主页
产品
Red Hat OpenShift Data Foundation
4.18
Managing hybrid and multicloud resources
3.3. Adding storage resources for hybrid or Multicloud using the MCG command line interface

3.3. Adding storage resources for hybrid or Multicloud using the MCG command line interface

The Multicloud Object Gateway (MCG) simplifies the process of spanning data across the cloud provider and clusters.

Add a backing storage that can be used by the MCG.

Depending on the type of your deployment, you can choose one of the following procedures to create a backing storage:

For creating an AWS-backed backingstore, see 第 3.3.1 节 “Creating an AWS-backed backingstore”
For creating an AWS-STS-backed backingstore, see 第 3.3.2 节 “Creating an AWS-STS-backed backingstore”
For creating an IBM COS-backed backingstore, see 第 3.3.3 节 “Creating an IBM COS-backed backingstore”
For creating an Azure-backed backingstore, see 第 3.3.4 节 “Creating an Azure-backed backingstore”
For creating a GCP-backed backingstore, see 第 3.3.5 节 “Creating a GCP-backed backingstore”
For creating a local Persistent Volume-backed backingstore, see 第 3.3.6 节 “Creating a local Persistent Volume-backed backingstore”

For VMware deployments, skip to 第 3.4 节 “Creating an s3 compatible Multicloud Object Gateway backingstore” for further instructions.

3.3.1. Creating an AWS-backed backingstore
复制链接

Prerequisites

Download the Multicloud Object Gateway (MCG) command-line interface binary from the customer portal and make it executable.
注意
Choose the correct product variant according to your architecture. Available platforms are Linux(x86_64), Windows, and Mac OS.

Procedure

Using MCG command-line interface

From the MCG command-line interface, run the following command:
```
noobaa backingstore create aws-s3 <backingstore_name> --access-key=<AWS ACCESS KEY> --secret-key=<AWS SECRET ACCESS KEY> --target-bucket <bucket-name> -n openshift-storage
```
<backingstore_name>
The name of the backingstore.
<AWS ACCESS KEY> and <AWS SECRET ACCESS KEY>
The AWS access key ID and secret access key you created for this purpose.
<bucket-name>
The existing AWS bucket name. This argument indicates to the MCG which bucket to use as a target bucket for its backing store, and subsequently, data storage and administration.
The output will be similar to the following:
INFO[0001] ✅ Exists: NooBaa "noobaa" INFO[0002] ✅ Created: BackingStore "aws-resource" INFO[0002] ✅ Created: Secret "backing-store-secret-aws-resource"

Adding storage resources using a YAML

Create a secret with the credentials:
```
apiVersion: v1
kind: Secret
metadata:
  name: <backingstore-secret-name>
  namespace: openshift-storage
type: Opaque
data:
  AWS_ACCESS_KEY_ID: <AWS ACCESS KEY ID ENCODED IN BASE64>
  AWS_SECRET_ACCESS_KEY: <AWS SECRET ACCESS KEY ENCODED IN BASE64>
```
<AWS ACCESS KEY> and <AWS SECRET ACCESS KEY>
Supply and encode your own AWS access key ID and secret access key using Base64, and use the results for <AWS ACCESS KEY ID ENCODED IN BASE64> and <AWS SECRET ACCESS KEY ENCODED IN BASE64>.
<backingstore-secret-name>
The name of the backingstore secret created in the previous step.

Apply the following YAML for a specific backing store:

apiVersion: noobaa.io/v1alpha1
kind: BackingStore
metadata:
  finalizers:
  - noobaa.io/finalizer
  labels:
    app: noobaa
  name: bs
  namespace: openshift-storage
spec:
  awsS3:
    secret:
      name: <backingstore-secret-name>
      namespace: openshift-storage
    targetBucket: <bucket-name>
  type: aws-s3

<bucket-name>: The existing AWS bucket name.
<backingstore-secret-name>: The name of the backingstore secret created in the previous step.

