diff --git a/content/docs/authorization/Backup and Restore/helm/_index.md b/content/docs/authorization/Backup and Restore/helm/_index.md index 6b0c9b9c2e..e4ecfec456 100644 --- a/content/docs/authorization/Backup and Restore/helm/_index.md +++ b/content/docs/authorization/Backup and Restore/helm/_index.md @@ -75,9 +75,9 @@ deployment.apps/proxy-server restarted ## Tenants, Quota, and Volume ownership -Redis is used to store application data regarding [tenants, quota, and volume ownership](../../design#quota--volume-ownership) with the Storage Class specified in the `redis.storageClass` parameter in the values file, or with the default Storage Class if that parameter was not specified. +Redis is used to store application data regarding [tenants, quota, and volume ownership](../../design#quota--volume-ownership) with the Storage Class `csm-authorization-local-storage` or the one specified in the `redis.storageClass` parameter in the values file. -The Persistent Volume for Redis is dynamically provisioned by this Storage Class with the `redis-primary-pv-claim` Persistent Volume Claim. See the example. +The Persistent Volume for Redis is provisioned by the above Storage Class with the `redis-primary-pv-claim` Persistent Volume Claim. See the example. ```bash kubectl get persistentvolume diff --git a/content/docs/deployment/helm/modules/authorization/configuration/_index.md b/content/docs/authorization/configuration/_index.md similarity index 100% rename from content/docs/deployment/helm/modules/authorization/configuration/_index.md rename to content/docs/authorization/configuration/_index.md diff --git a/content/docs/deployment/helm/modules/authorization/configuration/powerflex/_index.md b/content/docs/authorization/configuration/powerflex/_index.md similarity index 89% rename from content/docs/deployment/helm/modules/authorization/configuration/powerflex/_index.md rename to content/docs/authorization/configuration/powerflex/_index.md index 903245f0b0..3c2ef8262a 100644 --- a/content/docs/deployment/helm/modules/authorization/configuration/powerflex/_index.md +++ b/content/docs/authorization/configuration/powerflex/_index.md @@ -55,7 +55,7 @@ Given a setup where Kubernetes, a storage system, and the CSM for Authorization **Helm** - Refer to the [Install the Driver](../../../csidriver/installation/helm/powerflex/#install-the-driver) section to edit the parameters in `samples/config.yaml` to configure the driver to communicate with the CSM Authorization sidecar. + Refer to the [Install the Driver](../../../deployment/helm/drivers/installation/powerflex/#install-the-driver) section to edit the parameters in `samples/config.yaml` to configure the driver to communicate with the CSM Authorization sidecar. - Update `endpoint` to match the localhost endpoint in `samples/secret/karavi-authorization-config.json`. @@ -78,7 +78,7 @@ Given a setup where Kubernetes, a storage system, and the CSM for Authorization **Operator** - Refer to the [Create Secret](../../../deployment/csmoperator/drivers/powerflex/#create-secret) section to prepare `config.yaml` to configure the driver to communicate with the CSM Authorization sidecar. + Refer to the [Create Secret](../../../deployment/csmoperator/drivers/powerflex/#create-secret) section to prepare `secret.yaml` to configure the driver to communicate with the CSM Authorization sidecar. - Update `endpoint` to match the localhost endpoint in `samples/secret/karavi-authorization-config.json`. @@ -102,13 +102,13 @@ Given a setup where Kubernetes, a storage system, and the CSM for Authorization **Helm** - Refer to the [Install the Driver](../../../csidriver/installation/helm/powerflex/#install-the-driver) section to edit the parameters in `myvalues.yaml` to enable CSM Authorization. + Refer to the [Install the Driver](../../../deployment/helm/drivers/installation/powerflex/#install-the-driver) section to edit the parameters in `myvalues.yaml` to enable CSM Authorization. - Update `authorization.enabled` to `true`. - Update `images.authorization` to the image of the CSM Authorization sidecar. In most cases, you can leave the default value. - - Update `authorization.proxyHost` to the hostname of the CSM Authorization Proxy Server. + - Update `authorization.proxyHost` to the hostname of the CSM Authorization Proxy Server. `csm-authorization.com` is a placeholder for the proxyHost. See the administrator of CSM for Authorization