Elastic Compute Service:Siklus hidup RHEL dan solusi untuk fase Extended Life RHEL 7

Buat cadangan data dengan membuat Snapshot untuk mencegah kehilangan data jika upgrade gagal. Lihat Create a snapshot.

Login ke instans ECS sebagai pengguna root.

Lihat Menghubungkan ke Instans Linux menggunakan Workbench.

Periksa apakah instans RHEL Anda menggunakan langganan RHEL Alibaba Cloud.

rpm -q client-rhel7

• Jika tidak ada respons yang dikembalikan, sistem Anda tidak menggunakan langganan RHEL Alibaba Cloud. Purchase a subscription terlebih dahulu, lalu lakukan upgrade.

• Jika respons yang dikembalikan mirip dengan client-rhel7-3.0-1.el7_9.noarch, sistem Anda menggunakan langganan RHEL Alibaba Cloud. Lanjutkan dengan upgrade.

  

Persiapkan lingkungan upgrade.

1. Upgrade sistem RHEL ke versi terbaru dan restart sistem.

   yum -y update
   reboot

2. Instal tool upgrade Leapp.

   yum -y install leapp leapp-rhui-alibaba --enablerepo="*"

3. Verifikasi bahwa Leapp telah terinstal.

   leapp --version

   Respons yang mirip dengan leapp version xxx mengonfirmasi Leapp telah terinstal.

Lakukan pemeriksaan pra-upgrade.

Konfigurasi sistem bervariasi. Gunakan tool Leapp untuk menjalankan pemeriksaan pra-upgrade dan selesaikan masalah yang dilaporkan sebelum melakukan upgrade.

1. Lakukan pemeriksaan pra-upgrade.

   • Pra-upgrade ke versi terbaru RHEL 8.

     leapp preupgrade  --no-rhsm

   • Pra-upgrade ke versi target tertentu. Misalnya, upgrade RHEL 7 ke RHEL 8.8.

     leapp preupgrade --no-rhsm --target 8.8

     Catatan

     Jalankan leapp preupgrade -h untuk melihat versi target yang didukung.

2. Lihat hasil pemeriksaan pra-upgrade.

   Log pemeriksaan pra-upgrade Leapp:

   • /var/log/leapp/leapp-preupgrade.log: log tool Leapp

   • /var/log/leapp/leapp-report.txt: laporan pemeriksaan pra-upgrade dalam format teks

   • /var/log/leapp/leapp-report.json: laporan pemeriksaan pra-upgrade dalam format JSON

   Jika pemeriksaan pra-upgrade gagal, item yang gagal akan ditampilkan:

   

3. (Bersyarat) Tangani error pra-upgrade.

   Periksa /var/log/leapp/leapp-report.txt untuk pesan error dan selesaikan berdasarkan saran tool Leapp. Error umum berdasarkan tingkat risiko:

   • high (inhibitor): Menghambat upgrade. Harus diselesaikan sebelum melanjutkan.

     • Kasus 1: Beberapa versi kernel terinstal di sistem.

       Risk Factor: high (inhibitor)
       Title: Multiple devel kernels installed
       Summary: DNF cannot produce a valid upgrade transaction when multiple kernel-devel packages are installed.
       Remediation: [hint] Remove all but one kernel-devel packages before running Leapp again.
       [command] yum -y remove kernel-devel-3.10.0-1160.11.1.el7

       Solusi: Hapus paket kernel lama menggunakan perintah yang disarankan oleh Leapp, misalnya, yum -y remove kernel-devel-3.10.0-1160.11.1.el7.

     • Kasus 2: Modul kernel yang tidak didukung di RHEL 8 dimuat di sistem.

