Chapter 2. Storage classes

1. In the OpenShift Container Platform web console, navigate to Workloads Secrets.
2. Click Create Key/value secret.
3. Enter Secret Name as ceph-csi-kms-token.
4. Enter Key as token.

5. Enter Value.

   It is the token from Vault. You can either click Browse to select and upload the file containing the token or enter the token directly in the text box.

6. Click Create.

Prerequisites

1. Create a KMIP client if one does not exist. From the user interface, select KMIP Client Profile Add Profile.

   1. Add the CipherTrust username to the Common Name field during profile creation.
2. Create a token be navigating to KMIP Registration Token New Registration Token. Copy the token for the next step.
3. To register the client, navigate to KMIP Registered Clients Add Client. Specify the Name. Paste the Registration Token from the previous step, then click Save.
4. Download the Private Key and Client Certificate by clicking Save Private Key and Save Certificate respectively.

5. To create a new KMIP interface, navigate to Admin Settings Interfaces Add Interface.

   1. Select KMIP Key Management Interoperability Protocol and click Next.
   2. Select a free Port.
   3. Select Network Interface as all.
   4. Select Interface Mode as TLS, verify client cert, user name taken from client cert, auth request is optional.
   5. (Optional) You can enable hard delete to delete both meta-data and material when the key is deleted. It is disabled by default.
   6. Select the CA to be used, and click Save.
6. To get the server CA certificate, click on the Action menu (⋮) on the right of the newly created interface, and click Download Certificate.

Procedure

1. To create a key to act as the Key Encryption Key (KEK) for storageclass encryption, follow the steps below:

   1. Navigate to Keys Add Key.
   2. Enter Key Name.
   3. Set the Algorithm and Size to AES and 256 respectively.
   4. Enable Create a key in Pre-Active state and set the date and time for activation.
   5. Ensure that Encrypt and Decrypt are enabled under Key Usage.
   6. Copy the ID of the newly created Key to be used as the Unique Identifier during deployment.

1. Apply the following YAML to your Openshift cluster:

   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: rbd-csi-vault-token-review
   ---
   kind: ClusterRole
   apiVersion: rbac.authorization.k8s.io/v1
   metadata:
     name: rbd-csi-vault-token-review
   rules:
     - apiGroups: ["authentication.k8s.io"]
       resources: ["tokenreviews"]
       verbs: ["create", "get", "list"]
   
   ---
   kind: ClusterRoleBinding
   apiVersion: rbac.authorization.k8s.io/v1
   metadata:
     name: rbd-csi-vault-token-review
   subjects:
     - kind: ServiceAccount
       name: rbd-csi-vault-token-review
       namespace: openshift-storage
   roleRef:
     kind: ClusterRole
     name: rbd-csi-vault-token-review
     apiGroup: rbac.authorization.k8s.io

2. Create a secret for serviceaccount token and CA certificate.

   $ cat <<EOF | oc create -f -
   apiVersion: v1
   kind: Secret
   metadata:
     name: rbd-csi-vault-token-review-token
     namespace: openshift-storage
     annotations:
       kubernetes.io/service-account.name: "rbd-csi-vault-token-review"
   type: kubernetes.io/service-account-token
   data: {}
   EOF

3. Get the token and the CA certificate from the secret.

   $ SA_JWT_TOKEN=$(oc -n openshift-storage get secret rbd-csi-vault-token-review-token -o jsonpath="{.data['token']}" | base64 --decode; echo)
   $ SA_CA_CRT=$(oc -n openshift-storage get secret rbd-csi-vault-token-review-token -o jsonpath="{.data['ca\.crt']}" | base64 --decode; echo)

4. Retrieve the OpenShift cluster endpoint.

   $ OCP_HOST=$(oc config view --minify --flatten -o jsonpath="{.clusters[0].cluster.server}")

5. Use the information collected in the previous steps to set up the kubernetes authentication method in Vault as shown:

   $ vault auth enable kubernetes
   $ vault write auth/kubernetes/config \
             token_reviewer_jwt="$SA_JWT_TOKEN" \
             kubernetes_host="$OCP_HOST" \
             kubernetes_ca_cert="$SA_CA_CRT"

6. Create a role in Vault for the tenant namespace:

   $ vault write "auth/kubernetes/role/csi-kubernetes" bound_service_account_names="ceph-csi-vault-sa" bound_service_account_namespaces=<tenant_namespace> policies=<policy_name_in_vault>

   csi-kubernetes is the default role name that OpenShift Data Foundation looks for in Vault. The default service account name in the tenant namespace in the OpenShift Data Foundation cluster is ceph-csi-vault-sa. These default values can be overridden by creating a ConfigMap in the tenant namespace.

   For more information about overriding the default names, see Overriding Vault connection details using tenant ConfigMap.

Procedure

1. Ensure that you are in the tenant namespace.
2. Click on Workloads ConfigMaps.
3. Click on Create ConfigMap.

4. The following is a sample yaml. The values to be overidden for the given tenant namespace can be specified under the data section as shown below:

   ---
   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: ceph-csi-kms-config
   data:
     vaultAddress: "<vault_address:port>"
     vaultBackendPath: "<backend_path>"
     vaultTLSServerName: "<vault_tls_server_name>"
     vaultNamespace: "<vault_namespace>"

5. After the yaml is edited, click on Create.