Initialize Management with unattended Media

Use read-only configuration media to reuse prepared Management setup settings. The media authorizes initialization of one exact state disk. This procedure still requires authenticated host SSH to stage the administrator password and, if used, the TLS key.

Before you begin

Prepare a fresh Management VM, its exact state-disk identity and management-interface MAC address. Use the network and identity decisions from Management settings. You also need a tool that can create a read-only filesystem image with a volume label.

This procedure applies to fresh Management state. An existing valid state disk retains its configuration; attached media does not overwrite it automatically.

Create the Configuration Medium

Create autoinstall.conf at the root of one read-only filesystem labeled MTG_AUTOINSTALL. Values are literal; do not add shell quotes. The following example uses DHCP. Replace the disk path, MAC address, DNS names and time server with your actual values before creating the image.

schema_version=mtg.state-init.seed.v1
operation=initialize-state
destructive_enabled=true
state_disk=/dev/disk/by-id/REPLACE_WITH_EXACT_STATE_DISK_ID
hostname=mtg-management
time_server=ntp.example.com
network_mode=dhcp
network_mac=02:00:00:00:00:10
network_address=
network_gateway=
network_dns=
network_search_domains=
network_connection_name=mtg-management
network_mtu=1500
management_hostname=management.example.com
management_https_port=443
management_node_ip=10.41.0.1
management_tls_mode=self-signed
management_acme_directory_url=
management_acme_email=
management_password_file=/run/mtg-management-bootstrap-password

Use the disk’s stable /dev/disk/by-id/ path, not a size-based guess. The MAC address must match the selected interface exactly. For static networking, set network_mode=static and provide the host IPv4 address with prefix, gateway, one or two comma-separated DNS server addresses, and any comma-separated search domains. Do not use the private management_node_ip as the host’s LAN address.

The supported TLS values are self-signed, supplied and acme. Supplied mode uses the files staged in the next section. ACME requires management_acme_directory_url and management_acme_email and CA reachability on port 80. Leave unused ACME fields empty.

Boot and stage Credentials

destructive_enabled=true authorizes erasing the exact matching state disk. Review the configuration and the VM’s disk identity before attaching the medium.

  1. Attach exactly one read-only MTG_AUTOINSTALL filesystem before booting the Management ISO. Keep the console open.

  2. Setup validates the medium on first boot. If the referenced password file or supplied TLS files have not been staged, the console reports invalid unattended media and offers Retry. Leave it at this prompt while staging the files.

  3. Establish authenticated root SSH access to the running host. Verify its SSH host key through the hypervisor console or another trusted channel.

  4. In a Bash session on that host, enter the initial administrator password without putting it in command history:

    umask 077
read -rsp 'Initial administrator password: ' management_setup_password
printf '\n'
printf '%s\n' "$management_setup_password" >/run/mtg-management-bootstrap-password
unset management_setup_password

    Use at least 12 characters. The file must remain root-owned with mode 0600.

  5. If you use supplied-certificate mode, stage the certificate and key in /run/mtg-management-tls before selecting Retry.

The /run staging files are temporary. Stage them during the boot in which initialization runs; restage them after any reboot before setup.

Initialize and Verify

  1. After staging the required files, select Retry on the console’s unattended-media prompt.

  2. Confirm that setup accepts the medium and the exact disk identity. Other invalid or ambiguous inputs still stop initialization; correct the reported cause before retrying.

  3. Wait for Management to start. Verify the public URL, healthy status and certificate, then sign in as mtg-admin with the staged password.

  4. Remove the source password staging file from /run/mtg-management-bootstrap-password after successful setup. Detach the unattended configuration medium. Keep the Management ISO attached.

Setup saves the settings on the state disk. The host retains its own protected pending password file if initial startup is interrupted and removes that pending copy after the first healthy startup.

If setup stops, inspect the console message and logs. Check the volume label, the number of attached configuration media, disk identity, MAC address and root-only credential files. Preserve partially initialized state for investigation. Continue with Make bundles available after successful sign-in.