Skip to content

Commit 5d69327

Browse files
stevsmitstevsmit
authored
Merge pull request #93642 from travier/main-ibm-z-cex-bootdevices-layouts
[OSDOCS-11048] IBM Z CEX: Use Butane's boot_device layouts
2 parents 760746c + ca03009 commit 5d69327

File tree

2 files changed

+84
-67
lines changed

2 files changed

+84
-67
lines changed

‎modules/ibm-z-configure-hw-based-cex-encryption.adoc

Lines changed: 78 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -39,9 +39,9 @@ Enabling hardware-based Linux Unified Key Setup (LUKS) encryption via {ibm-name}
3939
4040
.Procedure
4141

42-
. Create Butane configuration files for the control plane and compute nodes.
43-
+
44-
The following example of a Butane configuration for a control plane node creates a file named `main-storage.bu` for disk encryption:
42+
ifdef::ibm-z-kvm[]
43+
. Create Butane configuration files for the control plane and compute nodes:
44+
** Create a file named `main-storage.bu` by using the following Butane configuration for a control plane node with disk encryption, for example:
4545
+
4646
[source,yaml,subs="attributes+"]
4747
----
@@ -51,91 +51,113 @@ metadata:
5151
name: main-storage
5252
labels:
5353
machineconfiguration.openshift.io/role: master
54-
storage:
54+
boot_device:
55+
layout: s390x-virt
5556
luks:
56-
- cex:
57-
enabled: true
58-
options: <1>
59-
- --pbkdf
60-
- pbkdf2
61-
ifndef::ibm-z-kvm[]
62-
device: /dev/disk/by-partlabel/root <2>
63-
endif::ibm-z-kvm[]
64-
ifdef::ibm-z-kvm[]
65-
device: /dev/disk/by-partlabel/root
57+
cex:
58+
enabled: true
59+
openshift:
60+
fips: true # <1>
61+
kernel_arguments:
62+
- rd.luks.key=/etc/luks/cex.key # <2>
63+
----
64+
<1> Specifies whether to enable or disable FIPS mode. By default, FIPS mode is not enabled. If FIPS mode is enabled, the {op-system-first} machines that {product-title} runs on bypass the default Kubernetes cryptography suite and use the cryptography modules that are provided with {op-system} instead.
65+
<2> Specifies the location of the key that is required to decrypt the device. You can not change this value.
6666
endif::ibm-z-kvm[]
67-
label: luks-root
68-
name: root
69-
wipe_volume: true
67+
ifndef::ibm-z-kvm[]
68+
. Choose the appropriate method to create Butane configuration files for the control plane and compute nodes:
69+
** For installations on DASD-type disks, create a file named `main-storage.bu` by using the following Butane configuration for a control plane node with disk encryption, for example:
70+
+
71+
[source,yaml,subs="attributes+"]
72+
----
73+
variant: openshift
74+
version: {product-version}.0
75+
metadata:
76+
name: main-storage
77+
labels:
78+
machineconfiguration.openshift.io/role: master
79+
boot_device:
80+
layout: s390x-eckd
81+
luks:
82+
device: /dev/dasda
83+
cex:
84+
enabled: true
85+
openshift:
86+
fips: true # <1>
87+
kernel_arguments:
88+
- rd.luks.key=/etc/luks/cex.key # <2>
89+
----
90+
<1> Specifies whether to enable or disable FIPS mode. By default, FIPS mode is not enabled. If FIPS mode is enabled, the {op-system-first} machines that {product-title} runs on bypass the default Kubernetes cryptography suite and use the cryptography modules that are provided with {op-system} instead.
91+
<2> Specifies the location of the key that is required to decrypt the device. You can not change this value.
92+
+
93+
** For installations on FCP-type disks, create a file named `main-storage.bu` by using the following Butane configuration for a control plane node with disk encryption, for example:
94+
+
95+
[source,yaml,subs="attributes+"]
96+
----
97+
variant: openshift
98+
version: {product-version}.0
99+
metadata:
100+
name: main-storage
101+
labels:
102+
machineconfiguration.openshift.io/role: master
103+
storage:
70104
filesystems:
71105
- device: /dev/mapper/root
72106
format: xfs
73107
label: root
74108
wipe_filesystem: true
109+
luks:
110+
- device: /dev/disk/by-label/root
111+
label: luks-root
112+
name: root
113+
wipe_volume: true
114+
cex:
115+
enabled: true
75116
openshift:
76-
ifndef::ibm-z-kvm[]
77-
fips: true <3>
78-
kernel_arguments: <4>
79-
endif::ibm-z-kvm[]
80-
ifdef::ibm-z-kvm[]
81-
fips: true <2>
82-
kernel_arguments: <3>
83-
endif::ibm-z-kvm[]
84-
- rd.luks.key=/etc/luks/cex.key
117+
fips: true # <1>
118+
kernel_arguments:
119+
- rd.luks.key=/etc/luks/cex.key # <2>
85120
----
86-
<1> The `pbkdf` option is only required if FIPS mode is enabled. Omit the entry if FIPS is disabled.
87-
ifndef::ibm-z-kvm[]
88-
<2> For installations on DASD-type disks, replace with `device: /dev/disk/by-label/root`.
89-
<3> Specifies whether to enable or disable FIPS mode. By default, FIPS mode is not enabled. If FIPS mode is enabled, the {op-system-first} machines that {product-title} runs on bypass the default Kubernetes cryptography suite and use the cryptography modules that are provided with {op-system} instead.
90-
<4> Specifies the location of the pass key that is required to decrypt the device.
91-
endif::ibm-z-kvm[]
92-
ifdef::ibm-z-kvm[]
93-
<2> Specifies whether to enable or disable FIPS mode. By default, FIPS mode is not enabled. If FIPS mode is enabled, the {op-system-first} machines that {product-title} runs on bypass the default Kubernetes cryptography suite and use the cryptography modules that are provided with {op-system} instead.
94-
<3> Specifies the location of the pass key that is required to decrypt the device.
121+
<1> Specifies whether to enable or disable FIPS mode. By default, FIPS mode is not enabled. If FIPS mode is enabled, the {op-system-first} machines that {product-title} runs on bypass the default Kubernetes cryptography suite and use the cryptography modules that are provided with {op-system} instead.
122+
<2> Specifies the location of the key that is required to decrypt the device. You can not change this value.
95123
endif::ibm-z-kvm[]
96124