       Risk Factor: high (inhibitor)                                                                                                                                                                                         
       Title: Leapp detected loaded kernel drivers which have been removed in RHEL 8. Upgrade cannot proceed.                                                                                                                
       Summary: Support for the following RHEL 7 device drivers has been removed in RHEL 8:                                                                                                                                  
            - floppy

       Solusi: Beberapa modul, seperti modul floppy pada contoh ini, tidak didukung di RHEL 8. Hapus modul tersebut:

       rmmod floppy

     • Kasus 3: Konfigurasi sshd_config non-standar

       Risk Factor: high (inhibitor)
       Title: Possible problems with remote login using root account
       Summary: OpenSSH configuration file does not explicitly state the option PermitRootLogin in sshd_config file, which will default in RHEL8 to "prohibit-password".
       Remediation: [hint] If you depend on remote root logins using passwords, consider setting up a different user for remote administration or adding "PermitRootLogin yes" to sshd_config. 
       If this change is ok for you, add explicit "PermitRootLogin prohibit-password" to your sshd_config to ignore this inhibitor

       Solusi:

       1. Di /etc/ssh/sshd_config, atur PermitRootLogin menjadi yes.

          Catatan

          Nilai default PermitRootLogin berbeda antara RHEL 7 dan RHEL 8:

          • RHEL 7: yes — login root diizinkan melalui password atau kunci.

          • RHEL 8: prohibit-password — login root berbasis password dinonaktifkan.

       2. Restart layanan sshd:

          systemctl restart sshd

     • Kasus 4: File acknowledgement belum diedit dan dikonfirmasi.

       Risk Factor: high (inhibitor)
       Title: Missing required answers in the answer file
       Summary: One or more sections in answerfile are missing user choices: remove_pam_pkcs11_module_check.confirm
       For more information consult https://leapp.readthedocs.io/en/latest/dialogs.html
       Remediation: [hint] Please register user choices with leapp answer cli command or by manually editing the answerfile.
       [command] leapp answer --section remove_pam_pkcs11_module_check.confirm=True

       Solusi: Hapus modul pam yang tidak didukung. Konfirmasi penghapusan di file /var/log/leapp/answerfile dengan mengatur confirm menjadi True:

       leapp answer --section remove_pam_pkcs11_module_check.confirm=True

       

   • high: Tidak menghambat upgrade tetapi harus diselesaikan sebelum atau setelah upgrade.

     • Kasus 1: Beberapa paket tidak dapat diinstal.

       Risk Factor: high
       Title: Packages from unknown repositories may not be installed
       Summary: 3 packages may not be installed or upgraded due to repositories unknown to leapp:
       - python3-pyxattr (repoid: rhel8-CRB)
       - rpcgen (repoid: rhel8-CRB)
       - ustr (repoid: rhel8-CRB)
       Remediation: [hint] In case the listed repositories are mirrors of official repositories for RHEL (provided by Red Hat on CDN) and their repositories IDs has been customized, you can change the configuration to use the official IDs instead of fixing the problem. You can also review the projected DNF upgrade transaction result in the logs to see what is going to happen, as this does not necessarily mean that the listed packages will not be upgraded. You can also install any missing packages after the in-place upgrade manually.

       Solusi: Instal paket yang hilang secara manual setelah upgrade.

     • Kasus 2: Beberapa paket RHEL 7 tidak di-upgrade.

       Risk Factor: high
       Title: Some RHEL 7 packages have not been upgraded
       Summary: Following RHEL 7 packages have not been upgraded:
       leapp-upgrade-el7toel8-0.18.0-1.el7_9
       kernel-3.10.0-1160.92.1.el7
       leapp-rhui-alibaba-1.0.0-1.el7_9
       Please remove these packages to keep your system in supported state.

       Solusi: Hapus paket-paket ini: yum remove leapp-upgrade-el7toel8-0.18.0-1.el7_9 kernel-3.10.0-1160.92.1.el7 leapp-rhui-alibaba-1.0.0-1.el7_9

   • medium: Tidak menghambat upgrade tetapi sebaiknya diselesaikan untuk mencegah potensi masalah.

     Kasus: Modul pam_pkcs11 dalam konfigurasi PAM akan dihapus.

