|
| 1 | +// Module included in the following assemblies: |
| 2 | +// |
| 3 | +// * installing/installing_ibm_z/installing-ibm-z.adoc |
| 4 | +// * installing/installing_ibm_z/installing-restricted-networks-ibm-z.adoc |
| 5 | +// * installing/installing_ibm_z/installing-ibm-z-kvm.adoc |
| 6 | +// * installing/installing_ibm_z/installing-restricted-networks-ibm-z-kvm.adoc |
| 7 | + |
| 8 | +ifeval::["{context}" == "installing-ibm-z"] |
| 9 | +:ibm-z: |
| 10 | +endif::[] |
| 11 | +ifeval::["{context}" == "installing-ibm-z-kvm"] |
| 12 | +:ibm-z-kvm: |
| 13 | +endif::[] |
| 14 | +ifeval::["{context}" == "installing-restricted-networks-ibm-z"] |
| 15 | +:ibm-z: |
| 16 | +endif::[] |
| 17 | +ifeval::["{context}" == "installing-restricted-networks-ibm-z-kvm"] |
| 18 | +:ibm-z-kvm: |
| 19 | +endif::[] |
| 20 | + |
| 21 | +:_content-type: PROCEDURE |
| 22 | +[id="configuring-nbde-static-ip-ibmz-linuxone-environment_{context}"] |
| 23 | += Configuring NBDE with static IP in an {ibmzProductName} or {linuxoneProductName} environment |
| 24 | + |
| 25 | +Enabling NBDE disk encryption in an {ibmzProductName} or {linuxoneProductName} environment requires additional steps, which are described in detail in this section. |
| 26 | + |
| 27 | +.Prerequisites |
| 28 | + |
| 29 | +* You have set up the External Tang Server. See link:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/configuring-automated-unlocking-of-encrypted-volumes-using-policy-based-decryption_security-hardening#network-bound-disk-encryption_configuring-automated-unlocking-of-encrypted-volumes-using-policy-based-decryption[Network-bound disk encryption] for instructions. |
| 30 | +* You have installed the `butane` utility. |
| 31 | +* You have reviewed the instructions for how to create machine configs with Butane. |
| 32 | +
|
| 33 | +.Procedure |
| 34 | + |
| 35 | +. Create Butane configuration files for the control plane and compute nodes. |
| 36 | ++ |
| 37 | +The following example of a Butane configuration for a control plane node creates a file named `master-storage.bu` for disk encryption: |
| 38 | ++ |
| 39 | +[source,yaml] |
| 40 | +---- |
| 41 | +variant: openshift |
| 42 | +version: 4.13.0 |
| 43 | +metadata: |
| 44 | + name: master-storage |
| 45 | + labels: |
| 46 | + machineconfiguration.openshift.io/role: master |
| 47 | +storage: |
| 48 | + luks: |
| 49 | + - clevis: |
| 50 | + tang: |
| 51 | + - thumbprint: QcPr_NHFJammnRCA3fFMVdNBwjs |
| 52 | + url: http://clevis.example.com:7500 |
| 53 | + options: <1> |
| 54 | + - --cipher |
| 55 | + - aes-cbc-essiv:sha256 |
| 56 | +ifndef::ibm-z-kvm[] |
| 57 | + device: /dev/disk/by-partlabel/root <2> |
| 58 | +endif::ibm-z-kvm[] |
| 59 | +ifdef::ibm-z-kvm[] |
| 60 | + device: /dev/disk/by-partlabel/root |
| 61 | +endif::ibm-z-kvm[] |
| 62 | + label: luks-root |
| 63 | + name: root |
| 64 | + wipe_volume: true |
| 65 | + filesystems: |
| 66 | + - device: /dev/mapper/root |
| 67 | + format: xfs |
| 68 | + label: root |
| 69 | + wipe_filesystem: true |
| 70 | +openshift: |
| 71 | +ifndef::ibm-z-kvm[] |
| 72 | + fips: true <3> |
| 73 | +endif::ibm-z-kvm[] |
| 74 | +ifdef::ibm-z-kvm[] |
| 75 | + fips: true <2> |
| 76 | +endif::ibm-z-kvm[] |
| 77 | +---- |
| 78 | +ifdef::ibm-z-kvm[] |
| 79 | +<1> The cipher option is only required if FIPS mode is enabled. Omit the entry if FIPS is disabled. |
| 80 | +<2> Whether to enable or disable FIPS mode. By default, FIPS mode is not enabled. If FIPS mode is enabled, the {op-system-first} machines that {product-title} runs on bypass the default Kubernetes cryptography suite and use the cryptography modules that are provided with {op-system} instead. |
| 81 | +endif::ibm-z-kvm[] |
| 82 | +ifndef::ibm-z-kvm[] |
| 83 | +<1> The cipher option is only required if FIPS mode is enabled. Omit the entry if FIPS is disabled. |
| 84 | +<2> For installations on DASD-type disks, replace with `device: /dev/disk/by-label/root`. |
