Chapter 27. Setting up Stratis file systems

Procedure

1. Install packages that provide the Stratis service and command-line utilities:

   # dnf install stratisd stratis-cli

   Copy to Clipboard

2. To start the stratisd service and enable it to launch at boot:

   # systemctl enable --now stratisd

   Copy to Clipboard

Procedure

1. Erase any file system, partition table, or RAID signatures that exist on each block device that you want to use in the Stratis pool:

   # wipefs --all block-device

   Copy to Clipboard

   The block-device value is the path to the block device; for example, /dev/sdb.

2. Create the new unencrypted Stratis pool on the selected block device:

   # stratis pool create my-pool block-device

   Copy to Clipboard

   The block-device value is the path to an empty or wiped block device.

   You can also specify multiple block devices on a single line by using the following command:

   # stratis pool create my-pool block-device-1 block-device-2

   Copy to Clipboard

Procedure

1. Log in to the RHEL 10 web console.

   For details, see Logging in to the web console.

2. Click Storage.
3. In the Storage table, click the menu button and select Create Stratis pool.
4. In the Name field, enter a name for the Stratis pool.
5. Select the Block devices from which you want to create the Stratis pool.
6. Optional: If you want to specify the maximum size for each file system that is created in the pool, select Manage filesystem sizes.
7. Click Create.

Procedure

1. Erase any file system, partition table, or RAID signatures that exist on each block device that you want to use in the Stratis pool:

   # wipefs --all block-device

   Copy to Clipboard

   The block-device value is the path to the block device; for example, /dev/sdb.

2. If you have not set a key already, run the following command and follow the prompts to create a key set to use for the encryption:

   # stratis key set --capture-key key-description

   Copy to Clipboard

   The key-description is a reference to the key that gets created in the kernel keyring. You will be prompted to enter a key value at the command-line. You can also place the key value in a file and use the --keyfile-path option instead of the --capture-key option.

3. Create the encrypted Stratis pool and specify the key description to use for the encryption:

   # stratis pool create --key-desc key-description my-pool block-device

   Copy to Clipboard

   key-description

   References the key that exists in the kernel keyring, which you created in the previous step.

   my-pool

   Specifies the name of the new Stratis pool.

   block-device

   Specifies the path to an empty or wiped block device.

   You can also specify multiple block devices on a single line by using the following command:

   # stratis pool create --key-desc key-description my-pool block-device-1 block-device-2

   Copy to Clipboard

Procedure

1. Erase any file system, partition table, or RAID signatures that exist on each block device that you want to use in the Stratis pool:

   # wipefs --all block-device

   Copy to Clipboard

   The block-device value is the path to the block device; for example, /dev/sdb.

2. Create the encrypted Stratis pool and specify the Clevis mechanism to use for the encryption:

   # stratis pool create --clevis tpm2 my-pool block-device

   Copy to Clipboard

   tpm2

   Specifies the Clevis mechanism to use.

   my-pool

   Specifies the name of the new Stratis pool.

   block-device

   Specifies the path to an empty or wiped block device.

   Alternatively, use the Clevis tang server mechanism by using the following command:

   # stratis pool create --clevis tang --tang-url my-url --thumbprint thumbprint my-pool block-device

   Copy to Clipboard

   tang

   Specifies the Clevis mechanism to use.

   my-url

   Specifies the URL of the tang server.

   thumbprint

   References the thumbprint of the tang server.

   You can also specify multiple block devices on a single line by using the following command:

   # stratis pool create --clevis tpm2 my-pool block-device-1 block-device-2

   Copy to Clipboard

Procedure

1. Store your sensitive variables in an encrypted file:

   1. Create the vault:

      $ ansible-vault create ~/vault.yml
      New Vault password: <vault_password>
      Confirm New Vault password: <vault_password>

      Copy to Clipboard

   2. After the ansible-vault create command opens an editor, enter the sensitive data in the <key>: <value> format:

      luks_password: <password>

      Copy to Clipboard
   3. Save the changes, and close the editor. Ansible encrypts the data in the vault.

2. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: Manage local storage
     hosts: managed-node-01.example.com
     vars_files:
       - ~/vault.yml
     tasks:
       - name: Create a new encrypted Stratis pool with Clevis and Tang
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.storage
         vars:
           storage_pools:
              - name: mypool
                disks:
                  - sdd
                  - sde
                type: stratis
                encryption: true
                encryption_password: "{{ luks_password }}"
                encryption_clevis_pin: tang
                encryption_tang_url: tang-server.example.com:7500

   Copy to Clipboard

   The settings specified in the example playbook include the following:

   encryption_password

   Password or passphrase used to unlock the LUKS volumes.

   encryption_clevis_pin

   Clevis method that you can use to encrypt the created pool. You can use tang and tpm2.

   encryption_tang_url

   URL of the Tang server.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.storage/README.md file on the control node.