     Title: Module pam_pkcs11 will be removed from PAM configuration
     Summary: Module pam_pkcs11 was surpassed by SSSD and therefore it was removed from RHEL-8. Keeping it in PAM configuration may lock out the system thus it will be automatically removed from PAM configuration before upgrading to RHEL-8. Please switch to SSSD to recover the functionality of pam_pkcs11.
     Remediation: [hint] Configure SSSD to replace pam_pkcs11

     Solusi: Konfigurasikan SSSD untuk menggantikan fungsi pam_pkcs11 guna memastikan otentikasi berfungsi dengan benar setelah upgrade.

   • low: Dampak minor. Sebaiknya diselesaikan untuk memastikan operasi stabil.

     Kasus: SELinux akan diatur ke mode permissive.

     Risk Factor: low 
     Title: SElinux will be set to permissive mode
     Summary: SElinux will be set to permissive mode. Current mode: enforcing. This action is required by the upgrade process to make sure the upgraded system can boot without beinig blocked by SElinux rules.
     Remediation: [hint] Make sure there are no SElinux related warnings after the upgrade and enable SElinux manually afterwards. Notice: You can ignore the "/root/tmp_leapp_py3" SElinux warnings.

     Solusi: Setelah upgrade, verifikasi tidak ada peringatan terkait SELinux, lalu atur kembali SELinux ke mode enforcing.

   • info: Informasi. Tidak perlu tindakan. Tinjau laporan untuk memahami perubahan selama upgrade.

     Kasus: Versi rilis di /etc/dnf/vars/releasever akan diatur ke versi target saat ini.

     Risk Factor: info 
     Title: Release version in /etc/dnf/vars/releasever will be set to the current target release
     Summary: On this system, Leapp detected "releasever" variable is either configured through DNF/YUM configuration file and/or the system is using RHUI infrastructure. To avoid issues with repofile URLs (when --release option is not provided) in cases where there is the previous major.minor version value in the configuration, release version will be set to the target release version (8.8). This will also ensure the system stays on the expected target version after the upgrade

     Tidak perlu tindakan.

Lakukan upgrade.

• Upgrade ke versi terbaru RHEL 8.

  leapp upgrade  --no-rhsm

• Upgrade ke versi target tertentu. Misalnya, upgrade RHEL 7 ke RHEL 8.8.

  leapp upgrade  --no-rhsm --target 8.8

Upgrade yang berhasil terlihat seperti ini:

Restart instans untuk boot ke sistem baru.

reboot

Verifikasi hasil upgrade.

• Jalankan perintah cat /etc/redhat-release untuk memeriksa apakah versi sistem telah diperbarui.

• Periksa log atau laporan eksekusi upgrade untuk error apa pun.

• Amati apakah aplikasi Anda berjalan dengan benar di sistem RHEL 8.

(Bersyarat) Konfigurasikan sumber RHEL.

Setelah upgrade Leapp, file /etc/dnf/vars/releasever mengunci sistem ke versi minor tertentu. Misalnya, RHEL 8.8 mengarah ke https://xxxx/8.8/xxx. Untuk mengakses paket RHEL 8 terbaru, hapus file releasever dan bangun kembali cache metadata.

rm -f /etc/dnf/vars/releasever
dnf clean all && dnf makecache

Sumber repositori diperbarui ke https://xxxx/8/xxx, memungkinkan akses otomatis ke security patch dan pembaruan fitur RHEL 8 terbaru.

Buat cadangan data dengan membuat Snapshot untuk mencegah kehilangan data jika upgrade gagal. Lihat Create a snapshot.

Login ke instans ECS sebagai pengguna root.

Lihat Connect to a Linux instance using Workbench.

Periksa apakah instans RHEL Anda menggunakan langganan RHEL Alibaba Cloud.

rpm -qa |grep aliyun

• Jika tidak ada respons yang dikembalikan, sistem Anda tidak menggunakan langganan RHEL Alibaba Cloud. Purchase a subscription terlebih dahulu, lalu lakukan upgrade.

• Jika respons berisi versi minor, seperti rhel8.6, submit a ticket untuk memperoleh paket RPM terbaru, instal paket tersebut, lalu lakukan upgrade.

