13.2. Customizing nodes

Procedure

1. Register a RHEL 8 system:

   # subscription-manager register

2. Attach a subscription to the RHEL 8 system:

   # subscription-manager attach --auto

3. Install software that is required to build the software and container:

   # yum install podman make git -y

4. Clone the kmod-via-containers repository:

   1. Create a folder for the repository:

      $ mkdir kmods; cd kmods

   2. Clone the repository:

      $ git clone https://github.com/kmods-via-containers/kmods-via-containers

5. Install a KVC framework instance on your RHEL 8 build host to test the module. This adds a kmods-via-container systemd service and loads it:

   1. Change to the kmod-via-containers directory:

      $ cd kmods-via-containers/

   2. Install the KVC framework instance:

      $ sudo make install

   3. Reload the systemd manager configuration:

      $ sudo systemctl daemon-reload

6. Get the kernel module source code. The source code might be used to build a third-party module that you do not have control over, but is supplied by others. You will need content similar to the content shown in the kvc-simple-kmod example that can be cloned to your system as follows:

   $ cd .. ; git clone https://github.com/kmods-via-containers/kvc-simple-kmod

7. Edit the configuration file, simple-kmod.conf file, in this example, and change the name of the Dockerfile to Dockerfile.rhel:

   1. Change to the kvc-simple-kmod directory:

      $ cd kvc-simple-kmod

   2. Rename the Dockerfile:

      $ cat simple-kmod.conf

      Example Dockerfile

      KMOD_CONTAINER_BUILD_CONTEXT="https://github.com/kmods-via-containers/kvc-simple-kmod.git"
      KMOD_CONTAINER_BUILD_FILE=Dockerfile.rhel
      KMOD_SOFTWARE_VERSION=dd1a7d4
      KMOD_NAMES="simple-kmod simple-procfs-kmod"

8. Create an instance of kmods-via-containers@.service for your kernel module, simple-kmod in this example:

   $ sudo make install

9. Enable the kmods-via-containers@.service instance:

   $ sudo kmods-via-containers build simple-kmod $(uname -r)

10. Enable and start the systemd service:

    1. Enable the service:

       $ sudo systemctl enable kmods-via-containers@simple-kmod.service

    2. Start the service:

       $ sudo systemctl start kmods-via-containers@simple-kmod.service

    3. Review the service status:

       $ sudo systemctl status kmods-via-containers@simple-kmod.service

       Example output

       ● kmods-via-containers@simple-kmod.service - Kmods Via Containers - simple-kmod
          Loaded: loaded (/etc/systemd/system/kmods-via-containers@.service;
                 enabled; vendor preset: disabled)
          Active: active (exited) since Sun 2020-01-12 23:49:49 EST; 5s ago...

11. To confirm that the kernel modules are loaded, use the lsmod command to list the modules:

    $ lsmod | grep simple_

    Example output

    simple_procfs_kmod     16384  0
    simple_kmod            16384  0

12. Optional. Use other methods to check that the simple-kmod example is working:

    • Look for a "Hello world" message in the kernel ring buffer with dmesg:

      $ dmesg | grep 'Hello world'

      Example output

      [ 6420.761332] Hello world from simple_kmod.

    • Check the value of simple-procfs-kmod in /proc:

      $ sudo cat /proc/simple-procfs-kmod

      Example output

      simple-procfs-kmod number = 0

    • Run the spkut command to get more information from the module:

      $ sudo spkut 44

      Example output

      KVC: wrapper simple-kmod for 4.18.0-147.3.1.el8_1.x86_64
      Running userspace wrapper using the kernel module container...
      + podman run -i --rm --privileged
         simple-kmod-dd1a7d4:4.18.0-147.3.1.el8_1.x86_64 spkut 44
      simple-procfs-kmod number = 0
      simple-procfs-kmod number = 44

Procedure

1. Check to see if TPM v2 encryption needs to be enabled in the BIOS on each node. This is required on most Dell systems. Check the manual for your computer.

2. Generate the Kubernetes manifests for the cluster:

   $ ./openshift-install create manifests --dir=<installation_directory>

3. In the openshift directory, create master or worker files to encrypt disks for those nodes.

   • To create a worker file, run the following command:

     $ cat << EOF > ./99-openshift-worker-tpmv2-encryption.yaml
     apiVersion: machineconfiguration.openshift.io/v1
     kind: MachineConfig
     metadata:
       name: worker-tpm
       labels:
         machineconfiguration.openshift.io/role: worker
     spec:
       config:
         ignition:
           version: 2.2.0
         storage:
           files:
           - contents:
               source: data:text/plain;base64,e30K
             filesystem: root
             mode: 420
             path: /etc/clevis.json
     EOF

   • To create a master file, run the following command:

     $ cat << EOF > ./99-openshift-master-tpmv2-encryption.yaml
     apiVersion: machineconfiguration.openshift.io/v1
     kind: MachineConfig
     metadata:
       name: master-tpm
       labels:
         machineconfiguration.openshift.io/role: master
     spec:
       config:
         ignition:
           version: 2.2.0
         storage:
           files:
           - contents:
               source: data:text/plain;base64,e30K
             filesystem: root
             mode: 420
             path: /etc/clevis.json
     EOF

4. Make a backup copy of the YAML file. You should do this because the file will be deleted when you create the cluster.
5. Continue with the remainder of the OpenShift Container Platform deployment.