3. Validate the playbook syntax:

   $ ansible-playbook --ask-vault-pass --syntax-check ~/playbook.yml

   Copy to Clipboard

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

4. Run the playbook:

   $ ansible-playbook --ask-vault-pass ~/playbook.yml

   Copy to Clipboard

Procedure

1. Log in to the RHEL 10 web console.

   For details, see Logging in to the web console.

2. Click Storage.
3. In the Storage table, click the menu button and select Create Stratis pool.
4. In the Name field, enter a name for the Stratis pool.
5. Select the Block devices from which you want to create the Stratis pool.

6. Select the type of encryption, you can use a passphrase, a Tang keyserver, or both:

   • Passphrase:

     1. Enter a passphrase.
     2. Confirm the passphrase.

   • Tang keyserver:

     1. Enter the keyserver address. For more information, see Deploying a Tang server with SELinux in enforcing mode.
7. Optional: If you want to specify the maximum size for each file system that is created in pool, select Manage filesystem sizes.
8. Click Create.

Procedure

1. Log in to the RHEL 10 web console.

   For details, see Logging in to the web console.

2. Click Storage.
3. In the Storage table, click the Stratis pool you want to rename.
4. On the Stratis pool page, click edit next to the Name field.
5. In the Rename Stratis pool dialog box, enter a new name.
6. Click Rename.

1. Create a pool from one or more block devices to make the pool fully provisioned at the time of creation:

   # stratis pool create --no-overprovision pool-name /dev/sdb

   Copy to Clipboard
   • By using the --no-overprovision option, the pool cannot allocate more logical space than actual available physical space.

2. Set overprovisioning mode in the existing pool:

   # stratis pool overprovision pool-name <yes|no>

   Copy to Clipboard
   • If set to "yes", you enable overprovisioning to the pool. This means that the sum of the logical sizes of the Stratis file systems, supported by the pool, can exceed the amount of available data space. If the pool is overprovisioned and the sum of the logical sizes of all the file systems exceeds the space available on the pool, then the system cannot turn off overprovisioning and returns an error.

Verification

1. View the full list of Stratis pools:

   # stratis pool list
   
   Name       Total Physical                    Properties    UUID                                  Alerts
   pool-name  1.42 TiB / 23.96 MiB / 1.42 TiB  ~Ca,~Cr,~Op    cb7cb4d8-9322-4ac4-a6fd-eb7ae9e1e540

   Copy to Clipboard
2. Check if there is an indication of the pool overprovisioning mode flag in the stratis pool list output. The " ~ " is a math symbol for "NOT", so ~Op means no-overprovisioning.

3. Optional: Check overprovisioning on a specific pool:

   # stratis pool overprovision pool-name yes
   
   # stratis pool list
   
   Name          Total Physical                    Properties     UUID                                   Alerts
   pool-name     1.42 TiB / 23.96 MiB / 1.42 TiB   ~Ca,~Cr,~Op    cb7cb4d8-9322-4ac4-a6fd-eb7ae9e1e540

   Copy to Clipboard

Procedure

1. Re-create the key set using the same key description that was used previously:

   # stratis key set --capture-key key-description

   Copy to Clipboard

   key-description references the key that exists in the kernel keyring, which was generated when you created the encrypted Stratis pool.

2. Verify that the Stratis pool is visible:

   # stratis pool list

   Copy to Clipboard

Procedure

1. Create a Stratis file system on a pool:

   # stratis filesystem create --size number-and-unit my-pool my-fs

   Copy to Clipboard

   number-and-unit

   Specifies the size of a file system. The specification format must follow the standard size specification format for input, that is B, KiB, MiB, GiB, TiB or PiB.

   my-pool

   Specifies the name of the Stratis pool.

   my-fs

   Specifies an arbitrary name for the file system.

   For example:

   Example 27.1. Creating a Stratis file system

   # stratis filesystem create --size 10GiB pool1 filesystem1

   Copy to Clipboard

2. Set a size limit of a file system:

   # stratis filesystem create --size number-and-unit --size-limit number-and-unit my-pool my-fs

   Copy to Clipboard
   Note

   This option is available starting with Stratis 3.6.0.

   You can also remove the size limit later, if needed:

   # stratis filesystem unset-size-limit my-pool my-fs

   Copy to Clipboard

Procedure

1. Log in to the RHEL 10 web console.

   For details, see Logging in to the web console.

2. Click Storage.
3. Click the Stratis pool on which you want to create a file system.
4. On the Stratis pool page, scroll to the Stratis filesystems section and click Create new filesystem.
5. Enter a name for the file system.
6. Enter a mount point for the file system.
7. Select the mount option.
8. In the At boot drop-down menu, select when you want to mount your file system.

9. Create the file system:

   • If you want to create and mount the file system, click Create and mount.
   • If you want to only create the file system, click Create only.