroot. When using SELinux, remember to correct file contexts:
86 10 Lukas Zapletal
87 9 Lukas Zapletal
  restorecon -RvF /var/lib/tftpboot/
88 1 Alexander Chuzhoy
89 12 Lukas Zapletal
h3. TFTP setup (gPXELinux alternative)
90 10 Lukas Zapletal
91 12 Lukas Zapletal
This is alternative approach if none of the above configurations work or packages are not available.
92 10 Lukas Zapletal
93 12 Lukas Zapletal
Copy the gPXE firmware to the TFTP root directory:
94 10 Lukas Zapletal
95 12 Lukas Zapletal
  cp /usr/share/syslinux/gpxelinuxk.0 /var/lib/tftpboot/
96
97
The source directory can be different on linux distributions, this is for Red Hats. The file is shipped in syslinux package.
98
99
Do not use symbolic links as TFTP runs in chroot. When using SELinux, remember to correct file contexts:
100
101
  restorecon -RvF /var/lib/tftpboot/
102
103
h3. Foreman setup - PXELinux template
104
105 9 Lukas Zapletal
In your Foreman instance, go to "Provisioning templates" and create new template of PXELinux kind with the following contents:
106
107 1 Alexander Chuzhoy
<pre><code>
108
DEFAULT undionly-ipxe
109 9 Lukas Zapletal
LABEL undionly-ipxe
110 1 Alexander Chuzhoy
MENU LABEL iPXE UNDI
111
KERNEL undionly-ipxe.0
112 10 Lukas Zapletal
IPAPPEND 2
113 9 Lukas Zapletal
</code></pre>
114 1 Alexander Chuzhoy
115
Recent version of Foreman ships with this template already under name "PXELinux chain iPXE UNDI".
116
117 12 Lukas Zapletal
h3. Foreman setup - iPXE template
118 1 Alexander Chuzhoy
119 12 Lukas Zapletal
Associate iPXE template which ships with Foreman which is named 'Kickstart default iPXE' or 'Preseed default iPXE' containing something like:
120 1 Alexander Chuzhoy
121
<pre><code>#!ipxe
122
kernel <%= "#{@host.url_for_boot(:kernel)}" %> ks=<%= foreman_url("provision")%>
123
initrd <%= "#{@host.url_for_boot(:initrd)}" %>
124
boot
125
</code></pre>
126
127
If there was a host associated with PXELinux templates, you may need to exit and re-enter Build state for the TFTP configuration to be redeployed. Recent versions of Foreman do this automatically on template save.
128
129 12 Lukas Zapletal
h3. DHCP setup
130 1 Alexander Chuzhoy
131
The above configuration will lead to an endless loop of chainbooting iPXE firmware. To break this loop, configure DHCP server to hand over correct URL to iPXE to continue booting. In the /etc/dhcp/dhcpd.conf file change the "filename" global or subnet configuration as follows:
132
133 10 Lukas Zapletal
<pre><code>
134 9 Lukas Zapletal
if exists user-class and option user-class = "iPXE" {
135 13 Lukas Zapletal
  filename "https://foreman:443/unattended/iPXE";
136 1 Alexander Chuzhoy
} else {
137
  filename "pxelinux.0";
138
}
139
</code></pre>
140
141 12 Lukas Zapletal
On isolated networks, use Smart Proxy URL instead of Foreman when templates feature is enabled. If there are existing leases on the DHCP server, let them expire and restart the DHCP service. This can be also forced with
142 1 Alexander Chuzhoy
143 10 Lukas Zapletal
<pre><code>
144 1 Alexander Chuzhoy
truncate /var/lib/dhcpd/dhcpd.leases
145 10 Lukas Zapletal
service dhcpd restart
146
</code></pre>
147 11 Lukas Zapletal
148 13 Lukas Zapletal
h2. C. Chainbooting virtual machines
149 10 Lukas Zapletal
150 12 Lukas Zapletal
Since most virtualization hypervisors use iPXE as the primary firmware for PXE booting, the above configuration will directly work without TFTP and PXELinux involved. This is known to work with libvirt, oVirt and RHEV. If the hypervisor is capable of replacing PXE firmware, it will work too (e.g. VMWare is documented at http://ipxe.org/howto/vmware). The workflow is simplified in this case:
151 10 Lukas Zapletal
152
* VM is turned on
153 11 Lukas Zapletal
* iPXE gets network credentials from DHCP again
154 10 Lukas Zapletal
* iPXE gets HTTP address from DHCP
155 1 Alexander Chuzhoy
* iPXE chainloads the iPXE template from Foreman
156
* iPXE loads kernel and init RAM disk of the installer
157 11 Lukas Zapletal
158 12 Lukas Zapletal
To configure this, make sure your hypervisor is using iPXE, configure iPXE template for your host(s) and DHCP server to return valid URL:
159
160
h3. Foreman setup - iPXE template
161
162
Associate iPXE template which ships with Foreman which is named 'Kickstart default iPXE' or 'Preseed default iPXE'. The contents is the same as in the workflows above. If there was a host associated with PXELinux templates, you may need to exit and re-enter Build state for the TFTP configuration to be redeployed. Recent versions of Foreman do this automatically on template save.
163
164
h3. DHCP setup
165
166
Similarly to UNDI configuration, this will lead to an endless loop of chainbooting iPXE firmware. To break this loop, configure DHCP server to hand over correct URL to iPXE to continue booting. In the /etc/dhcp/dhcpd.conf file change the "filename" global or subnet configuration as follows:
167
168
<pre><code>
169
if exists user-class and option user-class = "iPXE" {
170 13 Lukas Zapletal
  filename "https://foreman:443/unattended/iPXE";
171 12 Lukas Zapletal
} else {
172
  filename "pxelinux.0";
173
}
174
</code></pre>
175
176
On isolated networks, use Smart Proxy URL instead of Foreman when templates feature is enabled. If there are existing leases on the DHCP server, let them expire and restart the DHCP service (see above).