for the correct value. - Update `authorization.skipCertificateValidation` to `true` or `false` depending on if you want to disable or enable certificate validation of the CSM Authorization Proxy Server. @@ -144,7 +144,7 @@ Given a setup where Kubernetes, a storage system, and the CSM for Authorization - Update the `image` to the image of the CSM Authorization sidecar. In most cases, you can leave the default value. - - Update the `PROXY_HOST` environment value to the hostname of the CSM Authorization Proxy Server. + - Update the `PROXY_HOST` environment value to the hostname of the CSM Authorization Proxy Server. `csm-authorization.com` is a placeholder for the proxyHost. See the administrator of CSM for Authorization for the correct value. - Update the `SKIP_CERTIFICATE_VALIDATION` environment value to `true` or `false` depending on if you want to disable or enable certificate validation of the CSM Authorization Proxy Server. diff --git a/content/docs/deployment/helm/modules/authorization/configuration/powermax/_index.md b/content/docs/authorization/configuration/powermax/_index.md similarity index 82% rename from content/docs/deployment/helm/modules/authorization/configuration/powermax/_index.md rename to content/docs/authorization/configuration/powermax/_index.md index ca4f350226..50aecfef26 100644 --- a/content/docs/deployment/helm/modules/authorization/configuration/powermax/_index.md +++ b/content/docs/authorization/configuration/powermax/_index.md @@ -51,13 +51,21 @@ Create the karavi-authorization-config secret using this command: kubectl -n powermax create secret generic proxy-server-root-certificate --from-file=rootCertificate.pem=/path/to/rootCA -o yaml --dry-run=client | kubectl apply -f - ``` -4. Enable CSM Authorization in the driver installation applicable to your installation method. +4. Prepare the driver configuration secret, applicable to your driver installation method, to communicate with the CSM Authorization sidecar. **Helm** - In [Install the Driver](../../../csidriver/installation/helm/powermax/#install-the-driver) where you edit `samples/secret/secret.yaml` with the credentials of the PowerMax, you can leave these with the default values as they will be ignored. + Refer to the [Install the Driver](../../../deployment/helm/drivers/installation/powermax/#install-the-driver) section where you edit `samples/secret/secret.yaml` with the credentials of the PowerMax. Leave `username` and `password` with the default values as they will be ignored. - Refer to the [Install the Driver](../../../csidriver/installation/helm/powermax/#install-the-driver) section to edit the parameters in `my-powermax-settings.yaml` file to configure the driver to communicate with the CSM Authorization sidecar. + **Operator** + + Refer to the [Install the Driver](../../../deployment/csmoperator/drivers/powermax/#install-driver) section to prepare `powermax-creds.yaml`. Leave `username` and `password` with the default values as they will be ignored. + +5. Enable CSM Authorization in the driver installation applicable to your installation method. + + **Helm** + + Refer to the [Install the Driver](../../../deployment/helm/drivers/installation/powermax/#install-the-driver) section to edit the parameters in `my-powermax-settings.yaml` file to configure the driver to communicate with the CSM Authorization sidecar. - Update `global.storageArrays.endpoint` to match the localhost endpoint in `samples/secret/karavi-authorization-config.json`. @@ -67,7 +75,7 @@ Create the karavi-authorization-config secret using this command: - Update `images.authorization` to the image of the CSM Authorization sidecar. In most cases, you can leave the default value. - - Update `authorization.proxyHost` to the hostname of the CSM Authorization Proxy Server. + - Update `authorization.proxyHost` to the hostname of the CSM Authorization Proxy Server. `csm-authorization.com` is a placeholder for the proxyHost. See the administrator of CSM for Authorization for the correct value. - Update `authorization.skipCertificateValidation` to `true` or `false` depending on if you want to disable or enable certificate validation of the CSM Authorization Proxy Server. @@ -110,7 +118,7 @@ Create the karavi-authorization-config secret using this command: - Update the `image` to the image of the CSM Authorization sidecar. In most cases, you can leave the default value. - - Update the `PROXY_HOST` environment