3.3.2. Creating an AWS-STS-backed backingstore
复制链接

Amazon Web Services Security Token Service (AWS STS) is an AWS feature and it is a way to authenticate using short-lived credentials. Creating an AWS-STS-backed backingstore involves the following:

Creating an AWS role using a script, which helps to get the temporary security credentials for the role session
Installing OpenShift Data Foundation operator in AWS STS OpenShift cluster
Creating backingstore in AWS STS OpenShift cluster

3.3.2.1. Creating an AWS role using a script
复制链接

You need to create a role and pass the role Amazon resource name (ARN) while installing the OpenShift Data Foundation operator.

Prerequisites

Configure Red Hat OpenShift Container Platform cluster with AWS STS. For more information, see Configuring an AWS cluster to use short-term credentials.

Procedure

Create an AWS role using a script that matches OpenID Connect (OIDC) configuration for Multicloud Object Gateway (MCG) on OpenShift Data Foundation.

The following example shows the details that are required to create the role:

{
    “Version”: “2012-10-17",
    “Statement”: [
        {
            “Effect”: “Allow”,
            “Principal”: {
                “Federated”: “arn:aws:iam::123456789123:oidc-provider/mybucket-oidc.s3.us-east-2.amazonaws.com”
            },
            “Action”: “sts:AssumeRoleWithWebIdentity”,
            “Condition”: {
                “StringEquals”: {
                    “mybucket-oidc.s3.us-east-2.amazonaws.com:sub”: [
                        “system:serviceaccount:openshift-storage:noobaa”,
                        "system:serviceaccount:openshift-storage:noobaa-core",
                        “system:serviceaccount:openshift-storage:noobaa-endpoint”
                    ]
                }
            }
        }
    ]
}

where

123456789123: Is the AWS account ID
mybucket: Is the bucket name (using public bucket configuration)
us-east-2: Is the AWS region
openshift-storage: Is the namespace name

Sample script

#!/bin/bash
set -x

# This is a sample script to help you deploy MCG on AWS STS cluster.
# This script shows how to create role-policy and then create the role in AWS.
# For more information see: https://docs.openshift.com/rosa/authentication/assuming-an-aws-iam-role-for-a-service-account.html

# WARNING: This is a sample script. You need to adjust the variables based on your requirement.

# Variables :
# user variables - REPLACE these variables with your values:
ROLE_NAME="<role-name>" # role name that you pick in your AWS account
NAMESPACE="<namespace>" # namespace name where MCG is running. For OpenShift Data Foundation, it is openshift-storage.

# MCG variables
SERVICE_ACCOUNT_NAME_1="noobaa" # The service account name of deployment operator
SERVICE_ACCOUNT_NAME_2="noobaa-endpoint" # The service account name of deployment endpoint
SERVICE_ACCOUNT_NAME_3="noobaa-core" # The service account name of statefulset core

# AWS variables
# Make sure these values are not empty (AWS_ACCOUNT_ID, OIDC_PROVIDER)
# AWS_ACCOUNT_ID is your AWS account number
AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query "Account" --output text)
# If you want to create the role before using the cluster, replace this field too.
# The OIDC provider is in the structure:
# 1) <OIDC-bucket>.s3.<aws-region>.amazonaws.com. for OIDC bucket configurations are in an S3 public bucket
# 2) `<characters>.cloudfront.net` for OIDC bucket configurations in an S3 private bucket with a public CloudFront distribution URL
OIDC_PROVIDER=$(oc get authentication cluster -ojson | jq -r .spec.serviceAccountIssuer | sed -e "s/^https:\/\///")
# the permission (S3 full access)
POLICY_ARN_STRINGS="arn:aws:iam::aws:policy/AmazonS3FullAccess"

