Addon Order

--===============6014655338903545526==
Content-Type: multipart/alternative; boundary="001a11402970d339290550e45aa3"

--001a11402970d339290550e45aa3
Content-Type: text/plain; charset="UTF-8"

Hello,

I have a bit of an odd use-case. Part of our environment is isolated off
from the internet, so to get around this, I have mirrored the CentOS and
Epel repos locally and running the installer against those.

The environment is isolated off due to PCI compliance, so I'm trying to
configure kickstart to select this profile at install.

%addon org_fedora_oscap
    content-type = scap-security-guide
    profile = pci-dss
%end

The problem is, once the centos-release package is installed, it replaces
or updates the /etc/yum.repos.d/CentOS-Base.repo files back to their
defaults.

This causes the installer to hang trying to download required scap files
for that profile from the internet.

I have attempted to create an addon which runs just after the packages
install, but before the org_fedora_oscap addon, this new addon updates the
repo URLs back to the mirrored location.
/mnt/sysimage/etc/yum.repos.d/CentOS-Base.repo.

However, despite the addon running fine, it seems to run AFTER the
org_fedora_oscap addon.

So basically, am I going around this the wrong way, or is there some logic
behind which addons are executed in which order?

The relevant part of the kickstart file looks roughly like this:

%packages
@^minimal
@core
chrony
kexec-tools
#Additional
<list of more packages>

%end

%addon org_update_repo
%end


%addon org_fedora_oscap
    content-type = scap-security-guide
    profile = pci-dss
%end

I can post the full sanitised file if requested.

My next option is to update the org_fedora_oscap addon to replace the
paths, but I think I might be going around this all the wrong way.

Would really appreciate any advice!
Cheers.
Alex

--001a11402970d339290550e45aa3
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hello,<div><br></div><div>I have a bit of an odd use-case.=
 Part of our environment is isolated off from the internet, so to get aroun=
d this, I have mirrored the CentOS and Epel repos locally and running the i=
nstaller against those.</div><div><br></div><div>The environment is isolate=
d off due to PCI compliance, so I&#39;m trying to configure kickstart to se=
lect this profile at install.</div><div><br></div><div><div>%addon org_fedo=
ra_oscap</div><div>=C2=A0 =C2=A0 content-type =3D scap-security-guide</div>=
<div>=C2=A0 =C2=A0 profile =3D pci-dss</div><div>%end</div></div><div><br><=
/div><div>The problem is, once the centos-release package is installed, it =
replaces or updates the /etc/yum.repos.d/CentOS-Base.repo files back to the=
ir defaults.</div><div><br></div><div>This causes the installer to hang try=
ing to download required scap files for that profile from the internet.</di=
v><div><br></div><div>I have attempted to create an addon which runs just a=
fter the packages install, but before the org_fedora_oscap addon, this new =
addon updates the repo URLs back to the mirrored location.</div><div>/mnt/s=
ysimage/etc/yum.repos.d/CentOS-Base.repo.</div><div><br></div><div>However,=
 despite the addon running fine, it seems to run AFTER the org_fedora_oscap=
 addon.</div><div><br></div><div>So basically, am I going around this the w=
rong way, or is there some logic behind which addons are executed in which =
order?</div><div><br></div><div>The relevant part of the kickstart file loo=
ks roughly like this:</div><div><br></div><div><div>%packages</div><div>@^m=
inimal</div><div>@core</div><div>chrony</div><div>kexec-tools</div><div>#Ad=
ditional</div><div>&lt;list of more packages&gt;</div><div><br></div><div>%=
end</div></div><div><br></div><div><div>%addon org_update_repo</div><div>%e=
nd</div><div><br></div><div><br></div><div>%addon org_fedora_oscap</div><di=
v>=C2=A0 =C2=A0 content-type =3D scap-security-guide</div><div>=C2=A0 =C2=
=A0 profile =3D pci-dss</div><div>%end</div></div><div><br></div><div>I can=
 post the full sanitised file if requested.=C2=A0</div><div><br></div><div>=
My next option is to update the org_fedora_oscap addon to replace the paths=
, but I think I might be going around this all the wrong way.=C2=A0</div><d=
iv><br></div><div>Would really appreciate any advice!</div><div>Cheers.</di=
v><div>Alex</div><div><br></div><div><br></div></div>

--001a11402970d339290550e45aa3--


--===============6014655338903545526==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Kickstart-list mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/kickstart-list
--===============6014655338903545526==--