97125
. Create a parameter file that includes `ignition.platform.id=metal` and `ignition.firstboot`.
98126
+
99127
.Example kernel parameter file for the control plane machine
100128
+
101-
ifndef::ibm-z-kvm[]
129+
ifdef::ibm-z-kvm[]
102130
[source,terminal]
103131
----
104132
cio_ignore=all,!condev rd.neednet=1 \
105133
console=ttysclp0 \
106-
coreos.inst.install_dev=/dev/disk/by-id/scsi-<serial_number> \// <1>
107134
ignition.firstboot ignition.platform.id=metal \
108-
coreos.inst.ignition_url=http://<http_server>/master.ign \// <2>
109-
coreos.live.rootfs_url=http://<http_server>/rhcos-<version>-live-rootfs.<architecture>.img \// <3>
135+
coreos.inst.ignition_url=http://<http_server>/master.ign \// <1>
136+
coreos.live.rootfs_url=http://<http_server>/rhcos-<version>-live-rootfs.<architecture>.img \// <2>
110137
ip=<ip_address>::<gateway>:<netmask>:<hostname>::none nameserver=<dns> \
111138
rd.znet=qeth,0.0.bdd0,0.0.bdd1,0.0.bdd2,layer2=1 \
112-
rd.zfcp=0.0.5677,0x600606680g7f0056,0x034F000000000000 // <4>
139+
rd.zfcp=0.0.5677,0x600606680g7f0056,0x034F000000000000
113140
----
114-
ifdef::ibm-z[]
115-
<1> Specifies a unique fully qualified path depending on disk type. This can be DASD-type or FCP-type disks.
116-
endif::ibm-z[]
117-
ifdef::ibm-z-lpar[]
118-
<1> Specifies a unique fully qualified path depending on disk type. This can be DASD-type, FCP-type, or NVMe-type disks.
119-
endif::ibm-z-lpar[]
120-
<2> Specifies the location of the Ignition config file. Use `master.ign` or `worker.ign`. Only HTTP and HTTPS protocols are supported.
121-
<3> Specifies the location of the `rootfs` artifact for the `kernel` and `initramfs` you are booting. Only HTTP and HTTPS protocols are supported.
122-
<4> Specifies the root device. For installations on DASD-type disks, replace with `rd.dasd=0.0.xxxx` to specify the DASD device.
141+
<1> Specifies the location of the Ignition configuration file. Use `master.ign` or `worker.ign`. You can only use the HTTP and HTTPS protocols.
142+
<2> Specifies the location of the `rootfs` artifact for the `kernel` and `initramfs` that you want to boot. You can only use the HTTP and HTTPS protocols.
123143
endif::ibm-z-kvm[]
124-
ifdef::ibm-z-kvm[]
144+
ifndef::ibm-z-kvm[]
125145
[source,terminal]
126146
----
127147
cio_ignore=all,!condev rd.neednet=1 \
128148
console=ttysclp0 \
149+
coreos.inst.install_dev=/dev/disk/by-id/scsi-<serial_number> \// <1>
129150
ignition.firstboot ignition.platform.id=metal \
130-
coreos.inst.ignition_url=http://<http_server>/master.ign \// <1>
131-
coreos.live.rootfs_url=http://<http_server>/rhcos-<version>-live-rootfs.<architecture>.img \// <2>
151+
coreos.inst.ignition_url=http://<http_server>/master.ign \// <2>
152+
coreos.live.rootfs_url=http://<http_server>/rhcos-<version>-live-rootfs.<architecture>.img \// <3>
132153
ip=<ip_address>::<gateway>:<netmask>:<hostname>::none nameserver=<dns> \
133154
rd.znet=qeth,0.0.bdd0,0.0.bdd1,0.0.bdd2,layer2=1 \
134-
rd.zfcp=0.0.5677,0x600606680g7f0056,0x034F000000000000
155+
rd.zfcp=0.0.5677,0x600606680g7f0056,0x034F000000000000 <4>
135156
----
136-
<1> Specifies the location of the Ignition config file. Use `master.ign` or `worker.ign`. Only HTTP and HTTPS protocols are supported.
137-
<2> Specifies the location of the `rootfs` artifact for the `kernel` and `initramfs` you are booting. Only HTTP and HTTPS protocols are supported.
138-
157+
<1> Specifies a unique fully qualified path depending on disk type. This can be DASD-type or FCP-type disks.
158+
<2> Specifies the location of the Ignition configuration file. Use `master.ign` or `worker.ign`. You can only use the HTTP and HTTPS protocols.
159+
<3> Specifies the location of the `rootfs` artifact for the `kernel` and `initramfs` that you want to boot. You can only use the HTTP and HTTPS protocols.
160+
<4> Specifies the root device. For installations on DASD-type disks, replace with `rd.dasd=0.0.xxxx` to specify the DASD device.
139161
endif::ibm-z-kvm[]
140162
+
141163
[NOTE]

