[Feature Request] - VMware OVA/OVF

[phene]

Will Amazon provide OVA or OVF images for support outside of AWS?

[nmeyerhans]

We do plan on providing VM images for on-premises use, but I don't have an ETA to offer at this time. Please stay tuned.

[bplessis-swi]

I think this is a duplicates #102

[git-cgallagher]

Are there any known caveats to exporting a vanilla AL2023 instance to OVA using the VM import/export function?

[stewartsmith]

We do set some things up by default in AMIs to limit what kernel modules are in the initramfs (via the dracut-config-ec2 package), so that may be a limiting factor in some non-EC2 environments. IIRC the cloud-init config skips the early phase where it may load things from seed.iso so that would need to be changed too. Otherwise, things should mostly work... (albeit a situation which we are not currently testing)

[Rosch]

An VMware esxi image would be highly appreciated. Is there any ETA?

[Angelicvorian]

Ok AWS.
This is looking like there will not be an OVA released. I take it from the radio silence that is the case.
I want to move from an older, red/blu-ish coloured distro to something more modern. But we can't keep hanging on forever, hoping, with no information provided.
Canonical just got another customer.

[ozbenh]

This is still under evaluation on our side

[Rosch]

And this is still needed on many peoples side to be (at all / a lot better) able to develop software against AL2023.

[stewartsmith]

Good news everyone!

We have just released the first KVM and VMware images of Amazon Linux 2023.

The documentation is up at https://docs.aws.amazon.com/linux/al2023/ug/outside-ec2.html
and these first images can be found at https://cdn.amazonlinux.com/al2023/os-images/2023.2.20231113.0/ (the https://cdn.amazonlinux.com/al2023/os-images/latest/ URL that is in the User Guide will work shortly, and always lead to the latest release, much like it does for AL2, and I'll update this comment when I've verified it's working).

The documentation covers supported device types and related things.

This version of the images have a few extra development packages installed by default, and we'll make the minor change in an upcoming revision of the images (i.e. AL2023.3) to more closely mirror the package content of the standard AMIs. At that point in time we'll update the docs to show the full package list of the KVM and VMware images (like is present for the AMIs and container image types).

In the meantime, we welcome feedback on these images and documentation on how to use them!

[stewartsmith]

FYI, https://cdn.amazonlinux.com/al2023/os-images/latest/ works now.

[rich-nahra]

EDIT: My original workaround is not needed.

Thank you for providing this image.

[stewartsmith]

The minimal version for the VMWare images is set to what it is as it's the oldest revision to support UEFI Secure Boot.

[rich-nahra]

The minimal version for the VMWare images is set to what it is as it's the oldest revision to support UEFI Secure Boot.

Secure Boot has been an option since hardware version 13 vmware.com. Wouldn't 13 be the oldest revision? Also, Amazon Linux 2023 doesn't currently support UEFI docs.aws.

[Rosch]

Thank you very very much. This is what we need! That makes developing for AL2023 a lot lot easier.

But I have a problem. I have deployed AL2023 on VMWare esxi 6.7. And maybe I messed up, my seed.iso somehow.
My al2023 boots up, gets also an ip (I assume - i can ping it) but I cannot login with the account I specified in user-data via ssh. It always gives me "permission denied" already without entering a password.

So I tried to login via VMWare console. I can't, too. But for a different reason. I cannot enter something via keyboard. The cursor blinks, but nothing appears on the console. I also cannot switch terminal using function key buttons.

Does someone know what is wrong here with the console?
I will try to fix the seed.iso problem but would also be able to use console.

Thanks for your help.

[rich-nahra]

have deployed AL2023 on VMWare esxi 6.7. And ma

Not very helpful but i can tell you my cloud-init (user-data and meta-data) files are working as expected.

Here are relevant lines in my cloud-init user-data (yaml). You can ignore the docker group and membership.

chpasswd:
  Expire: true #force reset 
  list: ["rich:PasswdToReset"]
groups: [docker]
users:
  - groups: [wheel, sudo, docker]
    lock_passwd: false
    name: rich
    shell: /bin/bash
    ssh-authorized-keys: [ssh-rsa ...]
    sudo: ALL=(ALL) NOPASSWD:ALL

[daniejstriata]

Thank you very very much. This is what we need! That makes developing for AL2023 a lot lot easier.