# Creating the role (with AWS command line interface)

read -r -d '' TRUST_RELATIONSHIP <<EOF
{
 "Version": "2012-10-17",
 "Statement": [
   {
 	"Effect": "Allow",
 	"Principal": {
   	"Federated": "arn:aws:iam::${AWS_ACCOUNT_ID}:oidc-provider/${OIDC_PROVIDER}"
 	},
 	"Action": "sts:AssumeRoleWithWebIdentity",
 	"Condition": {
   	"StringEquals": {
    	"${OIDC_PROVIDER}:sub": [
      	"system:serviceaccount:${NAMESPACE}:${SERVICE_ACCOUNT_NAME_1}",
      	"system:serviceaccount:${NAMESPACE}:${SERVICE_ACCOUNT_NAME_2}",
        "system:serviceaccount:${NAMESPACE}:${SERVICE_ACCOUNT_NAME_3}"
      	]
   	}
 	}
   }
 ]
}
EOF

echo "${TRUST_RELATIONSHIP}" > trust.json

aws iam create-role --role-name "$ROLE_NAME" --assume-role-policy-document file://trust.json --description "role for demo"

while IFS= read -r POLICY_ARN; do
   echo -n "Attaching $POLICY_ARN ... "
   aws iam attach-role-policy \
   	--role-name "$ROLE_NAME" \
   	--policy-arn "${POLICY_ARN}"
   echo "ok."
done <<< "$POLICY_ARN_STRINGS"

3.3.2.2. Installing OpenShift Data Foundation operator in AWS STS OpenShift cluster
复制链接

Prerequisites

Configure Red Hat OpenShift Container Platform cluster with AWS STS. For more information, see Configuring an AWS cluster to use short-term credentials.
Create an AWS role using a script that matches OpenID Connect (OIDC) configuration. For more information, see Creating an AWS role using a script.

Procedure

Install OpenShift Data Foundation Operator from the Operator Hub.
- During the installation add the role ARN in the ARN Details field.
- Make sure that the Update approval field is set to Manual.

3.3.2.3. Creating a new AWS STS backingstore
复制链接

Prerequisites

Configure Red Hat OpenShift Container Platform cluster with AWS STS. For more information, see Configuring an AWS cluster to use short-term credentials.
Create an AWS role using a script that matches OpenID Connect (OIDC) configuration. For more information, see Creating an AWS role using a script.
Install OpenShift Data Foundation Operator. For more information, see Installing OpenShift Data Foundation operator in AWS STS OpenShift cluster.

Procedure

Install Multicloud Object Gateway (MCG).
It is installed with the default backingstore by using the short-lived credentials.
After the MCG system is ready, you can create more backingstores of the type aws-sts-s3 using the following MCG command line interface command:
```
$ noobaa backingstore create aws-sts-s3 <backingstore-name> --aws-sts-arn=<aws-sts-role-arn> --region=<region> --target-bucket=<target-bucket>
```
where
backingstore-name
Name of the backingstore
aws-sts-role-arn
The AWS STS role ARN which will assume role
region
The AWS bucket region
target-bucket
The target bucket name on the cloud

3.3.3. Creating an IBM COS-backed backingstore
复制链接

Prerequisites

Download the Multicloud Object Gateway (MCG) command-line interface binary from the customer portal and make it executable.
注意
Choose the correct product variant according to your architecture. Available platforms are Linux(x86_64), Windows, and Mac OS.

Procedure

Using command-line interface

From the MCG command-line interface, run the following command:
```
noobaa backingstore create ibm-cos <backingstore_name> --access-key=<IBM ACCESS KEY> --secret-key=<IBM SECRET ACCESS KEY> --endpoint=<IBM COS ENDPOINT> --target-bucket <bucket-name> -n openshift-storage
```
<backingstore_name>
The name of the backingstore.
<IBM ACCESS KEY>, <IBM SECRET ACCESS KEY>, and <IBM COS ENDPOINT>
An IBM access key ID, secret access key and the appropriate regional endpoint that corresponds to the location of the existing IBM bucket.
To generate the above keys on IBM cloud, you must include HMAC credentials while creating the service credentials for your target bucket.
<bucket-name>
An existing IBM bucket name. This argument indicates MCG about the bucket to use as a target bucket for its backing store, and subsequently, data storage and administration.
The output will be similar to the following:
INFO[0001] ✅ Exists: NooBaa "noobaa" INFO[0002] ✅ Created: BackingStore "ibm-resource" INFO[0002] ✅ Created: Secret "backing-store-secret-ibm-resource"

