Chapter 1. Preparing to deploy OpenShift Container Storage

Procedure

1. Log in to the Red Hat Enterprise Linux based node and open a terminal.

2. For each node in your cluster:

   1. Verify that the node has access to the rhel-7-server-extras-rpms repository.

      # subscription-manager repos --list-enabled | grep rhel-7-server

      Copy to Clipboard Toggle word wrap

      If you do not see both rhel-7-server-rpms and rhel-7-server-extras-rpms in the output, or if there is no output, run the following commands to enable each repository.

      # subscription-manager repos --enable=rhel-7-server-rpms
      # subscription-manager repos --enable=rhel-7-server-extras-rpms

      Copy to Clipboard Toggle word wrap

   2. Install the required packages.

      # yum install -y policycoreutils container-selinux

      Copy to Clipboard Toggle word wrap

   3. Persistently enable container use of the Ceph file system in SELinux.

      # setsebool -P container_use_cephfs on

      Copy to Clipboard Toggle word wrap

Procedure

1. Enable the Key/Value (KV) backend path in Vault.

   For Vault KV secret engine API, version 1:

   $ vault secrets enable -path=ocs kv

   Copy to Clipboard Toggle word wrap

   For Vault KV secret engine API, version 2:

   $ vault secrets enable -path=ocs kv-v2

   Copy to Clipboard Toggle word wrap

2. Create a policy to restrict users to perform a write or delete operation on the secret using the following commands:

   echo '
   path "ocs/*" {
     capabilities = ["create", "read", "update", "delete", "list"]
   }
   path "sys/mounts" {
   capabilities = ["read"]
   }'| vault policy write ocs -

   Copy to Clipboard Toggle word wrap

3. Create a token matching the above policy:

   $ vault token create -policy=ocs -format json

   Copy to Clipboard Toggle word wrap