value to the hostname of the CSM Authorization Proxy Server. + - Update the `PROXY_HOST` environment value to the hostname of the CSM Authorization Proxy Server. `csm-authorization.com` is a placeholder for the proxyHost. See the administrator of CSM for Authorization for the correct value. - Update the `SKIP_CERTIFICATE_VALIDATION` environment value to `true` or `false` depending on if you want to disable or enable certificate validation of the CSM Authorization Proxy Server. diff --git a/content/docs/deployment/helm/modules/authorization/configuration/powerscale/_index.md b/content/docs/authorization/configuration/powerscale/_index.md similarity index 90% rename from content/docs/deployment/helm/modules/authorization/configuration/powerscale/_index.md rename to content/docs/authorization/configuration/powerscale/_index.md index 62964bdd54..94f8334d24 100644 --- a/content/docs/deployment/helm/modules/authorization/configuration/powerscale/_index.md +++ b/content/docs/authorization/configuration/powerscale/_index.md @@ -56,7 +56,7 @@ kubectl -n isilon create secret generic karavi-authorization-config --from-file= **Helm** - Refer to the [Install the Driver](../../../csidriver/installation/helm/isilon/#install-the-driver) section to edit the parameters in `samples/secret/secret.yaml` file to configure the driver to communicate with the CSM Authorization sidecar. + Refer to the [Install the Driver](../../../deployment/helm/drivers/installation/isilon/#install-the-driver) section to edit the parameters to prepare the `samples/secret/secret.yaml` file to configure the driver to communicate with the CSM Authorization sidecar. - Update `endpoint` to match the localhost endpoint in `samples/secret/karavi-authorization-config.json`. @@ -110,13 +110,13 @@ kubectl -n isilon create secret generic karavi-authorization-config --from-file= **Helm** - Refer to the [Install the Driver](../../../csidriver/installation/helm/isilon/#install-the-driver) section to edit the parameters in `my-isilon-settings.yaml` file to enable CSM Authorization. + Refer to the [Install the Driver](../../../deployment/helm/drivers/installation/isilon/#install-the-driver) section to edit the parameters in `my-isilon-settings.yaml` file to enable CSM Authorization. - Update `authorization.enabled` to `true`. - Update `images.authorization` to the image of the CSM Authorization sidecar. In most cases, you can leave the default value. - - Update `authorization.proxyHost` to the hostname of the CSM Authorization Proxy Server. + - Update `authorization.proxyHost` to the hostname of the CSM Authorization Proxy Server. `csm-authorization.com` is a placeholder for the proxyHost. See the administrator of CSM for Authorization for the correct value. - Update `authorization.skipCertificateValidation` to `true` or `false` depending on if you want to disable or enable certificate validation of the CSM Authorization Proxy Server. @@ -152,7 +152,7 @@ kubectl -n isilon create secret generic karavi-authorization-config --from-file= - Update the `image` to the image of the CSM Authorization sidecar. In most cases, you can leave the default value. - - Update the `PROXY_HOST` environment value to the hostname of the CSM Authorization Proxy Server. + - Update the `PROXY_HOST` environment value to the hostname of the CSM Authorization Proxy Server. `csm-authorization.com` is a placeholder for the proxyHost. See the administrator of CSM for Authorization for the correct value. - Update the `SKIP_CERTIFICATE_VALIDATION` environment value to `true` or `false` depending on if you want to disable or enable certificate validation of the CSM Authorization Proxy Server. diff --git a/content/docs/deployment/helm/modules/authorization/configuration/proxy-server/_index.md b/content/docs/authorization/configuration/proxy-server/_index.md similarity index 85% rename from content/docs/deployment/helm/modules/authorization/configuration/proxy-server/_index.md rename to content/docs/authorization/configuration/proxy-server/_index.md index df88d96e5a..9be045d765 100644 --- a/content/docs/deployment/helm/modules/authorization/configuration/proxy-server/_index.md +++ b/content/docs/authorization/configuration/proxy-server/_index.md @@ -14,9 +14,23 @@ The storage administrator must first configure Authorization with the following - Roles - Role bindings +The address of the Authorization proxy-server must be