Adding storage resources using an YAML

Create a secret with the credentials:
```
apiVersion: v1
kind: Secret
metadata:
  name: <backingstore-secret-name>
  namespace: openshift-storage
type: Opaque
data:
  IBM_COS_ACCESS_KEY_ID: <IBM COS ACCESS KEY ID ENCODED IN BASE64>
  IBM_COS_SECRET_ACCESS_KEY: <IBM COS SECRET ACCESS KEY ENCODED IN BASE64>
```
<IBM COS ACCESS KEY ID ENCODED IN BASE64> and <IBM COS SECRET ACCESS KEY ENCODED IN BASE64>
Provide and encode your own IBM COS access key ID and secret access key using Base64, and use the results in place of these attributes respectively.
<backingstore-secret-name>
The name of the backingstore secret.
Apply the following YAML for a specific backing store:
```
apiVersion: noobaa.io/v1alpha1
kind: BackingStore
metadata:
  finalizers:
  - noobaa.io/finalizer
  labels:
    app: noobaa
  name: bs
  namespace: openshift-storage
spec:
  ibmCos:
    endpoint: <endpoint>
    secret:
      name: <backingstore-secret-name>
      namespace: openshift-storage
    targetBucket: <bucket-name>
  type: ibm-cos
```
<bucket-name>
an existing IBM COS bucket name. This argument indicates to MCG about the bucket to use as a target bucket for its backingstore, and subsequently, data storage and administration.
<endpoint>
A regional endpoint that corresponds to the location of the existing IBM bucket name. This argument indicates to MCG about the endpoint to use for its backingstore, and subsequently, data storage and administration.
<backingstore-secret-name>
The name of the secret created in the previous step.

3.3.4. Creating an Azure-backed backingstore
复制链接

Prerequisites

Download the Multicloud Object Gateway (MCG) command-line interface binary from the customer portal and make it executable.
注意
Choose the correct product variant according to your architecture. Available platforms are Linux(x86_64), Windows, and Mac OS.

Procedure

Using the MCG command-line interface

From the MCG command-line interface, run the following command:
```
noobaa backingstore create azure-blob <backingstore_name> --account-key=<AZURE ACCOUNT KEY> --account-name=<AZURE ACCOUNT NAME> --target-blob-container <blob container name> -n openshift-storage
```
<backingstore_name>
The name of the backingstore.
<AZURE ACCOUNT KEY> and <AZURE ACCOUNT NAME>
An AZURE account key and account name you created for this purpose.
<blob container name>
An existing Azure blob container name. This argument indicates to MCG about the bucket to use as a target bucket for its backingstore, and subsequently, data storage and administration.
The output will be similar to the following:
INFO[0001] ✅ Exists: NooBaa "noobaa" INFO[0002] ✅ Created: BackingStore "azure-resource" INFO[0002] ✅ Created: Secret "backing-store-secret-azure-resource"

Adding storage resources using a YAML

Create a secret with the credentials:
```
apiVersion: v1
kind: Secret
metadata:
  name: <backingstore-secret-name>
type: Opaque
data:
  AccountName: <AZURE ACCOUNT NAME ENCODED IN BASE64>
  AccountKey: <AZURE ACCOUNT KEY ENCODED IN BASE64>
```
<AZURE ACCOUNT NAME ENCODED IN BASE64> and <AZURE ACCOUNT KEY ENCODED IN BASE64>
Supply and encode your own Azure Account Name and Account Key using Base64, and use the results in place of these attributes respectively.
<backingstore-secret-name>
A unique name of backingstore secret.
Apply the following YAML for a specific backing store:
```
apiVersion: noobaa.io/v1alpha1
kind: BackingStore
metadata:
  finalizers:
  - noobaa.io/finalizer
  labels:
    app: noobaa
  name: bs
  namespace: openshift-storage
spec:
  azureBlob:
    secret:
      name: <backingstore-secret-name>
      namespace: openshift-storage
    targetBlobContainer: <blob-container-name>
  type: azure-blob
```
<blob-container-name>
An existing Azure blob container name. This argument indicates to the MCG about the bucket to use as a target bucket for its backingstore, and subsequently, data storage and administration.
<backingstore-secret-name>
with the name of the secret created in the previous step.