But I have a problem. I have deployed AL2023 on VMWare esxi 6.7. And maybe I messed up, my seed.iso somehow. My al2023 boots up, gets also an ip (I assume - i can ping it) but I cannot login with the account I specified in user-data via ssh. It always gives me "permission denied" already without entering a password.

So I tried to login via VMWare console. I can't, too. But for a different reason. I cannot enter something via keyboard. The cursor blinks, but nothing appears on the console. I also cannot switch terminal using function key buttons.

Does someone know what is wrong here with the console? I will try to fix the seed.iso problem but would also be able to use console.

Thanks for your help.

@Rosch I had the same issue where my key was not accepted. I use Proxmox though with KVM. I changed the default CD drive from IDE to SATA. After which the seed.iso was detected and I could login. I don't have the issue that I cannot type anything on the terminal.

[cpswan]

Thanks @daniejstriata adding a SATA controller and then using it for the CD-ROM got things working for me on ESXi 8.0u2

And then in the process of writing up a bug report I've now seen it working with an IDE controller :/

It would be handy if the OVA had a suitable CD-ROM (and controller) [and maybe ditch the floppy too].

[daniejstriata]

That's strange. I've not been able to get the seed.iso to be work for me when using IDE. I'll do some more tests later tonight and give feedback.

[ozbenh]

The minimal version for the VMWare images is set to what it is as it's the oldest revision to support UEFI Secure Boot.

Secure Boot has been an option since hardware version 13 vmware.com. Wouldn't 13 be the oldest revision? Also, Amazon Linux 2023 doesn't currently support UEFI docs.aws.

The AL2023 OVA should have minimum HW version 13 for that reason. It also comes with empty SB keys provisionned so that if you actually enable UEFI, you will be in Setup Mode and will be able to run amazon-linux-sb enroll to provision our keys (instead of being locked in with Microsoft keys).

UEFI works, it's not "supported" yet mostly because our testing automation doesn't yet qualfies it and because the current images don't have an EFI framebuffer so you don't get a console unless you use serial. This will be fixed in an upcoming release and we might even switch the OVA default to UEFI at that point.

As far as Secure Boot, VMware is a bit weird, so if you do what I described above, you will have the keys provisioned, but you will still need to go enable secure boot in the UI (or using the API), the presence of a valid PK doesnt seem to be sufficient for VMware to enable SB (unlike for example qemu).

We are looking at providing OVAs pre-provisioned with our keys in the future (no ETA)

[ozbenh]

Thanks @daniejstriata adding a SATA controller and then using it for the CD-ROM got things working for me on ESXi 8.0u2

And then in the process of writing up a bug report I've now seen it working with an IDE controller :/

It would be handy if the OVA had a suitable CD-ROM (and controller) [and maybe ditch the floppy too].

Thanks, we'll look into this

[ozbenh]

Thank you for providing this image. Please consider changing minimum hardware version to vmx-10 as it does not work with VMWare vSphere 7.x. I understand vSphere 8 is listed as a requirement but 7 seems to work fine. https://docs.aws.amazon.com/linux/al2023/ug/vmware-supported-configurations.html

Steps to modify manifest manually

Change hardware version in OVA

Untar the OVA

 tar -xvf al2023-vmware_esx-2023.2.20231113.0-kernel-6.1-x86_64.xfs.gpt.ova

Notice there are three files:

INCOMPLETE-amzn2-vmware_esx-2.0.20220419.0-x86_64.xfs.gpt.ovf INCOMPLETE-amzn2-vmware_esx-2.0.20220419.0-x86_64.xfs.gpt.mf INCOMPLETE-amzn2-vmware_esx-2.0.20220419.0-x86_64.xfs.gpt-disk1.vmdk

Edit INCOMPLETE-amzn2-vmware_esx-2.0.20220419.0-x86_64.xfs.gpt.ovf Update VirtualSystemType to vmx-10

<VirtualHardwareSection>
      <Info>Virtual hardware requirements</Info>
      <System>
        <vssd:ElementName>Virtual Hardware Family</vssd:ElementName>
        <vssd:InstanceID>0</vssd:InstanceID>
        <vssd:VirtualSystemIdentifier>INCOMPLETE-amzn2-vmware_esx-2.0.20220419.0-x86_64.xfs.gpt</vssd:VirtualSystemIdentifier>
        <vssd:VirtualSystemType>vmx-11</vssd:VirtualSystemType>
      </System>
      ...
<VirtualHardwareSection>

