Questo contenuto non è disponibile nella lingua selezionata.
Chapter 1. Preparing to deploy OpenShift Data Foundation
When you deploy OpenShift Data Foundation on Red Hat OpenShift Container Platform using local storage devices, you can create internal cluster resources. This approach internally provisions base services and all applications can access additional storage classes.
Before you begin the deployment of Red Hat OpenShift Data Foundation using local storage, ensure that your resource requirements are met. See requirements for installing OpenShift Data Foundation using local storage devices.
On the external key management system (KMS),
- When the Token authentication method is selected for encryption then refer to Enabling cluster-wide encryption with the Token authentication using KMS.
- Ensure that you are using signed certificates on your Vault servers.
After you have addressed the above, follow these steps in the order given:
- Install the Red Hat OpenShift Data Foundation Operator.
- Install Local Storage Operator.
- Find the available storage devices.
- link:https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.17/html-single/deploying_openshift_data_foundation_using_ibm_z/index#creating-openshift-data-foundation-cluster-on-ibmz_ibmz[Create the OpenShift Data Foundation cluster service on IBM Z.
1.1. Requirements for installing OpenShift Data Foundation using local storage devices Copia collegamentoCollegamento copiato negli appunti!
Node requirements
The cluster must consist of at least three OpenShift Container Platform worker or infrastructure nodes with locally attached-storage devices on each of them.
- Each of the three selected nodes must have at least one raw block device available. OpenShift Data Foundation uses the one or more available raw block devices.
Make sure that the devices have a unique by-id device name for each available raw block device.
- The devices you use must be empty, the disks must not include Physical Volumes (PVs), Volume Groups (VGs), or Logical Volumes (LVs) remaining on the disk.
For more information, see the Resource requirements section in the Planning guide.
1.2. Enabling cluster-wide encryption with KMS using the Token authentication method Copia collegamentoCollegamento copiato negli appunti!
You can enable the key value backend path and policy in the vault for token authentication.
Prerequisites
- Administrator access to the vault.
- A valid Red Hat OpenShift Data Foundation Advanced subscription. For more information, see the knowledgebase article on OpenShift Data Foundation subscriptions.
-
Carefully, select a unique path name as the backend
paththat follows the naming convention since you cannot change it later.
Procedure
Enable the Key/Value (KV) backend path in the vault.
For vault KV secret engine API, version 1:
$ vault secrets enable -path=odf kvFor vault KV secret engine API, version 2:
$ vault secrets enable -path=odf kv-v2Create a policy to restrict the users to perform a write or delete operation on the secret:
echo ' path "odf/*" { capabilities = ["create", "read", "update", "delete", "list"] } path "sys/mounts" { capabilities = ["read"] }'| vault policy write odf -Create a token that matches the above policy:
$ vault token create -policy=odf -format json