Procedure

1. Access a Red Hat Enterprise Linux server from which you can configure the encryption settings and run openshift-install to install a cluster and oc to work with it.
2. Set up or access an existing Tang server. See Network-bound disk encryption for instructions. See Securing Automated Decryption New Cryptography and Techniques for a presentation on Tang.
3. Add kernel arguments to configure networking when you do the Red Hat Enterprise Linux CoreOS (RHCOS) installations for your cluster. For example, to configure DHCP networking, identify ip=dhcp, or set static networking when you add parameters to the kernel command line. For both DHCP and static networking, you also must provide the rd.neednet=1 kernel argument.

4. Install the clevis package, if it is not already installed:

5. Generate a thumbprint from the Tang server.

   1. In the following command, replace the value of url with the Tang server URL:

      $ echo nifty random wordwords \
           | clevis-encrypt-tang \
             '{"url":"https://tang.example.org"}'

      Example output

      The advertisement contains the following signing keys:
      
      PLjNyRdGw03zlRoGjQYMahSZGu9

   2. When the Do you wish to trust these keys? [ynYN] prompt displays, type Y, and the thumbprint is displayed:

      Example output

      eyJhbmc3SlRyMXpPenc3ajhEQ01tZVJiTi1oM...

6. Create a Base64 encoded file, replacing the URL of the Tang server (url) and thumbprint (thp) you just generated:

   $ (cat <<EOM
   {
    "url": "https://tang.example.com",
    "thp": "PLjNyRdGw03zlRoGjQYMahSZGu9"
   }
   EOM
   ) | base64 -w0

   Example output

   ewogInVybCI6ICJodHRwczovL3RhbmcuZXhhbXBsZS5jb20iLAogInRocCI6ICJaUk1leTFjR3cwN3psVExHYlhuUWFoUzBHdTAiCn0K

7. In the openshift directory, create master or worker files to encrypt disks for those nodes.

   • For worker nodes, use the following command:

     $ cat << EOF > ./99-openshift-worker-tang-encryption.yaml
     apiVersion: machineconfiguration.openshift.io/v1
     kind: MachineConfig
     metadata:
       name: worker-tang
       labels:
         machineconfiguration.openshift.io/role: worker
     spec:
       config:
         ignition:
           version: 2.2.0
         storage:
           files:
           - contents:
               source: data:text/plain;base64,e30K
               source: data:text/plain;base64,ewogInVybCI6ICJodHRwczovL3RhbmcuZXhhbXBsZS5jb20iLAogInRocCI6ICJaUk1leTFjR3cwN3psVExHYlhuUWFoUzBHdTAiCn0K
             filesystem: root
             mode: 420
             path: /etc/clevis.json
     EOF

   • For master nodes, use the following command:

     $ cat << EOF > ./99-openshift-master-tang-encryption.yaml
     apiVersion: machineconfiguration.openshift.io/v1
     kind: MachineConfig
     metadata:
       name: master-tang
       labels:
         machineconfiguration.openshift.io/role: master
     spec:
       config:
         ignition:
           version: 2.2.0
         storage:
           files:
           - contents:
               source: data:text/plain;base64,e30K
               source: data:text/plain;base64,ewogInVybCI6ICJodHRwczovL3RhbmcuZXhhbXBsZS5jb20iLAogInRocCI6ICJaUk1leTFjR3cwN3psVExHYlhuUWFoUzBHdTAiCn0K
             filesystem: root
             mode: 420
             path: /etc/clevis.json
     EOF

8. Add the rd.neednet=1 kernel argument, as shown in the following example:

     apiVersion: machineconfiguration.openshift.io/v1
     kind: MachineConfig
     metadata:
       name: <node_type>-tang <.>
     spec:
       config:
         ignition:
           version: 3.1.0
       kernelArguments:
         - rd.neednet=1 <.>

   Use the name you defined in the previous examples based on the type of node you are configuring, for example: name: worker-tang.

   Required.

9. Continue with the remainder of the OpenShift Container Platform deployment.