3.3.5. Creating a GCP-backed backingstore
复制链接

Prerequisites

Download the Multicloud Object Gateway (MCG) command-line interface binary from the customer portal and make it executable.
注意
Choose the correct product variant according to your architecture. Available platforms are Linux(x86_64), Windows, and Mac OS.

Procedure

Using the MCG command-line interface

From the MCG command-line interface, run the following command:
```
noobaa backingstore create google-cloud-storage <backingstore_name> --private-key-json-file=<PATH TO GCP PRIVATE KEY JSON FILE> --target-bucket <GCP bucket name> -n openshift-storage
```
<backingstore_name>
Name of the backingstore.
<PATH TO GCP PRIVATE KEY JSON FILE>
A path to your GCP private key created for this purpose.
<GCP bucket name>
An existing GCP object storage bucket name. This argument tells the MCG which bucket to use as a target bucket for its backing store, and subsequently, data storage and administration.
The output will be similar to the following:
INFO[0001] ✅ Exists: NooBaa "noobaa" INFO[0002] ✅ Created: BackingStore "google-gcp" INFO[0002] ✅ Created: Secret "backing-store-google-cloud-storage-gcp"

Adding storage resources using a YAML

Create a secret with the credentials:
```
apiVersion: v1
kind: Secret
metadata:
  name: <backingstore-secret-name>
type: Opaque
data:
  GoogleServiceAccountPrivateKeyJson: <GCP PRIVATE KEY ENCODED IN BASE64>
```
<GCP PRIVATE KEY ENCODED IN BASE64>
Provide and encode your own GCP service account private key using Base64, and use the results for this attribute.
<backingstore-secret-name>
A unique name of the backingstore secret.

Apply the following YAML for a specific backing store:

apiVersion: noobaa.io/v1alpha1
kind: BackingStore
metadata:
  finalizers:
  - noobaa.io/finalizer
  labels:
    app: noobaa
  name: bs
  namespace: openshift-storage
spec:
  googleCloudStorage:
    secret:
      name: <backingstore-secret-name>
      namespace: openshift-storage
    targetBucket: <target bucket>
  type: google-cloud-storage

<target bucket>: An existing Google storage bucket. This argument indicates to the MCG about the bucket to use as a target bucket for its backing store, and subsequently, data storage dfdand administration.
<backingstore-secret-name>: The name of the secret created in the previous step.

3.3.6. Creating a local Persistent Volume-backed backingstore
复制链接

Prerequisites

Download the Multicloud Object Gateway (MCG) command-line interface binary from the customer portal and make it executable.
注意
Choose the correct product variant according to your architecture. Available platforms are Linux(x86_64), Windows, and Mac OS.

Procedure

Adding storage resources using the MCG command-line interface

From the MCG command-line interface, run the following command:

注意

This command must be run from within the openshift-storage namespace.

$ noobaa -n openshift-storage backingstore create pv-pool <backingstore_name> --num-volumes <NUMBER OF VOLUMES>  --pv-size-gb <VOLUME SIZE> --request-cpu <CPU REQUEST> --request-memory <MEMORY REQUEST> --limit-cpu <CPU LIMIT> --limit-memory <MEMORY LIMIT> --storage-class <LOCAL STORAGE CLASS>