‎modules/ibm-z-configure-nbde-with-static-ip.adoc

Lines changed: 6 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -58,11 +58,8 @@ storage:
5858
tang:
5959
- thumbprint: QcPr_NHFJammnRCA3fFMVdNBwjs
6060
url: http://clevis.example.com:7500
61-
options: <1>
62-
- --cipher
63-
- aes-cbc-essiv:sha256
6461
ifndef::ibm-z-kvm[]
65-
device: /dev/disk/by-partlabel/root <2>
62+
device: /dev/disk/by-partlabel/root # <1>
6663
endif::ibm-z-kvm[]
6764
ifdef::ibm-z-kvm[]
6865
device: /dev/disk/by-partlabel/root
@@ -77,20 +74,18 @@ endif::ibm-z-kvm[]
7774
wipe_filesystem: true
7875
openshift:
7976
ifndef::ibm-z-kvm[]
80-
fips: true <3>
77+
fips: true # <2>
8178
endif::ibm-z-kvm[]
8279
ifdef::ibm-z-kvm[]
83-
fips: true <2>
80+
fips: true # <1>
8481
endif::ibm-z-kvm[]
8582
----
8683
ifdef::ibm-z-kvm[]
87-
<1> The cipher option is only required if FIPS mode is enabled. Omit the entry if FIPS is disabled.
88-
<2> Whether to enable or disable FIPS mode. By default, FIPS mode is not enabled. If FIPS mode is enabled, the {op-system-first} machines that {product-title} runs on bypass the default Kubernetes cryptography suite and use the cryptography modules that are provided with {op-system} instead.
84+
<1> Whether to enable or disable FIPS mode. By default, FIPS mode is not enabled. If FIPS mode is enabled, the {op-system-first} machines that {product-title} runs on bypass the default Kubernetes cryptography suite and use the cryptography modules that are provided with {op-system} instead.
8985
endif::ibm-z-kvm[]
9086
ifndef::ibm-z-kvm[]
91-
<1> The cipher option is only required if FIPS mode is enabled. Omit the entry if FIPS is disabled.
92-
<2> For installations on DASD-type disks, replace with `device: /dev/disk/by-label/root`.
93-
<3> Whether to enable or disable FIPS mode. By default, FIPS mode is not enabled. If FIPS mode is enabled, the {op-system-first} machines that {product-title} runs on bypass the default Kubernetes cryptography suite and use the cryptography modules that are provided with {op-system} instead.
87+
<1> For installations on DASD-type disks, replace with `device: /dev/disk/by-label/root`.
88+
<2> Whether to enable or disable FIPS mode. By default, FIPS mode is not enabled. If FIPS mode is enabled, the {op-system-first} machines that {product-title} runs on bypass the default Kubernetes cryptography suite and use the cryptography modules that are provided with {op-system} instead.
9489
endif::ibm-z-kvm[]
9590

9691
. Create a customized initramfs file to boot the machine, by running the following command:

0 commit comments

Comments
 (0)