  

  Catatan

  Saat menjalankan RHEL di Alibaba Cloud, sistem mengakses repositori perangkat lunak Red Hat melalui layanan RHUI Alibaba Cloud. Paket spesifik versi minor, seperti aliyun_rhel8.6-2.0-1.noarch, dapat mencegah koneksi RHUI, sehingga memblokir pembaruan dan upgrade perangkat lunak.

• Jika paket langganan yang dikembalikan mirip dengan aliyun_rhui_rhel8-2.0-3.x86_64, sistem Anda menggunakan langganan RHEL Alibaba Cloud. Lanjutkan dengan upgrade.

  

Persiapkan lingkungan upgrade.

1. Upgrade sistem RHEL ke versi terbaru dan restart sistem.

   yum -y update
   reboot

2. Instal tool upgrade Leapp.

   yum -y install leapp leapp-rhui-alibaba --enablerepo="*"

3. Verifikasi bahwa Leapp telah terinstal.

   leapp --version

   Respons yang mirip dengan leapp version xxx mengonfirmasi Leapp telah terinstal.

Lakukan pemeriksaan pra-upgrade.

Konfigurasi sistem bervariasi. Gunakan tool Leapp untuk menjalankan pemeriksaan pra-upgrade dan selesaikan masalah yang dilaporkan sebelum melakukan upgrade.

1. Lakukan pemeriksaan pra-upgrade.

   • systemctl stop systemd-resolved
     systemctl disable  systemd-resolved

   • Pra-upgrade ke versi terbaru RHEL 9.

     leapp preupgrade  --no-rhsm

   • Pra-upgrade ke versi target tertentu. Misalnya, upgrade RHEL 8 ke RHEL 9.4.

     leapp preupgrade --no-rhsm --target 9.4

     Catatan

     Jalankan leapp preupgrade -h untuk melihat versi target yang didukung.

2. Lihat hasil pemeriksaan pra-upgrade.

   Log pemeriksaan pra-upgrade Leapp:

   • /var/log/leapp/leapp-preupgrade.log: log tool Leapp

   • /var/log/leapp/leapp-report.txt: laporan pemeriksaan pra-upgrade dalam format teks

   • /var/log/leapp/leapp-report.json: laporan pemeriksaan pra-upgrade dalam format JSON

   Jika pemeriksaan pra-upgrade gagal, item yang gagal akan ditampilkan:

   

3. (Bersyarat) Tangani error pra-upgrade.

   Periksa /var/log/leapp/leapp-report.txt untuk pesan error dan selesaikan berdasarkan saran tool Leapp. Error umum berdasarkan tingkat risiko:

   • high: Tidak menghambat upgrade tetapi harus diselesaikan sebelum atau setelah upgrade.

     • Kasus 1: Aktor atau file Leapp kustom terdeteksi.

       Risk Factor: high 
       Title: Detected custom leapp actors or files.
       Summary: We have detected installed custom actors or files on the system. These can be provided e.g. by third party vendors, Red Hat consultants, or can be created by users to customize the upgrade (e.g. to migrate custom applications). This is allowed and appreciated. However Red Hat is not responsible for any issues caused by these custom leapp actors. Note that upgrade tooling is under agile development which could require more frequent update of custom actors.
       The list of custom leapp actors and files:
           - /usr/share/leapp-repository/repositories/system_upgrade/common/files/rhui/alibaba/content.crt
           - /usr/share/leapp-repository/repositories/system_upgrade/common/files/rhui/alibaba/key.pem
           - /usr/share/leapp-repository/repositories/system_upgrade/common/files/rhui/alibaba/leapp-alibaba.repo
       Related links:
           - Customizing your Red Hat Enterprise Linux in-place upgrade: https://red.ht/customize-rhel-upgrade
       Remediation: [hint] In case of any issues connected to custom or third party actors, contact vendor of such actors. Also we suggest to ensure the installed custom leapp actors are up to date, compatible with the installed packages.