specified when executing `karavictl`. + +For the `RPM deployment`, the address is the DNS-hostname of the machine where the RPM is installed. + +For the `Helm/Operator deployment`, the address is exposed via LoadBalancer/NodePort by the Ingress Controller consuming the proxy-server Ingress. By default, this is the NGINX Ingress Controller. + +``` +# kubectl -n authorization get ingress +NAME CLASS HOSTS ADDRESS PORTS AGE +proxy-server nginx csm-authorization.com, 00, 000 2m35s +# kubectl -n authorization get service +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE +authorization-ingress-nginx-controller LoadBalancer 00.000.000.000 00:00000/TCP,000:00000/TCP 30s +``` + >__Note__: -> - The address of the Authorization proxy-server must be specified when executing `karavictl`. For the `RPM deployment`, the address is the DNS-hostname of the machine where the RPM -is installed. For the `Helm/Operator deployment`, the address is the Ingress host of the `proxy-server` with the port of the exposed Ingress Controller. +In clusters where there is no integrated LoadBalancer, the `EXTERNAL-IP` field is ``, so you must use the NodePort address. ### Configuring Admin Token @@ -53,12 +67,12 @@ $ cat admintoken.yaml A `storage` entity in CSM Authorization consists of the storage type (PowerFlex, PowerMax, PowerScale), the system ID, the API endpoint, and the credentials. For example, to create PowerFlex storage: -#RPM Deployment +#### RPM Deployment ```bash karavictl storage create --type powerflex --endpoint ${powerflexIP} --system-id ${systemID} --user ${user} --password ${password} --array-insecure --insecure --addr DNS-hostname --admin-token admintoken.yaml ``` -#Helm/Operator Deployment +#### Helm/Operator Deployment ```bash karavictl storage create --type powerflex --endpoint ${powerflexIP} --system-id ${systemID} --user ${user} --password ${password} --array-insecure --insecure --addr csm-authorization.com: --admin-token admintoken.yaml @@ -75,12 +89,12 @@ karavictl storage create --type powerflex --endpoint ${powerflexIP} --system-id ### Configuring Tenants A `tenant` is a Kubernetes cluster that a role will be bound to. For example, to create a tenant named `Finance`: -#RPM Deployment +#### RPM Deployment ```bash karavictl tenant create --name Finance --insecure --addr DNS-hostname --admin-token admintoken.yaml ``` -#Helm/Operator Deployment +#### Helm/Operator Deployment ```bash karavictl tenant create --name Finance --insecure --addr csm-authorization.com: --admin-token admintoken.yaml @@ -93,12 +107,12 @@ karavictl tenant create --name Finance --insecure --addr csm-authorization.com:< > - For the Powerflex Pre-approved Guid feature, the `approvesdc` boolean flag is `true` by default. If the `approvesdc` flag is false for a tenant, the proxy server will deny the requests to approve SDC if the SDCs are already in not-approved state. Inorder to change this flag for an already created tenant, see `tenant update` command in CLI section. -#RPM Deployment +#### RPM Deployment ```bash karavictl tenant create --name Finance --approvesdc=false --insecure --addr DNS-hostname --admin-token admintoken.yaml ``` -#Helm/Operator Deployment +#### Helm/Operator Deployment ```bash karavictl tenant create --name Finance --approvesdc=false --insecure --addr csm-authorization.com: --admin-token admintoken.yaml @@ -108,12 +122,12 @@ karavictl tenant create --name Finance --approvesdc=false --insecure --addr csm- A `role` consists of a name, the storage to use, and the quota limit for the storage pool to be used. For example, to create a role named `FinanceRole` using the PowerFlex storage created above with a quota limit of 100GB in storage pool `myStoragePool`: -#RPM Deployment +#### RPM Deployment ```bash karavictl role create --role=FinanceRole=powerflex=${systemID}=myStoragePool=100GB --insecure --addr DNS-hostname --admin-token admintoken.yaml ``` -#Helm/Operator Deployment +#### Helm/Operator Deployment ```bash karavictl role create --role=FinanceRole=powerflex=${systemID}=myStoragePool=100GB --insecure --addr csm-authorization.com: --admin-token admintoken.yaml ``` @@ -127,12 +141,12 @@ karavictl role create --role=FinanceRole=powerflex=${systemID}=myStoragePool=100 A `role binding` binds a role to a tenant. For example, to bind the `FinanceRole` to the `Finance` tenant: -#RPM Deployment +#### RPM Deployment ```bash karavictl rolebinding create --tenant Finance --role FinanceRole --insecure --addr DNS-hostname --admin-token admintoken.yaml ``` -#Helm/Operator Deployment +#### Helm/Operator Deployment ```bash karavictl rolebinding create --tenant Finance --role FinanceRole --insecure --addr csm-authorization.com: --admin-token admintoken.yaml @@ -147,12 +161,12 @@ karavictl rolebinding create --tenant Finance --role FinanceRole --insecure --ad Once rolebindings are created, an access/refresh token pair can be created for the tenant. The storage admin is responsible for generating and sending the token to the Kubernetes tenant admin. -#RPM Deployment +#### RPM Deployment ```bash karavictl generate token --tenant Finance --insecure --addr DNS-hostname --admin-token admintoken.yaml > token.yaml ``` -#Helm/Operator Deployment +#### Helm/Operator Deployment ```bash karavictl generate token --tenant Finance --insecure --addr csm-authorization.com: --admin-token admintoken.yaml > token.yaml diff --git a/content/docs/deployment/csmoperator/modules/authorization.md b/content/docs/deployment/csmoperator/modules/authorization.md index d7d00fe61b..bbad9140a8 100644 --- a/content/docs/deployment/csmoperator/modules/authorization.md +++ b/content/docs/deployment/csmoperator/modules/authorization.md @@ -60,94 +60,6 @@ kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/relea kubectl create -f samples/authorization/karavi-storage-secret.yaml ``` -5. Prepare a storage class for Redis to use for persistence. If not supplied, the default storage class in your environment is used. - - Example, if using CSM Authorization for PowerScale: - - ```yaml - apiVersion: storage.k8s.io/v1 - kind: StorageClass - metadata: - name: isilon - provisioner: csi-isilon.dellemc.com - reclaimPolicy: Delete - allowVolumeExpansion: true - parameters: - # The name of the access zone a volume can be created in - # Optional: true - # Default value: default value specified in values.yaml - # Examples: System, zone1 - AccessZone: System - - # The base path for the volumes to be created on PowerScale cluster. - # Ensure that this path exists on PowerScale cluster. - # Allowed values: unix absolute path - # Optional: true - # Default value: value specified in values.yaml for isiPath - # Examples: /ifs/data/csi, /ifs/engineering - IsiPath: /ifs/data/csi - - # The permissions for isi volume directory path - # This value overrides the isiVolumePathPermissions attribute of corresponding cluster config in secret, if present - # Allowed values: valid octal mode number - # Default value: "0777" - # Examples: "0777", "777", "0755" - #IsiVolumePathPermissions: "0777" - - # AccessZone groupnet service IP. Update AzServiceIP if different than endpoint. - # Optional: true - # Default value: endpoint of the cluster ClusterName - #AzServiceIP : 192.168.2.1 - - # When a PVC is being created, this parameter determines, when a node mounts the PVC, - # whether to add the k8s node to the "Root clients" field or "Clients" field of the NFS export - # Allowed values: - # "true": adds k8s node to the "Root clients" field of the NFS export - # "false": adds k8s node to the "Clients" field of the NFS export - # Optional: true - # Default value: "false" - RootClientEnabled: "false" - - # Name of PowerScale cluster, where pv will be provisioned. - # This name should match with name of one of the cluster configs in isilon-creds secret. - # If this parameter is not specified, then default cluster config in isilon-creds secret - # will be considered if available. - # Optional: true - #ClusterName: - - # Sets the filesystem type which will be used to format the new volume - # Optional: true - # Default value: None - #csi.storage.k8s.io/fstype: "nfs" - - # volumeBindingMode controls when volume binding and dynamic provisioning should occur. - # Allowed values: - # Immediate: indicates that volume binding and dynamic provisioning occurs once the - # PersistentVolumeClaim is created - # WaitForFirstConsumer: will delay the binding and provisioning of a PersistentVolume - # until a Pod using the PersistentVolumeClaim is created - # Default value: Immediate - volumeBindingMode: Immediate - - # allowedTopologies helps scheduling pods on worker nodes which match all of below expressions. - # If enableCustomTopology is set to true in helm values.yaml, then do not specify allowedTopologies - # Change all instances of to the IP of the PowerScale OneFS API server - #allowedTopologies: - # - matchLabelExpressions: - # - key: csi-isilon.dellemc.com/ - # values: - # - csi-isilon.dellemc.com - - # specify additional mount options for when a Persistent Volume is being mounted on a node. - # To mount volume with NFSv4, specify mount option vers=4. Make sure NFSv4 is enabled on the Isilon Cluster - #mountOptions: ["", "", ..., ""] - ``` - - Save the file and create it by using - ```bash - kubectl create -f - ``` - ### Install CSM Authorization Proxy Server 1. Follow all the [prerequisites](#prerequisite). @@ -162,12 +74,15 @@ kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/relea | PROXY_HOST | The hostname to configure the self-signed certificate (if applicable), and the proxy service Ingress. | Yes | csm-authorization.com | | PROXY_INGRESS_CLASSNAME | The ingressClassName of the proxy-service Ingress. | Yes | nginx | | PROXY_INGRESS_HOSTS | Additional host rules to be applied to the proxy-service Ingress. | No | authorization-ingress-nginx-controller.authorization.svc.cluster.local | - | REDIS_STORAGE_CLASS | The storage class for Redis to use for persistence. If not supplied, the default storage class is used. | Yes | - | + | REDIS_STORAGE_CLASS | The storage class for Redis to use for persistence. If not supplied, a locally provisioned volume is used. | No | - | | **ingress-nginx** | This section configures the enablement of the NGINX Ingress Controller. | - | - | | enabled | Enable/Disable deployment of the NGINX Ingress Controller. Set to false if you already have an Ingress Controller installed. | No | true | | **cert-manager** | This section configures the enablement of cert-manager. | - | - | | enabled | Enable/Disable deployment of cert-manager. Set to false if you already have cert-manager installed. | No | true | +>__Note__: +> - If you specify `REDIS_STORAGE_CLASS`, the storage class must NOT be provisioned by the Dell CSI Driver to be configured with this installation of CSM Authorization. + **Optional:** To enable reporting of trace data with [Zipkin](https://zipkin.io/), use the `csm-config-params` configMap in the sample CR or dynamically by editing the configMap. diff --git a/content/docs/deployment/helm/modules/authorization/_index.md b/content/docs/deployment/helm/modules/authorization/_index.md index fedb91d7d6..1619ba8608 100644 --- a/content/docs/deployment/helm/modules/authorization/_index.md +++ b/content/docs/deployment/helm/modules/authorization/_index.md @@ -89,7 +89,10 @@ The following third-party components are optionally installed in the specified n | **redis** | This section configures Redis. | - | - | | redis.images.redis | The image to use for Redis. | Yes | redis:6.0.8-alpine | | redis.images.commander | The image to use for Redis Commander. | Yes | rediscommander/redis-commander:latest | -| redis.storageClass | The storage class for Redis to use for persistence. If not supplied, the default storage class is used. | No | - | +| redis.storageClass | The storage class for Redis to use for persistence. If not supplied, a locally provisioned volume is used. | No | - | + +>__Note__: +> - If you specify `redis.storageClass`, the storage class must NOT be provisioned by the Dell CSI Driver to be configured with this installation of CSM Authorization. 6. Install the driver using `helm`: diff --git a/content/docs/deployment/offline/drivers/_index.md b/content/docs/deployment/offline/drivers/_index.md index b13c81f407..229207fec9 100644 --- a/content/docs/deployment/offline/drivers/_index.md +++ b/content/docs/deployment/offline/drivers/_index.md @@ -220,7 +220,7 @@ Loaded image: registry.k8s.io/sig-storage/csi-snapshotter:v6.2.2 ### Perform either a Helm installation or Operator installation -Now that the required images are available and the Helm Charts/Operator configuration updated, you can proceed by following the usual installation procedure as documented either via [Helm](../../../deployment/helm/drivers/installation) or [Operator](../../../deployment/csmoperator/#installation).. +Now that the required images are available and the Helm Charts/Operator configuration updated, you can proceed by following the usual installation procedure as documented either via [Helm](../../../deployment/helm/drivers/installation) or [Operator](../../../deployment/csmoperator/#installation). *NOTES:* 1. Offline bundle installation is only supported with manual installs i.e. without using Operator Lifecycle Manager.