Chapter 4. Storage classes and storage pools

Procedure

1. Log in to OpenShift Web Console.
2. Click Storage Storage Classes.
3. Click Create Storage Class.
4. Enter the storage class Name and Description.
5. Select either Delete or Retain for the Reclaim Policy. By default, Delete is selected.
6. Select RBD Provisioner which is the plugin used for provisioning the persistent volumes.

7. You can either create a new pool or use an existing one.

   Create a new pool

   1. Enter a name for the pool.
   2. Choose 2-way-Replication or 3-way-Replication as the Data Protection Policy.

   3. Select Enable compression if you need to compress the data.

      Enabling compression can impact application performance and might prove ineffective when data to be written is already compressed or encrypted. Data written before enabling compression will not be compressed.

   4. Click Create to create the storage pool.
   5. Click Finish after the pool is created.
   6. Click Create to create the storage class.

   Use an existing pool

   1. Choose a pool from the list.
   2. Click Create to create the storage class with the selected pool.

Procedure

1. Navigate to Storage Storage Classes.
2. Click Create Storage Class.
3. Enter the storage class Name and Description.
4. Select either Delete or Retain for the Reclaim Policy. By default, Delete is selected.
5. Select RBD Provisioner openshift-storage.rbd.csi.ceph.com which is the plugin used for provisioning the persistent volumes.
6. Select Storage Pool where the volume data will be stored.

7. Select Enable Encryption checkbox.

   1. Key Management Service Provider is set to Vault by default.
   2. Enter Vault Service Name, host Address of Vault server ('https://<hostname or ip>'), and Port number.

   3. Expand Advanced Settings to enter certificate details.

      1. Enter the key value secret path in Backend Path that is dedicated and unique to OpenShift Container Storage.
      2. (Optional) Enter TLS Server Name and Vault Enterprise Namespace.
      3. Provide CA Certificate, Client Certificate and Client Private Key by uploading the respective PEM encoded certificate file.
      4. Click Save.
   4. Click Connect.
8. Review external key management service Connection details. To modify the information, click Change connection details and edit the fields.
9. Click Create.

10. Edit the configmap to add the VAULT_BACKEND parameter if the Hashicorp Vault setup does not allow automatic detection of the Key/Value (KV) secret engine API version used by the backend path.

    Note

    VAULT_BACKEND is an optional parameter that is added to the configmap to specify the version of the KV secret engine API associated with the backend path. Ensure that the value matches the KV secret engine API version that is set for the backend path, otherwise it might result in a failure during persistent volume claim (PVC) creation.

    1. Identify the encryptionKMSID being used by the newly created storage class.

       1. On the OpenShift Web Console, navigate to Storage Storage Classes.
       2. Click the Storage class name YAML tab.

       3. Capture the encryptionKMSID being used by the storage class.

          Example:

          encryptionKMSID: 1-vault

    2. On the OpenShift Web Console, navigate to Workloads ConfigMaps.
    3. To view the KMS connection details, click csi-kms-connection-details.

    4. Edit the configmap.

       1. Click Action menu (⋮) Edit ConfigMap.

       2. Add the VAULT_BACKEND parameter depending on the backend that is configured for the previously identified encryptionKMSID.

          You can assign kv for KV secret engine API, version 1 and kv-v2 for KV secret engine API, version 2 as the VAULT_BACKEND parameter.

          Example:

          kind: ConfigMap
          apiVersion: v1
          metadata:
            name: csi-kms-connection-details
          [...]
          data:
            1-vault: >-
          
              {
                "KMS_PROVIDER": "vaulttokens",
                "KMS_SERVICE_NAME": "vault",
                [...]
                "VAULT_BACKEND": "kv-v2"
              }

       3. Click Save.