Chapter 1. Preparing to deploy OpenShift Data Foundation

When you deploy OpenShift Data Foundation on OpenShift Container Platform using local storage devices, you can create internal cluster resources. This approach internally provisions base services. Then all applications can access additional storage classes.

Before you begin the deployment of Red Hat OpenShift Data Foundation using local storage, ensure that your resource requirements are met. See requirements for installing OpenShift Data Foundation using local storage devices.

On the external key management system (KMS),

After you have addressed the above, follow these steps in the order given:

  1. Install the Red Hat OpenShift Data Foundation Operator.
  2. Install Local Storage Operator.
  3. Find the available storage devices.
  4. Create the OpenShift Data Foundation cluster service on IBM Z.

1.1. Requirements for installing OpenShift Data Foundation using local storage devices

Node requirements

The cluster must consist of at least three OpenShift Container Platform worker nodes with locally attached-storage devices on each of them.

  • Each of the three selected nodes must have at least one raw block device available to be used by OpenShift Data Foundation.
  • The devices you use must be empty; the disks must not include physical volumes (PVs), volume groups (VGs), or logical volumes (LVs) remaining on the disk.

For more information, see the Resource requirements section in the Planning guide.

  • For storage nodes, FCP storage devices are required.

1.2. Enabling key value backend path and policy in Vault

Prerequisites

  • Administrator access to Vault.
  • Carefully, choose a unique path name as the backend path that follows the naming convention since it cannot be changed later.

Procedure

  1. Enable the Key/Value (KV) backend path in Vault.

    For Vault KV secret engine API, version 1: 

    $ vault secrets enable -path=odf kv

    For Vault KV secret engine API, version 2: 

    $ vault secrets enable -path=odf kv-v2

  2. Create a policy to restrict users to perform a write or delete operation on the secret using the following commands. 

    echo '
path "odf/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}
path "sys/mounts" {
capabilities = ["read"]
}'| vault policy write odf -

  3. Create a token matching the above policy. 

    $ vault token create -policy=odf -format json