本手册是同名的CentOS 5.9 文章的分支，并考虑了新OS的功能。目前，AWS Marketplace中没有来自centos.org的官方Centos8映像。

如您所知，在Amazon云中，虚拟实例是基于映像（所谓的AMI）启动的。亚马逊提供了大量此类服务，您还可以使用第三方准备的公共图像，云提供商当然对此不承担任何责任。但是有时您需要一个带有必要参数的干净系统的映像，该映像不在映像列表中。

然后，唯一的出路就是制作您的AMI。

官方文档描述了如何创建“实例存储支持的AMI”。

这种方法的缺点是完成的图像也将需要转换为EBS支持的AMI。同样值得注意的是Cockpit Image Builder。它将允许您在CLI或WEB GUI模式下创建自定义映像，但是当您已经拥有Centos 8时。

本文将讨论如何在没有中间步骤的情况下在Amazon云中创建EBS支持的AMI。

行动计划

准备环境
安装干净的系统，进行必要的设置
制作磁盘快照（快照）
注册AMI

环境准备

为了我们的目的，任何形状的任何正式Centos 7实例都是合适的，至少是t2.micro。您可以通过CLI运行它：

aws ec2 run-instances \
  --image-id ami-4bf3d731 \
  --region us-east-1 \
  --key-name alpha \
  --instance-type t2.micro \
  --subnet-id subnet-240a8618 \
  --associate-public-ip-address \
  --block-device-mappings DeviceName=/dev/sda1,Ebs={VolumeSize=8} \
  --block-device-mappings DeviceName=/dev/sdb,Ebs={VolumeSize=4}

VPC, subnet-id. , , SG 'default' .

ssh, , dnf :

sudo yum update -y && sudo yum install -y dnf && sudo reboot

root.

Centos 8.1

DEVICE=/dev/xvdb
ROOTFS=/rootfs
parted -s ${DEVICE} mktable gpt
parted -s ${DEVICE} mkpart primary ext2 1 2
parted -s ${DEVICE} set 1 bios_grub on
parted -s ${DEVICE} mkpart primary xfs 2 100%

mkfs.xfs -L root ${DEVICE}2
mkdir -p $ROOTFS
mount ${DEVICE}2 $ROOTFS

mkdir $ROOTFS/{proc,sys,dev,run}
mount --bind /proc $ROOTFS/proc
mount --bind /sys $ROOTFS/sys
mount --bind /dev $ROOTFS/dev
mount --bind /run $ROOTFS/run

RPM :

PKGSURL=http://mirror.centos.org/centos/8/BaseOS/x86_64/os/Packages
rpm --root=$ROOTFS --initdb
rpm --root=$ROOTFS -ivh \
  $PKGSURL/centos-release-8.1-1.1911.0.8.el8.x86_64.rpm \
  $PKGSURL/centos-gpg-keys-8.1-1.1911.0.8.el8.noarch.rpm \
  $PKGSURL/centos-repos-8.1-1.1911.0.8.el8.x86_64.rpm

dnf --installroot=$ROOTFS --nogpgcheck --setopt=install_weak_deps=False \
   -y install audit authselect basesystem bash biosdevname coreutils \
   cronie curl dnf dnf-plugins-core dnf-plugin-spacewalk dracut-config-generic \
   dracut-config-rescue e2fsprogs filesystem firewalld glibc grub2 grubby hostname \
   initscripts iproute iprutils iputils irqbalance kbd kernel kernel-tools \
   kexec-tools less linux-firmware lshw lsscsi ncurses network-scripts \
   openssh-clients openssh-server passwd plymouth policycoreutils prefixdevname \
   procps-ng  rng-tools rootfiles rpm rsyslog selinux-policy-targeted setup \
   shadow-utils sssd-kcm sudo systemd util-linux vim-minimal xfsprogs \
   chrony cloud-init

, , , .

, :

dnf --installroot=$ROOTFS groupinstall base core \
    --excludepkgs "NetworkManager*" \
     -e "i*-firmware"

yum --excludepkgs, , .

dnf group info core core.