| 85 | +<3> Whether to enable or disable FIPS mode. By default, FIPS mode is not enabled. If FIPS mode is enabled, the {op-system-first} machines that {product-title} runs on bypass the default Kubernetes cryptography suite and use the cryptography modules that are provided with {op-system} instead. |
| 86 | +endif::ibm-z-kvm[] |
| 87 | + |
| 88 | +. Create a customized initramfs file to boot the machine, by running the following command: |
| 89 | ++ |
| 90 | +[source,terminal] |
| 91 | +---- |
| 92 | +$ coreos-installer pxe customize \ |
| 93 | + /root/rhcos-bootfiles/rhcos-<release>-live-initramfs.s390x.img \ |
| 94 | + --dest-device /dev/sda --dest-karg-append \ |
| 95 | + ip=<ip-address>::<gateway-ip>:<subnet-mask>::<network-device>:none \ |
| 96 | + --dest-karg-append nameserver=<nameserver-ip> \ |
| 97 | + --dest-karg-append rd.neednet=1 -o \ |
| 98 | + /root/rhcos-bootfiles/<Node-name>-initramfs.s390x.img |
| 99 | +---- |
| 100 | ++ |
| 101 | +[NOTE] |
| 102 | +==== |
| 103 | +Before first boot, you must customize the initramfs for each node in the cluster, and add PXE kernel parameters. |
| 104 | +==== |
| 105 | + |
| 106 | +. Create a parameter file that includes `ignition.platform.id=metal` and `ignition.firstboot`. |
| 107 | ++ |
| 108 | +.Example kernel parameter file for the control plane machine: |
| 109 | ++ |
| 110 | +ifndef::ibm-z-kvm[] |
| 111 | +[source,terminal] |
| 112 | +---- |
| 113 | +rd.neednet=1 \ |
| 114 | +console=ttysclp0 \ |
| 115 | +coreos.inst.install_dev=/dev/dasda \ <1> |
| 116 | +ignition.firstboot ignition.platform.id=metal \ |
| 117 | +coreos.live.rootfs_url=http://10.19.17.25/redhat/ocp/rhcos-413.86.202302201445-0/rhcos-413.86.202302201445-0-live-rootfs.s390x.img \ |
| 118 | +coreos.inst.ignition_url=http://bastion.ocp-cluster1.example.com:8080/ignition/master.ign \ |
| 119 | +ip=10.19.17.2::10.19.17.1:255.255.255.0::enbdd0:none nameserver=10.19.17.1 \ |
| 120 | +zfcp.allow_lun_scan=0 \ <2> |
| 121 | +rd.znet=qeth,0.0.bdd0,0.0.bdd1,0.0.bdd2,layer2=1 \ |
| 122 | +rd.zfcp=0.0.5677,0x600606680g7f0056,0x034F000000000000 \ <3> |
| 123 | +zfcp.allow_lun_scan=0 \ |
| 124 | +rd.znet=qeth,0.0.bdd0,0.0.bdd1,0.0.bdd2,layer2=1 \ |
| 125 | +rd.zfcp=0.0.5677,0x600606680g7f0056,0x034F000000000000 |
| 126 | +---- |
| 127 | +<1> For installations on DASD-type disks, add `coreos.inst.install_dev=/dev/dasda`. Omit this value for FCP-type disks. |
| 128 | +<2> For installations on FCP-type disks, add `zfcp.allow_lun_scan=0`. Omit this value for DASD-type disks. |
| 129 | +<3> For installations on DASD-type disks, replace with `rd.dasd=0.0.3490` to specify the DASD device. |
| 130 | +endif::ibm-z-kvm[] |
| 131 | +ifdef::ibm-z-kvm[] |
| 132 | +[source,terminal] |
| 133 | +---- |
| 134 | +rd.neednet=1 \ |
| 135 | +console=ttysclp0 \ |
| 136 | +ignition.firstboot ignition.platform.id=metal \ |
| 137 | +coreos.live.rootfs_url=http://10.19.17.25/redhat/ocp/rhcos-413.86.202302201445-0/rhcos-413.86.202302201445-0-live-rootfs.s390x.img \ |
| 138 | +coreos.inst.ignition_url=http://bastion.ocp-cluster1.example.com:8080/ignition/master.ign \ |
| 139 | +ip=10.19.17.2::10.19.17.1:255.255.255.0::enbdd0:none nameserver=10.19.17.1 \ |
| 140 | +zfcp.allow_lun_scan=0 \ |
| 141 | +rd.znet=qeth,0.0.bdd0,0.0.bdd1,0.0.bdd2,layer2=1 \ |
| 142 | +rd.zfcp=0.0.5677,0x600606680g7f0056,0x034F000000000000 |
| 143 | +---- |
| 144 | +endif::ibm-z-kvm[] |
| 145 | ++ |
| 146 | +[NOTE] |
| 147 | +==== |
| 148 | +Write all options in the parameter file as a single line and make sure you have no newline characters. |
| 149 | +==== |
| 150 | + |
| 151 | +ifeval::["{context}" == "installing-ibm-z"] |
| 152 | +:!ibm-z: |
| 153 | +endif::[] |
| 154 | +ifeval::["{context}" == "installing-ibm-z-kvm"] |
| 155 | +:!ibm-z-kvm: |
| 156 | +endif::[] |
| 157 | +ifeval::["{context}" == "installing-restricted-networks-ibm-z"] |
| 158 | +:!ibm-z: |
| 159 | +endif::[] |
| 160 | +ifeval::["{context}" == "installing-restricted-networks-ibm-z-kvm"] |
| 161 | +:!ibm-z-kvm: |
| 162 | +endif::[] |
0 commit comments