Chapter 23. Setting up Stratis file systems

Procedure

1. Install packages that provide the Stratis service and command-line utilities:

   Copy to Clipboard Toggle word wrap

   # dnf install stratisd stratis-cli

2. To start the stratisd service and enable it to launch at boot:

   Copy to Clipboard Toggle word wrap

   # systemctl enable --now stratisd

Procedure

1. Erase any file system, partition table, or RAID signatures that exist on each block device that you want to use in the Stratis pool:

   Copy to Clipboard Toggle word wrap

   # wipefs --all block-device

   The block-device value is the path to the block device; for example, /dev/sdb.

2. Create the new unencrypted Stratis pool on the selected block device:

   Copy to Clipboard Toggle word wrap

   # stratis pool create my-pool block-device

   The block-device value is the path to an empty or wiped block device.

   You can also specify multiple block devices on a single line by using the following command:

   Copy to Clipboard Toggle word wrap

   # stratis pool create my-pool block-device-1 block-device-2

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Click Storage.
3. In the Storage table, click the menu button and select Create Stratis pool.
4. In the Name field, enter a name for the Stratis pool.
5. Select the Block devices from which you want to create the Stratis pool.
6. Optional: If you want to specify the maximum size for each file system that is created in the pool, select Manage filesystem sizes.
7. Click Create.

Procedure

1. Erase any file system, partition table, or RAID signatures that exist on each block device that you want to use in the Stratis pool:

   Copy to Clipboard Toggle word wrap

   # wipefs --all block-device

   The block-device value is the path to the block device; for example, /dev/sdb.

2. If you have not set a key already, run the following command and follow the prompts to create a key set to use for the encryption:

   Copy to Clipboard Toggle word wrap

   # stratis key set --capture-key key-description

   The key-description is a reference to the key that gets created in the kernel keyring. You will be prompted to enter a key value at the command-line. You can also place the key value in a file and use the --keyfile-path option instead of the --capture-key option.

3. Create the encrypted Stratis pool and specify the key description to use for the encryption:

   Copy to Clipboard Toggle word wrap

   # stratis pool create --key-desc key-description my-pool block-device

   key-description

   References the key that exists in the kernel keyring, which you created in the previous step.

   my-pool

   Specifies the name of the new Stratis pool.

   block-device

   Specifies the path to an empty or wiped block device.

   You can also specify multiple block devices on a single line by using the following command:

   Copy to Clipboard Toggle word wrap

   # stratis pool create --key-desc key-description my-pool block-device-1 block-device-2

Procedure

1. Erase any file system, partition table, or RAID signatures that exist on each block device that you want to use in the Stratis pool:

   Copy to Clipboard Toggle word wrap

   # wipefs --all block-device

   The block-device value is the path to the block device; for example, /dev/sdb.

2. Create the encrypted Stratis pool and specify the Clevis mechanism to use for the encryption:

   Copy to Clipboard Toggle word wrap

   # stratis pool create --clevis tpm2 my-pool block-device

   tpm2

   Specifies the Clevis mechanism to use.

   my-pool

   Specifies the name of the new Stratis pool.

   block-device

   Specifies the path to an empty or wiped block device.

   Alternatively, use the Clevis tang server mechanism by using the following command:

   Copy to Clipboard Toggle word wrap

   # stratis pool create --clevis tang –tang-url my-url –thumbprint thumbprint my-pool block-device

   tang

   Specifies the Clevis mechanism to use.

   my-url

   Specifies the URL of the tang server.

   thumbprint

   References the thumbprint of the tang server.

   You can also specify multiple block devices on a single line by using the following command:

   Copy to Clipboard Toggle word wrap

   # stratis pool create --clevis tpm2 my-pool block-device-1 block-device-2

Procedure

1. Store your sensitive variables in an encrypted file:

   1. Create the vault:

      Copy to Clipboard Toggle word wrap

      $ ansible-vault create ~/vault.yml
      New Vault password: <vault_password>
      Confirm New Vault password: <vault_password>

   2. After the ansible-vault create command opens an editor, enter the sensitive data in the <key>: <value> format:

      Copy to Clipboard Toggle word wrap

      luks_password: <password>

   3. Save the changes, and close the editor. Ansible encrypts the data in the vault.

2. Create a playbook file, for example ~/playbook.yml, with the following content:

   Copy to Clipboard Toggle word wrap

   ---
   - name: Manage local storage
     hosts: managed-node-01.example.com
     vars_files:
       - ~/vault.yml
     tasks:
       - name: Create a new encrypted Stratis pool with Clevis and Tang
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.storage
         vars:
           storage_pools:
              - name: mypool
                disks:
                  - sdd
                  - sde
                type: stratis
                encryption: true
                encryption_password: "{{ luks_password }}"
                encryption_clevis_pin: tang
                encryption_tang_url: tang-server.example.com:7500

   The settings specified in the example playbook include the following:

   encryption_password

   Password or passphrase used to unlock the LUKS volumes.

   encryption_clevis_pin

   Clevis method that you can use to encrypt the created pool. You can use tang and tpm2.

   encryption_tang_url

   URL of the Tang server.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.storage/README.md file on the control node.