       Solusi: Pastikan aktor kustom mutakhir dan kompatibel dengan tool Leapp. Setelah upgrade, verifikasi operasi sistem. Lihat Customizing your Red Hat Enterprise Linux in-place upgrade.

     • Kasus 2: Konfigurasi GRUB2 akan diperbarui secara otomatis selama upgrade.

       Risk Factor: high 
       Title: GRUB2 core will be automatically updated during the upgrade
       Summary: On legacy (BIOS) systems, GRUB2 core (located in the gap between the MBR and the first partition) cannot be updated during the rpm transaction and Leapp has to initiate the update running "grub2-install" after the transaction. No action is needed before the upgrade. After the upgrade, it is recommended to check the GRUB configuration.

       Solusi: Setelah upgrade, periksa konfigurasi GRUB untuk memastikan sistem dapat boot dengan benar.

   • low: Dampak minor. Sebaiknya diselesaikan untuk memastikan operasi stabil.

     Kasus: SELinux diatur ke mode permissive.

     Risk Factor: low 
     Title: SElinux will be set to permissive mode
     Summary: SElinux will be set to permissive mode. Current mode: enforcing. This action is required by the upgrade process to make sure the upgraded system can boot without beinig blocked by SElinux rules.
     Remediation: [hint] Make sure there are no SElinux related warnings after the upgrade and enable SElinux manually afterwards. Notice: You can ignore the "/root/tmp_leapp_py3" SElinux warnings.

     Solusi: Setelah upgrade, verifikasi tidak ada peringatan terkait SELinux, lalu atur kembali SELinux ke mode enforcing.

   • info: Informasi. Tidak perlu tindakan. Tinjau laporan untuk memahami perubahan selama upgrade.

     Kasus: Beberapa repositori sistem target dikecualikan.

     Risk Factor: info 
     Title: Excluded target system repositories
     Summary: The following repositories are not supported by Red Hat and are excluded from the list of repositories used during the upgrade.
     - rhui-codeready-builder-for-rhel-9-aarch64-rhui-rpms
     - codeready-builder-for-rhel-9-aarch64-rpms
     - codeready-builder-for-rhel-9-s390x-rpms
     - codeready-builder-beta-for-rhel-9-ppc64le-rpms
     - codeready-builder-for-rhel-9-x86_64-rpms
     Remediation: [hint] If some of excluded repositories are still required to be used during the upgrade, execute leapp with the --enablerepo option with the repoid of the repository required to be enabled as an argument (the option can be used multiple times).

     Solusi: Untuk mengaktifkan repositori yang dikecualikan selama upgrade, gunakan opsi --enablerepo.

Lakukan upgrade.

• Upgrade ke versi terbaru RHEL 9.

  leapp upgrade  --no-rhsm

• Upgrade ke versi target tertentu. Misalnya, upgrade RHEL 8 ke RHEL 9.4.

  leapp upgrade  --no-rhsm --target 9.4

Upgrade yang berhasil terlihat seperti ini:

Restart instans untuk boot ke sistem baru.

reboot

Verifikasi hasil upgrade.

• Jalankan perintah cat /etc/redhat-release untuk memeriksa apakah versi sistem telah diperbarui.

• Periksa log atau laporan eksekusi upgrade untuk error apa pun.

• Amati apakah aplikasi Anda berjalan dengan benar di sistem RHEL 9.

(Bersyarat) Konfigurasikan sumber RHEL.

Setelah upgrade Leapp, file /etc/dnf/vars/releasever mengunci sistem ke versi minor tertentu. Misalnya, RHEL 9.4 mengarah ke https://xxxx/9.4/xxx. Untuk mengakses paket RHEL 9 terbaru, hapus file releasever dan bangun kembali cache metadata.

rm -f /etc/dnf/vars/releasever
dnf clean all && dnf makecache

Sumber repositori diperbarui ke https://xxxx/9/xxx, memungkinkan akses otomatis ke security patch dan pembaruan fitur RHEL 9 terbaru.