<VirtualHardwareSection>
      <Info>Virtual hardware requirements</Info>
      <System>
        <vssd:ElementName>Virtual Hardware Family</vssd:ElementName>
        <vssd:InstanceID>0</vssd:InstanceID>
        <vssd:VirtualSystemIdentifier>INCOMPLETE-amzn2-vmware_esx-2.0.20220419.0-x86_64.xfs.gpt</vssd:VirtualSystemIdentifier>
        <vssd:VirtualSystemType>vmx-10</vssd:VirtualSystemType>
      </System>
      ...
<VirtualHardwareSection>

Next calculate SHA value for the updated INCOMPLETE-amzn2-vmware_esx-2.0.20220419.0-x86_64.xfs.gpt.ovf

sha1sum INCOMPLETE-amzn2-vmware_esx-2.0.20220419.0-x86_64.xfs.gpt.ovf

Update INCOMPLETE-amzn2-vmware_esx-2.0.20220419.0-x86_64.xfs.gpt.mf with new SHA

Tar all three files:

tar -cvf al2023-vmware_esx-2023.2.20231113.0-kernel-6.1-x86_64.xfs.gpt.ova INCOMPLETE-amzn2-vmware_esx-2.0.20220419.0-x86_64.xfs.gpt-disk1.vmdk INCOMPLETE-amzn2-vmware_esx-2.0.20220419.0-x86_64.xfs.gpt.mf INCOMPLETE-amzn2-vmware_esx-2.0.20220419.0-x86_64.xfs.gpt.ovf 

What you describe above is a modification of the AL2 images, not the AL2023 ... a whole different topic.

This issue is about AL2023 images. While we qualified it with vSphere 8.0 (that's what we have) it should work with 7. Hardware version 13 which is what we require for AL2023 is I think ESXi 6.5 and later (from memory).

[rich-nahra]

Thank you for providing this image. Please consider changing minimum hardware version to vmx-10 as it does not work with VMWare vSphere 7.x. I understand vSphere 8 is listed as a requirement but 7 seems to work fine. https://docs.aws.amazon.com/linux/al2023/ug/vmware-supported-configurations.html
Steps to modify manifest manually

Change hardware version in OVA

Untar the OVA

 tar -xvf al2023-vmware_esx-2023.2.20231113.0-kernel-6.1-x86_64.xfs.gpt.ova

Notice there are three files:
INCOMPLETE-amzn2-vmware_esx-2.0.20220419.0-x86_64.xfs.gpt.ovf INCOMPLETE-amzn2-vmware_esx-2.0.20220419.0-x86_64.xfs.gpt.mf INCOMPLETE-amzn2-vmware_esx-2.0.20220419.0-x86_64.xfs.gpt-disk1.vmdk
Edit INCOMPLETE-amzn2-vmware_esx-2.0.20220419.0-x86_64.xfs.gpt.ovf Update VirtualSystemType to vmx-10

<VirtualHardwareSection>
      <Info>Virtual hardware requirements</Info>
      <System>
        <vssd:ElementName>Virtual Hardware Family</vssd:ElementName>
        <vssd:InstanceID>0</vssd:InstanceID>
        <vssd:VirtualSystemIdentifier>INCOMPLETE-amzn2-vmware_esx-2.0.20220419.0-x86_64.xfs.gpt</vssd:VirtualSystemIdentifier>
        <vssd:VirtualSystemType>vmx-11</vssd:VirtualSystemType>
      </System>
      ...
<VirtualHardwareSection>

<VirtualHardwareSection>
      <Info>Virtual hardware requirements</Info>
      <System>
        <vssd:ElementName>Virtual Hardware Family</vssd:ElementName>
        <vssd:InstanceID>0</vssd:InstanceID>
        <vssd:VirtualSystemIdentifier>INCOMPLETE-amzn2-vmware_esx-2.0.20220419.0-x86_64.xfs.gpt</vssd:VirtualSystemIdentifier>
        <vssd:VirtualSystemType>vmx-10</vssd:VirtualSystemType>
      </System>
      ...
<VirtualHardwareSection>

Next calculate SHA value for the updated INCOMPLETE-amzn2-vmware_esx-2.0.20220419.0-x86_64.xfs.gpt.ovf

sha1sum INCOMPLETE-amzn2-vmware_esx-2.0.20220419.0-x86_64.xfs.gpt.ovf

Update INCOMPLETE-amzn2-vmware_esx-2.0.20220419.0-x86_64.xfs.gpt.mf with new SHA
Tar all three files:

tar -cvf al2023-vmware_esx-2023.2.20231113.0-kernel-6.1-x86_64.xfs.gpt.ova INCOMPLETE-amzn2-vmware_esx-2.0.20220419.0-x86_64.xfs.gpt-disk1.vmdk INCOMPLETE-amzn2-vmware_esx-2.0.20220419.0-x86_64.xfs.gpt.mf INCOMPLETE-amzn2-vmware_esx-2.0.20220419.0-x86_64.xfs.gpt.ovf 

What you describe above is a modification of the AL2 images, not the AL2023 ... a whole different topic.