3. Validate the playbook syntax:

   Copy to Clipboard Toggle word wrap

   $ ansible-playbook --ask-vault-pass --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

4. Run the playbook:

   Copy to Clipboard Toggle word wrap

   $ ansible-playbook --ask-vault-pass ~/playbook.yml

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Click Storage.
3. In the Storage table, click the menu button and select Create Stratis pool.
4. In the Name field, enter a name for the Stratis pool.
5. Select the Block devices from which you want to create the Stratis pool.

6. Select the type of encryption, you can use a passphrase, a Tang keyserver, or both:

   • Passphrase:

     1. Enter a passphrase.
     2. Confirm the passphrase.

   • Tang keyserver:

     1. Enter the keyserver address. For more information, see Deploying a Tang server with SELinux in enforcing mode.
7. Optional: If you want to specify the maximum size for each file system that is created in pool, select Manage filesystem sizes.
8. Click Create.

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Click Storage.
3. In the Storage table, click the Stratis pool you want to rename.
4. On the Stratis pool page, click edit next to the Name field.
5. In the Rename Stratis pool dialog box, enter a new name.
6. Click Rename.

1. Create a pool from one or more block devices to make the pool fully provisioned at the time of creation:

   Copy to Clipboard Toggle word wrap

   # stratis pool create --no-overprovision pool-name /dev/sdb

   • By using the --no-overprovision option, the pool cannot allocate more logical space than actual available physical space.

2. Set overprovisioning mode in the existing pool:

   Copy to Clipboard Toggle word wrap

   # stratis pool overprovision pool-name <yes|no>

   • If set to "yes", you enable overprovisioning to the pool. This means that the sum of the logical sizes of the Stratis file systems, supported by the pool, can exceed the amount of available data space. If the pool is overprovisioned and the sum of the logical sizes of all the file systems exceeds the space available on the pool, then the system cannot turn off overprovisioning and returns an error.

Verification

1. View the full list of Stratis pools:

   Copy to Clipboard Toggle word wrap

   # stratis pool list
   
   Name       Total Physical                    Properties    UUID                                  Alerts
   pool-name  1.42 TiB / 23.96 MiB / 1.42 TiB  ~Ca,~Cr,~Op    cb7cb4d8-9322-4ac4-a6fd-eb7ae9e1e540

2. Check if there is an indication of the pool overprovisioning mode flag in the stratis pool list output. The " ~ " is a math symbol for "NOT", so ~Op means no-overprovisioning.

3. Optional: Check overprovisioning on a specific pool:

   Copy to Clipboard Toggle word wrap

   # stratis pool overprovision pool-name yes
   
   # stratis pool list
   
   Name          Total Physical                    Properties     UUID                                   Alerts
   pool-name     1.42 TiB / 23.96 MiB / 1.42 TiB   ~Ca,~Cr,~Op    cb7cb4d8-9322-4ac4-a6fd-eb7ae9e1e540

Procedure

1. Re-create the key set using the same key description that was used previously:

   Copy to Clipboard Toggle word wrap

   # stratis key set --capture-key key-description

   key-description references the key that exists in the kernel keyring, which was generated when you created the encrypted Stratis pool.

2. Verify that the Stratis pool is visible:

   Copy to Clipboard Toggle word wrap

   # stratis pool list

Procedure

1. Create a Stratis file system on a pool:

   Copy to Clipboard Toggle word wrap

   # stratis filesystem create --size number-and-unit my-pool my-fs

   number-and-unit

   Specifies the size of a file system. The specification format must follow the standard size specification format for input, that is B, KiB, MiB, GiB, TiB or PiB.

   my-pool

   Specifies the name of the Stratis pool.

   my-fs

   Specifies an arbitrary name for the file system.

   For example:

   Example 23.1. Creating a Stratis file system

   Copy to Clipboard Toggle word wrap

   # stratis filesystem create --size 10GiB pool1 filesystem1

2. Set a size limit of a file system:

   Copy to Clipboard Toggle word wrap

   # stratis filesystem create --size number-and-unit --size-limit number-and-unit my-pool my-fs

   Note

   This option is available starting with Stratis 3.6.0.

   You can also remove the size limit later, if needed:

   Copy to Clipboard Toggle word wrap

   # stratis filesystem unset-size-limit my-pool my-fs

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Click Storage.
3. Click the Stratis pool on which you want to create a file system.
4. On the Stratis pool page, scroll to the Stratis filesystems section and click Create new filesystem.
5. Enter a name for the file system.
6. Enter a mount point for the file system.
7. Select the mount option.
8. In the At boot drop-down menu, select when you want to mount your file system.

9. Create the file system:

   • If you want to create and mount the file system, click Create and mount.
   • If you want to only create the file system, click Create only.