Adding storage resources using YAML

Apply the following YAML for a specific backing store:
```
apiVersion: noobaa.io/v1alpha1
kind: BackingStore
metadata:
  finalizers:
  - noobaa.io/finalizer
  labels:
    app: noobaa
  name: <backingstore_name>
  namespace: openshift-storage
spec:
   pvPool:
    numVolumes: <NUMBER OF VOLUMES>
    resources:
      requests:
        storage: <VOLUME SIZE>
        cpu: <CPU REQUEST>
        memory: <MEMORY REQUEST>
      limits:
        cpu: <CPU LIMIT>
        memory: <MEMORY LIMIT>
    storageClass: <LOCAL STORAGE CLASS>
  type: pv-pool
```
<backingstore_name>
The name of the backingstore.
<NUMBER OF VOLUMES>
The number of volumes you would like to create. Note that increasing the number of volumes scales up the storage.
<VOLUME SIZE>
Required size in GB of each volume.
<CPU REQUEST>
Guaranteed amount of CPU requested in CPU unit m.
<MEMORY REQUEST>
Guaranteed amount of memory requested.
<CPU LIMIT>
Maximum amount of CPU that can be consumed in CPU unit m.
<MEMORY LIMIT>
Maximum amount of memory that can be consumed.
<LOCAL STORAGE CLASS>
The local storage class name, recommended to use ocs-storagecluster-ceph-rbd.
The output will be similar to the following:
INFO[0001] ✅ Exists: NooBaa "noobaa" INFO[0002] ✅ Exists: BackingStore "local-mcg-storage"

3.3. Adding storage resources for hybrid or Multicloud using the MCG command line interface

3.3.1. Creating an AWS-backed backingstore
复制链接

3.3.2. Creating an AWS-STS-backed backingstore
复制链接

3.3.2.1. Creating an AWS role using a script
复制链接

3.3.2.2. Installing OpenShift Data Foundation operator in AWS STS OpenShift cluster
复制链接

3.3.2.3. Creating a new AWS STS backingstore
复制链接

3.3.3. Creating an IBM COS-backed backingstore
复制链接

3.3.4. Creating an Azure-backed backingstore
复制链接

3.3.5. Creating a GCP-backed backingstore
复制链接

3.3.6. Creating a local Persistent Volume-backed backingstore
复制链接

学习

尝试、购买和销售

社区

關於紅帽

让开源更具包容性

关于红帽文档

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links

3.3. Adding storage resources for hybrid or Multicloud using the MCG command line interface

3.3.1. Creating an AWS-backed backingstore复制链接链接已复制到粘贴板!

3.3.2. Creating an AWS-STS-backed backingstore复制链接链接已复制到粘贴板!

3.3.2.1. Creating an AWS role using a script复制链接链接已复制到粘贴板!

3.3.2.2. Installing OpenShift Data Foundation operator in AWS STS OpenShift cluster复制链接链接已复制到粘贴板!

3.3.2.3. Creating a new AWS STS backingstore复制链接链接已复制到粘贴板!

3.3.3. Creating an IBM COS-backed backingstore复制链接链接已复制到粘贴板!

3.3.4. Creating an Azure-backed backingstore复制链接链接已复制到粘贴板!

3.3.5. Creating a GCP-backed backingstore复制链接链接已复制到粘贴板!

3.3.6. Creating a local Persistent Volume-backed backingstore复制链接链接已复制到粘贴板!

学习

尝试、购买和销售

社区

關於紅帽

让开源更具包容性

关于红帽文档

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links

3.3.1. Creating an AWS-backed backingstore
复制链接

3.3.2. Creating an AWS-STS-backed backingstore
复制链接

3.3.2.1. Creating an AWS role using a script
复制链接

3.3.2.2. Installing OpenShift Data Foundation operator in AWS STS OpenShift cluster
复制链接

3.3.2.3. Creating a new AWS STS backingstore
复制链接

3.3.3. Creating an IBM COS-backed backingstore
复制链接

3.3.4. Creating an Azure-backed backingstore
复制链接

3.3.5. Creating a GCP-backed backingstore
复制链接

3.3.6. Creating a local Persistent Volume-backed backingstore
复制链接