Chapter 1. Preparing to deploy OpenShift Container Storage
Deploying OpenShift Container Storage on OpenShift Container Platform using dynamic or local storage devices provides you with the option to create internal cluster resources. This will result in the internal provisioning of the base services, which helps to make additional storage classes available to applications.
Before you begin the deployment of Red Hat OpenShift Container Storage using dynamic or local storage, ensure that your resource requirements are met. See Planning your deployment.
For Red Hat Enterprise Linux based hosts for worker nodes in a user provisioned infrastructure (UPI), enable the container access to the underlying file system. Follow the instructions on enable file system access for containers on Red Hat Enterprise Linux based nodes.
NoteSkip this step for Red Hat Enterprise Linux CoreOS (RHCOS).
Optional: If you want to enable cluster-wide encryption using an external Key Management System (KMS):
- Ensure that a policy with a token exists and the key value backend path in Vault is enabled. See enabling key value backend path and policy in vault.
- Ensure that you are using signed certificates on your Vault servers.
Minimum starting node requirements [Technology Preview]
An OpenShift Container Storage cluster will be deployed with minimum configuration when the standard deployment resource requirement is not met. See Resource requirements section in Planning guide.
- For deploying using local storage devices, see requirements for installing OpenShift Container Storage using local storage devices. These are not applicable for deployment using dynamic storage devices.
1.1. Enabling file system access for containers on Red Hat Enterprise Linux based nodes
Deploying OpenShift Container Storage on an OpenShift Container Platform with worker nodes on a Red Hat Enterprise Linux base in a user provisioned infrastructure (UPI) does not automatically provide container access to the underlying Ceph file system.
Skip this step for hosts based on Red Hat Enterprise Linux CoreOS (RHCOS).
Procedure
- Log in to the Red Hat Enterprise Linux based node and open a terminal.
For each node in your cluster:
Verify that the node has access to the rhel-7-server-extras-rpms repository.
# subscription-manager repos --list-enabled | grep rhel-7-server
If you do not see both
rhel-7-server-rpms
andrhel-7-server-extras-rpms
in the output, or if there is no output, run the following commands to enable each repository.# subscription-manager repos --enable=rhel-7-server-rpms # subscription-manager repos --enable=rhel-7-server-extras-rpms
Install the required packages.
# yum install -y policycoreutils container-selinux
Persistently enable container use of the Ceph file system in SELinux.
# setsebool -P container_use_cephfs on
1.2. Enabling key value backend path and policy in Vault
Prerequisites
- Administrator access to Vault.
-
Carefully, choose a unique path name as the backend
path
that follows the naming convention since it cannot be changed later.
Procedure
Enable the Key/Value (KV) backend path in Vault.
For Vault KV secret engine API, version 1:
$ vault secrets enable -path=ocs kv
For Vault KV secret engine API, version 2:
$ vault secrets enable -path=ocs kv-v2
Create a policy to restrict users to perform a write or delete operation on the secret using the following commands:
echo ' path "ocs/*" { capabilities = ["create", "read", "update", "delete", "list"] } path "sys/mounts" { capabilities = ["read"] }'| vault policy write ocs -
Create a token matching the above policy:
$ vault token create -policy=ocs -format json
1.3. Requirements for installing OpenShift Container Storage using local storage devices
Node requirements
The cluster must consist of at least three OpenShift Container Platform worker nodes with locally attached-storage devices on each of them.
- Each of the three selected nodes must have at least one raw block device available to be used by OpenShift Container Storage.
- The devices you use must be empty; the disks must not include physical volumes (PVs), volume groups (VGs), or logical volumes (LVs) remaining on the disk.
See the Resource requirements section in Planning guide.
Arbiter stretch cluster requirements [Technology Preview]
- You need a minimum of five nodes in three zones. Two zones include two nodes per data-center zone while the third zone includes one node. A master node can be used for the arbiter zone.
- This solution is designed to be deployed where latencies do not exceed 4 milliseconds round-trip time (RTT) between locations. Contact Red Hat Customer Support if you are planning to deploy with higher latencies.
Each node must be pre-labeled with its zone label. To label the nodes use the following command:
$ oc label nodes <NodeNames> topology.kubernetes.io/zone='<label>'
For example, you can label the nodes as follows:
-
topology.kubernetes.io/zone=arbiter
to master or worker node -
topology.kubernetes.io/zone=datacenter1
to at least two worker nodes -
topology.kubernetes.io/zone=datacenter2
to at least two worker nodes
-
Minimum starting node requirements [Technology Preview]
An OpenShift Container Storage cluster will be deployed with minimum configuration when the standard deployment resource requirement is not met. See Resource requirements section in Planning guide.