This issue is about AL2023 images. While we qualified it with vSphere 8.0 (that's what we have) it should work with 7. Hardware version 13 which is what we require for AL2023 is I think ESXi 6.5 and later (from memory).

Right topic, wrong files. Thanks for the feedback

[ozbenh]

Thanks @daniejstriata adding a SATA controller and then using it for the CD-ROM got things working for me on ESXi 8.0u2
And then in the process of writing up a bug report I've now seen it working with an IDE controller :/
It would be handy if the OVA had a suitable CD-ROM (and controller) [and maybe ditch the floppy too].

Thanks, we'll look into this

I'm thinking we could just take out both IDE and SATA and just attach the CD-ROM to the SCSI bus ...

[ozbenh]

Thanks @daniejstriata adding a SATA controller and then using it for the CD-ROM got things working for me on ESXi 8.0u2
And then in the process of writing up a bug report I've now seen it working with an IDE controller :/
It would be handy if the OVA had a suitable CD-ROM (and controller) [and maybe ditch the floppy too].

Thanks, we'll look into this

I'm thinking we could just take out both IDE and SATA and just attach the CD-ROM to the SCSI bus ...

On second thoughts .... I would expect ESXi users to use the VMware guestinfo data source instead of a CD-ROM, in which case adding one as part of the .ova is ... overkill. Thoughts ?

[ozbenh]

Thanks @daniejstriata adding a SATA controller and then using it for the CD-ROM got things working for me on ESXi 8.0u2
And then in the process of writing up a bug report I've now seen it working with an IDE controller :/
It would be handy if the OVA had a suitable CD-ROM (and controller) [and maybe ditch the floppy too].

Thanks, we'll look into this

I'm thinking we could just take out both IDE and SATA and just attach the CD-ROM to the SCSI bus ...

On second thoughts .... I would expect ESXi users to use the VMware guestinfo data source instead of a CD-ROM, in which case adding one as part of the .ova is ... overkill. Thoughts ?

After a bit more experimentations with VMware Workstation (I haven't tried with vSphere yet), it's messy... if I put a CDROM drive in the OVA it really expects the ISO image to be in there too, at least in the Workstation case. If you take that out, it doesn't know what "backend" to use. The drive is there but it defaults to trying to use a physical device.

I'm going to take out the floopy, but I am less an less convinced that adding the cdrom by default is the right approach

[cpswan]

Thanks @ozbenh - I'd never heard of the guestinfo data source before you mentioned it, and my first reaction was 'it would be nice if that was documented', but then I saw that it is now documented - so kudos to the team for getting that done.

For anybody else following along and wondering how to use it that maybe doesn't have the govc tool installed and configured it's also possible to just drop values into the Configuration Parameters pane on the ESXi web interface (Edit - VM Options - Advanced - Edit Configuration).

Firstly I got the base64 values for my meta-data and user-data with cat meta-data | base64 -w0 and cat user-data | base64 -w0 then copy/pasted them along with adding the respective .encoding values:

I'm pleased to report that the VM fired up and was accessible with my SSH key without any .iso wrangling :)

There's no similar config GUI (that I can find) in Workstation, so after importing the OVA I simply added the extra lines to the .vmx file:

With Workstation I also hit snags with the bridged networking getting weird IPs because I hadn't restricted it to just using the ethernet adaptor. Thankfully this guide got me straightened out so that I was getting proper LAN IPs to SSH into.

[fabriziodea]

Thanks everyone for the info on this thread.
I tried to use both the iso file and the guestinfo, the metadata is picked up but the userdata is not.
This is the userdata i am trying to upload:

I tried various variations but i can't make it work, no user can log into my al2023 vm.

For the record i used
mkpasswd -m sha-512
to encrypt my password and i specified the guestinfo parameters as mentioned above by @cpswan

Any help or suggestion is welcome