Fedora Kickstart Guide: Validate the File and the Installed Host

A Kickstart release gate has two halves. First, parse the file for the exact Fedora or RHEL target. Second, install and boot a disposable machine because script behavior, repositories, disks, and hardware sit outside the parser's proof.

Kickstart gives Anaconda the answers that would otherwise be collected interactively. The pykickstart project's command reference covers Fedora and Red Hat Enterprise Linux commands as well as %packages, %pre, %post, and error sections. A missing required command can cause Anaconda to prompt, which looks like a hang on a machine with no attached display.

Keep commands and script sections separate

text
cdrom
lang en_US.UTF-8
keyboard --xlayouts='us'
timezone UTC --utc
network --bootproto=dhcp --device=link --activate --hostname=edge-01

rootpw --lock
user --name=ops --groups=wheel --password='$6$REPLACE_WITH_SHA512_CRYPT' --iscrypted
sshkey --username=ops "ssh-ed25519 AAAA... operator@example"

firewall --enabled --service=ssh
selinux --enforcing
ignoredisk --only-use=vda
clearpart --all --initlabel --drives=vda
autopart --type=lvm
reboot

%packages
@^minimal-environment
openssh-server
curl
jq
%end

%post --erroronfail
systemctl enable sshd
%end

This example assumes full installation media through cdrom and one virtual disk named vda. Change both assumptions as a pair. For network installation, use the source command and repository URLs approved for the release. For physical machines, inspect stable paths under /dev/disk/by-id before using a selector with clearpart.

Validate against the intended version

Install pykickstart and run ksvalidatorbefore handing the file to Anaconda. Red Hat's current RHEL 10 guide uses a version-qualified command:

ksvalidator -v RHEL10 /path/to/kickstart.ks

The Red Hat Kickstart guide states the limit plainly: validation checks syntax and deprecated options, but it does not validate %pre, %post, or %packages behavior.

Release checks after Anaconda exits

• Boot from the installed disk with the Kickstart source unavailable.
• Connect through the intended SSH key and confirm the password policy.
• Read getenforce and the active firewalld service rules.
• Confirm the root volume and any ignored disks match the reviewed inventory.
• Restart and prove sshd and the workload service return.

OpenFactory's useful role is the behavior loop around the machine: build, boot, inspect, and retain acceptance checks. Keep Kickstart when Anaconda is the right installer. Keep the release contract independent so a later move to an image builder does not discard the proof.