, fstab, grub2 169.254 AWS DNS NTP.

cat > $ROOTFS/etc/resolv.conf << HABR
nameserver 169.254.169.253
HABR

cat > $ROOTFS/etc/sysconfig/network << HABR
NETWORKING=yes
NOZEROCONF=yes
HABR

cat > $ROOTFS/etc/sysconfig/network-scripts/ifcfg-eth0  << HABR
DEVICE=eth0
ONBOOT=yes
BOOTPROTO=dhcp
HABR

cat > $ROOTFS/etc/fstab << HABR
LABEL=root / xfs defaults,relatime 1 1
HABR

sed -i  "s/cloud-user/centos/" $ROOTFS/etc/cloud/cloud.cfg
echo "server 169.254.169.123 prefer iburst minpoll 4 maxpoll 4" >> $ROOTFS/etc/chrony.conf
sed -i "/^pool /d" $ROOTFS/etc/chrony.conf
sed -i "s/^AcceptEnv/# \0/" $ROOTFS/etc/ssh/sshd_config

cat > $ROOTFS/etc/default/grub << HABR
GRUB_TIMEOUT=1
GRUB_DISTRIBUTOR="$(sed 's, release .*$,,g' /etc/system-release)"
GRUB_DEFAULT=saved
GRUB_DISABLE_SUBMENU=true
GRUB_TERMINAL_OUTPUT="console"
GRUB_CMDLINE_LINUX="crashkernel=auto console=ttyS0,115200n8 console=tty0 net.ifnames=0 biosdevname=0"
GRUB_DISABLE_RECOVERY="true"
GRUB_ENABLE_BLSCFG=true
HABR

, GRUB_CMDLINE_LINUX selinux=0, SELinux.

initramfs chroot

grub fstab .
:

KERNEL=$(ls $ROOTFS/lib/modules/) 
chroot $ROOTFS dracut -f -v /boot/initramfs-$KERNEL.img $KERNEL
chroot $ROOTFS grub2-mkconfig -o /boot/grub2/grub.cfg
chroot $ROOTFS grub2-install $DEVICE
chroot $ROOTFS update-crypto-policies --set FUTURE

update-crypto-policies — , :)

"", :

chroot $ROOTFS fips-mode-setup --enable
chroot $ROOTFS grub2-mkconfig -o /boot/grub2/grub.cfg
chroot $ROOTFS grub2-install $DEVICE

, update-crypto-policies --show FIPS.

chroot $ROOTFS systemctl enable network.service
chroot $ROOTFS systemctl enable sshd.service
chroot $ROOTFS systemctl enable cloud-init.service
chroot $ROOTFS systemctl mask tmp.mount

dnf --installroot=$ROOTFS clean all
truncate -c -s 0 $ROOTFS/var/log/*.log
rm -rf var/lib/dnf/*
touch $ROOTFS/.autorelabel

autorelabel — SELinux .

sync
umount $ROOTFS/{proc,sys,dev,run}
umount $ROOTFS

AMI

ebs- ami, :

aws ec2 create-snapshot \
    --volume-id vol-09f26eba4c50da110  --region us-east-1 \
    --description 'centos-release-8.1-1.1911.0.8 4.18.0-147.5.1 01'

- . SnapshotId:

aws ec2   describe-snapshots  --region us-east-1 --snapshot-ids snap-0b665542fc59e58ed

"State": "completed", AMI :

aws ec2 register-image \
    --region us-east-1 \
    --name 'CentOS-8.1-1.1911.0.8-minimal' \
    --description 'centos-release-8.1-1.1911.0.8 4.18.0-147.5.1 01' \
    --virtualization-type hvm --root-device-name /dev/sda1 \
    --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs": { "SnapshotId": "snap-0b665542fc59e58ed", "VolumeSize":4,  "DeleteOnTermination": true, "VolumeType": "gp2"}}]' \
    --architecture x86_64 --sriov-net-support simple --ena-support

aws ec2 modify-image-attribute \
    --region us-east-1 \
    --image-id ami-011ed2a37dc89e206 \
    --launch-permission 'Add=[{Group=all}]'

. .

, , Linux-. , Debian ( debootstrap ) RHEL-.

UPDATE . Packer, . .

在Amazon云中使用纯CentOS 8.1创建映像

行动计划

环境准备

Centos 8.1

initramfs chroot

AMI

More articles: