[MULTIARCH-3164] add NBDE encryption for IBM Z #58373

SNiemann15 · 2023-04-06T16:12:25Z

Version(s): 4.13 +

Issue: https://issues.redhat.com/browse/MULTIARCH-3164

Link to docs preview:

zVM
KVM

QE review:

QE has approved this change.

Additional information:

techrustlings

Done with the review.

techrustlings · 2023-04-07T05:41:31Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+====
+endif::ibm-z-kvm[]
+
+. Create a parameter file that includes `ignition.platform.id=metal` and `ignition.firstboot=true`.


kindly replace ignition.firstboot=true to only ignition.firstboot.

techrustlings · 2023-04-07T05:45:53Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+
+[source,terminal]
+----
+$ coreos-installer pxe customize rhcos-<version>-live-initramfs.x86_64.img \


rhcos-<version>-live-initramfs.x86_64.img is not required. as we already providing the path to the initramfs in the next line 68.

techrustlings · 2023-04-07T05:50:24Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+
+[source,terminal]
+----
+$ coreos-installer pxe customize rhcos-<version>-live-initramfs.x86_64.img \


rhcos--live-initramfs.x86_64.img need removal as we already providing the initramfs file location on line number 68.

techrustlings · 2023-04-07T06:39:02Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+
+. Create a parameter file that includes `ignition.platform.id=metal` and `ignition.firstboot=true`.
+
+The following example kernel parameter utane configuration for a control plane node creates a file named `master-storage.bu` for disk encryption:ecify the matching rootfs artifact for the kernel and initramfs you are booting. Only HTTP and HTTPS protocols are supported.


spell error replace utane to butane and encryption:ecify

ocpdocs-previewbot · 2023-04-11T11:36:35Z

🤖 Updated build preview is available at:
https://58373--docspreview.netlify.app

Build log: https://circleci.com/gh/ocpdocs-previewbot/openshift-docs/16081

bgilbert · 2023-04-12T14:47:09Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+    tang:
+      - url: http://12.23.21.58:7500
+        thumbprint: QcPr_NHFJammnRCA3fFMVdNBwjs
+    threshold: 1


The threshold defaults to 1, so this could be omitted.

bgilbert · 2023-04-12T14:56:14Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+
+[NOTE]
+====
+To encrypt DASD disks you must add `device: /dev/disk/by-label/root` to the Ignition file that is generated by Butane.


This one line isn't enough detail; we should give step-by-step instructions.

But, stepping back a bit: please don't ask users to manually modify Butane output. It's not how Butane is supposed to be used. Also, there's no guarantee that Butane's x86_64 template will meet the needs of s390x in the future, since s390x considerations are out of scope there. Instead, please use a Butane config that describes the necessary configuration in the storage section, avoiding boot_device altogether. See coreos/butane#453 for more info.

bgilbert · 2023-04-12T14:58:46Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+----
+rd.neednet=1 \
+console=ttysclp0 \
+coreos.inst.install_dev=dasda \ <1>


Omitting /dev/ is legacy syntax.

Suggested change

coreos.inst.install_dev=dasda \ <1>

coreos.inst.install_dev=/dev/dasda \ <1>

bgilbert · 2023-04-12T14:58:51Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+rd.neednet=1 \
+console=ttysclp0 \
+coreos.inst.install_dev=dasda \ <1>
+ignition.firstboot=true ignition.platform.id=metal \


Suggested change

ignition.firstboot=true ignition.platform.id=metal \

ignition.firstboot ignition.platform.id=metal \

techrustlings

Updated the configuration as suggested by Benjamin.

techrustlings · 2023-04-17T05:46:39Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+
+[source,yaml]
+----
+variant: openshift


The shortcut method works with s390x zfcp, but not works with dasd. So editing the ignition is not recommended. Define the storage configuration directly in the butane. Kindly remove the line from 41 to 52 and add the following config as example.

variant: openshift version: 4.13.0 metadata: name: master-storage labels: machineconfiguration.openshift.io/role: master storage: filesystems: - device: /dev/mapper/root format: xfs label: root wipe_filesystem: true luks: - clevis: tang: - thumbprint: QcPr_NHFJammnRCA3fFMVdNBwjs url: http://12.23.21.58:7500 device: /dev/disk/by-partlabel/root label: luks-root name: root wipe_volume: true

techrustlings · 2023-04-17T05:50:38Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+
+[NOTE]
+====
+To encrypt DASD disks you must add `device: /dev/disk/by-label/root` to the Ignition file that is generated by Butane.


Replace line 60 To encrypt DASD disks you must add device: /dev/disk/by-label/root to the Ignition file that is generated by Butane. <- To -> To encrypt DASD disks you must add device: /dev/disk/by-label/root to the butane file

It seems clearer to make this a footnote on the relevant Butane config line.

techrustlings · 2023-04-17T06:16:14Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+rd.znet=qeth,0.0.bdd0,0.0.bdd1,0.0.bdd2,layer2=1 \
+rd.zfcp=0.0.5677,0x600606680g7f0056,0x034F000000000000
+----
+<1> For installations on DASD-type disks, add `coreos.inst.install_dev=dasda`. Omit this value for FCP-type disks.


Kindly replace coreos.inst.install_dev=dasda to coreos.inst.install_dev=/dev/dasda

techrustlings · 2023-04-17T07:51:10Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+----
+rd.neednet=1 \
+console=ttysclp0 \
+ignition.firstboot=true ignition.platform.id=metal \


ignition.firstboot=true to ignition.firstboot

bgilbert · 2023-05-07T06:55:28Z

modules/installation-full-ibm-z-kvm-user-infra-machines-iso.adoc

@@ -55,7 +55,7 @@ $ virt-install \
   --network network={virt_network_parm} \
   --boot hd \
   --location {media_location},kernel={rhcos_kernel},initrd={rhcos_initrd} \
-   --extra-args "rd.neednet=1 coreos.inst=yes coreos.inst.install_dev=vda coreos.live.rootfs_url={rhcos_liveos} ip={ip}::{default_gateway}:{subnet_mask_length}:{vn_name}:enc1:none:{MTU} nameserver={dns} coreos.inst.ignition_url={rhcos_ign}" \
+   --extra-args "rd.neednet=1 coreos.inst=yes coreos.inst.install_dev=/dev/vda coreos.live.rootfs_url={rhcos_liveos} ip={ip}::{default_gateway}:{subnet_mask_length}:{vn_name}:enc1:none:{MTU} nameserver={dns} coreos.inst.ignition_url={rhcos_ign}" \


coreos.inst=yes is obsolete.

Suggested change

--extra-args "rd.neednet=1 coreos.inst=yes coreos.inst.install_dev=/dev/vda coreos.live.rootfs_url={rhcos_liveos} ip={ip}::{default_gateway}:{subnet_mask_length}:{vn_name}:enc1:none:{MTU} nameserver={dns} coreos.inst.ignition_url={rhcos_ign}" \

--extra-args "rd.neednet=1 coreos.inst.install_dev=/dev/vda coreos.live.rootfs_url={rhcos_liveos} ip={ip}::{default_gateway}:{subnet_mask_length}:{vn_name}:enc1:none:{MTU} nameserver={dns} coreos.inst.ignition_url={rhcos_ign}" \

bgilbert · 2023-05-07T17:00:06Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+ifndef::ibm-z-kvm[]
+<1> For installations on DASD-type disks, replace with `device: /dev/disk/by-label/root`.
+endif::ibm-z-kvm[]
+


The instructions don't say what to do with the Butane config once created. I assume we want to render it to a MachineConfig and add that to the install templates? We usually give explicit steps for that.

We have a link to Creating machine configs with Butane in the additional resources.

Sure, but I think there's a risk that users will follow the steps verbatim and won't realize that additional actions are implied.

Just below the line no 71 a Note section will remind the user to follow the Adding day 1 kernel arguments. Like below .

Generate the MachineConfig object from master-storage.bu by using butane and place it in the Openshift installation directory as described in "Adding day-1 kernel arguments"

Lets tackle this issue after 4.13 GA.

bgilbert · 2023-05-07T17:00:52Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+      name: root
+      wipe_volume: true
+openshift:
+  fips: true


Are we requiring FIPS mode? If not, we should footnote that this is optional.

Not required will remove the line.

Since this has been reinstated, would it make sense to footnote it?

Yes it makes sense. I added the callout text we use in the sample install-config.yaml for FIPS

bgilbert · 2023-05-07T17:03:25Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+      label: root
+      wipe_filesystem: true
+  luks:
+    - clevis:


In the FIPS case, the luks entry should also include:

options: - --cipher - aes-cbc-essiv:sha256

We need this to ensure that we're using a FIPS 140-2 compatible cipher mode. The default cipher mode is too new for 140-2 (but is supported in 140-3). Normally Butane handles this if it sees boot_device.luks and also openshift.fips: true, but since we're not using boot_device we need to do this ourselves.

I'd be inclined to footnote it and say that it's only needed in FIPS mode.

Not needed because I removed FIPS entry.

@SNiemann15 the comment from @bgilbert catched my eyes.
in case a customer want to have fips mode & a change for LUKS is required to adjust the cipher, we might want to document that. Because encryption is kind of base for compliance rules which also includes FIPS.

bgilbert · 2023-05-07T17:06:39Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+----
+$ coreos-installer pxe customize \
+    /root/rhcos-bootfiles/rhcos-<release>-live-initramfs.s390x.img \
+    --dest-device /dev/sda --dest-karg-append \


--dest-device does the same thing as coreos.inst.install_dev in the next step. I think it's better to only use --dest-device, and footnote the different values that should be used for virt/ECKD/FCP.

We do not require --dest-device in initramfs file for Dasda configuration. It has been mentioned in the call out section just below the example.

I'm suggesting that the instructions either consistently use only --dest-device or consistently use only coreos.inst.install_dev, rather than sometimes using both and having the latter override the former.

We used --dest-device in coreos-installer command, and the coreos.inst.install_dev we used in the kernel param file which we punch during the installation. Are you suggesting we use --dest-device in kernel param file too?

No, I'm suggesting that we either use --dest-device in the coreos-installer pxe customize command or coreos.inst.install_dev in the kernel param file. It's unnecessary and confusing to use both.

bgilbert · 2023-05-07T17:09:40Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+    - clevis:
+        tang:
+          - thumbprint: QcPr_NHFJammnRCA3fFMVdNBwjs
+            url: http://12.23.21.58:7500


Might be clearer to use e.g. http://clevis.example.com/ to show that this shouldn't be used as-is.

Replace with http://clevis.example.com:7500

bgilbert · 2023-05-07T17:11:45Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+  labels:
+    machineconfiguration.openshift.io/role: master
+storage:
+  filesystems:


Nit: Butane doesn't care either way, but I'd be inclined to put this section after the luks section to make the execution order clearer.

variant: openshift
version: 4.13.0
metadata:
name: master-storage
labels:
machineconfiguration.openshift.io/role: master
storage:
luks:
- clevis:
tang:
- thumbprint: QcPr_NHFJammnRCA3fFMVdNBwjs
url: http://clevis.example.com:7500
device: /dev/disk/by-partlabel/root
label: luks-root
name: root
wipe_volume: true
filesystems:
- device: /dev/mapper/root
format: xfs
label: root
wipe_filesystem: true

bgilbert · 2023-05-07T17:14:43Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+  fips: true
+----
+ifndef::ibm-z-kvm[]
+<1> For installations on DASD-type disks, replace with `device: /dev/disk/by-label/root`.


Using /dev/disk/by-label/root rather than e.g. /dev/dasda3 (where the user has to fill in the correct disk instead of /dev/dasda) is a bit of a hack, but it does simplify the docs, and I think I'm okay with it. If we're using this approach, maybe it's worth simplifying by using /dev/disk/by-label/root for the virt case too.

Any thoughts on doing this?

Hi @bgilbert , /dev/disk/by-partlabel/root works with KVM too. During the testing on KVM and zVM the configuration are similar. I did not done explicit test using /dev/disk/by-label/root in virtual (kvm) and zVM case because on the first shot it worked.

I'm suggesting that, if we're going to use the /dev/disk/by-label/root hack, we might as well use it in all cases to avoid the footnote and additional explanation. It should work equally well everywhere.

To be clear, this is a cleanup, not a blocker.

bgilbert · 2023-05-07T17:22:44Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+
+[NOTE]
+====
+Before first boot, you must customize the initramfs for each node in the cluster and add PXE kernel parameters.


Hmm, this note confuses me. Why is it only shown in the non-KVM case, and what does it add that the rest of the doc hasn't already said?

We need it KVM case as well.

bgilbert · 2023-05-07T17:23:37Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+<1> For installations on DASD-type disks, replace with `device: /dev/disk/by-label/root`.
+endif::ibm-z-kvm[]
+
+. Create a customized initramfs file, by running the following command:


We don't explicitly say that the customized initramfs should be used instead of the default initramfs when booting the machine. Should we?

We do not need to call that out explicitly.

I think that leaves users to fill in the gaps, and there's little harm in calling it out explicitly.

Ok, I think we are already providing the Note just below the command. So explicitly calling "customised" may not be relevant.

bgilbert · 2023-05-08T23:44:56Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+    - clevis:
+        tang:
+          - thumbprint: QcPr_NHFJammnRCA3fFMVdNBwjs
+            url: http://<clevis.example.com>:7500


Hmm, the angle brackets read as slightly confusing to me.

We need to remove angle bracket..

Ok will remove. Usually variables that get replaced have those brackets. But I also thought looks strange in this case.

bgilbert · 2023-05-08T23:45:21Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+  fips: true
+----
+ifndef::ibm-z-kvm[]
+<1> For installations on DASD-type disks, replace with `device: /dev/disk/by-label/root`.


Any thoughts on doing this?

bgilbert · 2023-05-08T23:46:38Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+<1> For installations on DASD-type disks, replace with `device: /dev/disk/by-label/root`.
+endif::ibm-z-kvm[]
+
+. Create a customized initramfs file, by running the following command:


I think that leaves users to fill in the gaps, and there's little harm in calling it out explicitly.

SNiemann15 · 2023-05-10T13:30:13Z

/label peer-review-needed

QE review is still in progress.

openshift-ci · 2023-05-10T14:53:56Z

@ocpdocs-previewbot: user ocpdocs-previewbot is not trusted for pull request #58373

madhu-pillai · 2023-05-10T16:27:19Z

Looks good to me.

snarayan-redhat

Overall looks good! Few suggestions and nits.

snarayan-redhat · 2023-05-11T07:47:32Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+
+.Prerequisites
+
+* You set up the External Tang Server. See link:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/configuring-automated-unlocking-of-encrypted-volumes-using-policy-based-decryption_security-hardening#network-bound-disk-encryption_configuring-automated-unlocking-of-encrypted-volumes-using-policy-based-decryption[Network-bound disk encryption] for instructions.


Suggested change

* You set up the External Tang Server. See link:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/configuring-automated-unlocking-of-encrypted-volumes-using-policy-based-decryption_security-hardening#network-bound-disk-encryption_configuring-automated-unlocking-of-encrypted-volumes-using-policy-based-decryption[Network-bound disk encryption] for instructions.

* You have set up the External Tang Server. See link:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/configuring-automated-unlocking-of-encrypted-volumes-using-policy-based-decryption_security-hardening#network-bound-disk-encryption_configuring-automated-unlocking-of-encrypted-volumes-using-policy-based-decryption[Network-bound disk encryption] for instructions.

snarayan-redhat · 2023-05-11T08:52:53Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+
+. Create Butane config files for the control plane and compute nodes.
+
+The following example Butane configuration for a control plane node creates a file named `master-storage.bu` for disk encryption:


Suggested change

The following example Butane configuration for a control plane node creates a file named `master-storage.bu` for disk encryption:

The following example of Butane configuration for a control plane node creates a file named `master-storage.bu` for disk encryption:

snarayan-redhat · 2023-05-11T08:54:56Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+
+.Procedure
+
+. Create Butane config files for the control plane and compute nodes.


Suggested change

. Create Butane config files for the control plane and compute nodes.

. Create Butane configuration files for the control plane and compute nodes.

snarayan-redhat · 2023-05-11T08:57:16Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+
+[NOTE]
+====
+Before first boot, you must customize the initramfs for each node in the cluster and add PXE kernel parameters.


Suggested change

Before first boot, you must customize the initramfs for each node in the cluster and add PXE kernel parameters.

Before first boot, you must customize the initramfs for each node in the cluster, and add PXE kernel parameters.

snarayan-redhat · 2023-05-11T09:00:27Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+rd.neednet=1 \
+console=ttysclp0 \
+ignition.firstboot ignition.platform.id=metal \
+coreos.live.rootfs_url=http://10.19.17.25/redhat/ocp/rhcos-413.86.202302201445-0/rhcos-413.86.202302201445-0-live-rootfs.s390x.img \
+coreos.inst.ignition_url=http://bastion.ocp-cluster1.example.com:8080/ignition/master.ign \
+ip=10.19.17.2::10.19.17.1:255.255.255.0::enbdd0:none nameserver=10.19.17.1 \
+zfcp.allow_lun_scan=0 \
+rd.znet=qeth,0.0.bdd0,0.0.bdd1,0.0.bdd2,layer2=1 \
+rd.zfcp=0.0.5677,0x600606680g7f0056,0x034F000000000000


Just mentioning that this block doesn't have callouts unlike the previous ifndef::ibm-z-kvm[] block, in case you think it's a miss. If it is intentional, then great.

Intentional :-)

snarayan-redhat · 2023-05-11T09:01:22Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+
+. Create a parameter file that includes `ignition.platform.id=metal` and `ignition.firstboot`.
+
+Example kernel parameter file for the control plane machine:


Suggested change

Example kernel parameter file for the control plane machine:

.Example kernel parameter file for the control plane machine:

snarayan-redhat · 2023-05-11T09:01:32Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+
+. Create a parameter file that includes `ignition.platform.id=metal` and `ignition.firstboot`.
+
+Example kernel parameter file for the control plane machine:


Suggested change

Example kernel parameter file for the control plane machine:

.Example kernel parameter file for the control plane machine:

snarayan-redhat · 2023-05-11T09:03:47Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+----
+endif::ibm-z-kvm[]
+
+Write all options in the parameter file as a single line and make sure you have no newline characters.


This can be a note or added to the step above. I would prefer a note consideirng the structure and reowrding it to be something like:
Ensure that all options in the parameter file are in a single line, and have no newline characters.

I would like to keep this active voice. But having it as a note is a good suggestion.

SNiemann15 · 2023-05-11T14:17:09Z

/label merge-review-needed

adellape · 2023-05-11T18:52:54Z

@SNiemann15 Please squash to 1 commit and re-queue for merge review. Also, I couldn't tell per the earlier comment whether QE review was completed or not at this point?

Thank you!

SNiemann15 · 2023-05-12T07:33:24Z

@SNiemann15 Please squash to 1 commit and re-queue for merge review. Also, I couldn't tell per the earlier comment whether QE review was completed or not at this point?

Thank you!

@adellape Really strange I squashed yesterday I assume the squash got stuck in the github issues.
Yes QE review is completed in the meantime. Both Holger and Benjamin ack'd.

SNiemann15 · 2023-05-12T07:34:08Z

/label merge-review-needed

bscott-rh · 2023-05-15T12:23:12Z

modules/ibmz-configure-nbde-with-static-ip.adoc

+$ coreos-installer pxe customize \
+    /root/rhcos-bootfiles/rhcos-<release>-live-initramfs.s390x.img \
+    --dest-device /dev/sda --dest-karg-append \
+    ip=<ip-address>::<gateway-ip>:<subnet-mask>::<network-device>:none \
+    --dest-karg-append nameserver=<nameserver-ip> \
+    --dest-karg-append rd.neednet=1 -o \
+    /root/rhcos-bootfiles/<Node-name>-initramfs.s390x.img
+----


I am not going to hold up the PR for this, but I would strongly recommend coming back later and adding annotations/callouts to describe the user-replaced values in this block.

I'll pick that up in the follow-up PR we are planning post GA.

bscott-rh · 2023-05-15T12:43:47Z

installing/installing_ibm_z/installing-ibm-z-kvm.adoc

+[id="additional-resources_configure-nbde-ibm-z-kvm"]
+.Additional resources
+
+* xref:../../installing/install_config/installing-customizing.adoc#installing-customizing[Creating machine configs with Butane].


Suggested change

* xref:../../installing/install_config/installing-customizing.adoc#installing-customizing[Creating machine configs with Butane].

* xref:../../installing/install_config/installing-customizing.adoc#installation-special-config-butane_installing-customizing[Creating machine configs with Butane]

Please remove the period from end of the additional resources xrefs in these 4 assemblies as they are not complete sentences. I also updated the xref anchor to go directly to the "Creating machine configs with Butane" section which could be updated in all 4 assemblies. Thank you!

bscott-rh · 2023-05-15T14:05:08Z

/cherrypick enterprise-4.13

openshift-cherrypick-robot · 2023-05-15T14:05:56Z

@bscott-rh: new pull request created: #60007

In response to this:

/cherrypick enterprise-4.13

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

bscott-rh · 2023-05-15T14:22:56Z

Merged and cherrypicked to enterprise-4.13.

openshift-ci bot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Apr 6, 2023

SNiemann15 force-pushed the ibmz_nbde branch from aab8b23 to c2955e1 Compare April 6, 2023 20:19

techrustlings reviewed Apr 7, 2023

View reviewed changes

openshift-ci bot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Apr 7, 2023

SNiemann15 force-pushed the ibmz_nbde branch from c5a1c0c to a606796 Compare April 11, 2023 11:29

SNiemann15 force-pushed the ibmz_nbde branch from a606796 to dc8f833 Compare April 12, 2023 12:51

openshift-ci bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Apr 12, 2023

SNiemann15 force-pushed the ibmz_nbde branch from dc8f833 to a0b2d75 Compare April 12, 2023 13:52

bgilbert reviewed Apr 12, 2023

View reviewed changes

techrustlings reviewed Apr 17, 2023

View reviewed changes

SNiemann15 force-pushed the ibmz_nbde branch 2 times, most recently from 9c0d889 to 1200491 Compare May 4, 2023 13:24

bgilbert reviewed May 7, 2023

View reviewed changes

SNiemann15 force-pushed the ibmz_nbde branch from 1200491 to 5eb0fc1 Compare May 8, 2023 15:12

SNiemann15 changed the title ~~WIP [MULTIARCH-3164] add NBDE encryption for IBM Z~~ [MULTIARCH-3164] add NBDE encryption for IBM Z May 8, 2023

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 8, 2023

SNiemann15 force-pushed the ibmz_nbde branch from 3cf8c95 to f86117a Compare May 8, 2023 15:45

bgilbert reviewed May 8, 2023

View reviewed changes

SNiemann15 force-pushed the ibmz_nbde branch 2 times, most recently from 840311f to 1d9cfb3 Compare May 10, 2023 07:05

openshift-ci bot added the peer-review-needed Signifies that the peer review team needs to review this PR label May 10, 2023

SNiemann15 force-pushed the ibmz_nbde branch from 1d9cfb3 to c0fbbe4 Compare May 10, 2023 14:23

SNiemann15 force-pushed the ibmz_nbde branch from c0fbbe4 to 6a26092 Compare May 10, 2023 16:44

SNiemann15 force-pushed the ibmz_nbde branch from 46b2126 to 77878b1 Compare May 11, 2023 08:32

snarayan-redhat reviewed May 11, 2023

View reviewed changes

snarayan-redhat added peer-review-done Signifies that the peer review team has reviewed this PR and removed peer-review-in-progress Signifies that the peer review team is reviewing this PR peer-review-needed Signifies that the peer review team needs to review this PR labels May 11, 2023

openshift-ci bot added the merge-review-needed Signifies that the merge review team needs to review this PR label May 11, 2023

adellape added the merge-review-in-progress Signifies that the merge review team is reviewing this PR label May 11, 2023

adellape removed merge-review-in-progress Signifies that the merge review team is reviewing this PR merge-review-needed Signifies that the merge review team needs to review this PR labels May 11, 2023

SNiemann15 force-pushed the ibmz_nbde branch from 64a14ab to acaa4c6 Compare May 12, 2023 07:24

openshift-ci bot added the merge-review-needed Signifies that the merge review team needs to review this PR label May 12, 2023

bscott-rh added the merge-review-in-progress Signifies that the merge review team is reviewing this PR label May 15, 2023

bscott-rh reviewed May 15, 2023

View reviewed changes

SNiemann15 added 2 commits May 15, 2023 15:51

add NBDE encryption for IBM Z

c8241d6

changes from merge review

f950ddb

SNiemann15 force-pushed the ibmz_nbde branch from acaa4c6 to f950ddb Compare May 15, 2023 13:52

bscott-rh added the branch/enterprise-4.13 label May 15, 2023

bscott-rh added this to the Planned for 4.13 GA milestone May 15, 2023

bscott-rh removed merge-review-in-progress Signifies that the merge review team is reviewing this PR merge-review-needed Signifies that the merge review team needs to review this PR labels May 15, 2023

bscott-rh merged commit e38fb5e into openshift:main May 15, 2023

openshift-cherrypick-robot mentioned this pull request May 15, 2023

[enterprise-4.13] [MULTIARCH-3164] add NBDE encryption for IBM Z #60007

Merged

	coreos.inst.install_dev=dasda \ <1>
	coreos.inst.install_dev=/dev/dasda \ <1>

	ignition.firstboot=true ignition.platform.id=metal \
	ignition.firstboot ignition.platform.id=metal \

	--extra-args "rd.neednet=1 coreos.inst=yes coreos.inst.install_dev=/dev/vda coreos.live.rootfs_url={rhcos_liveos} ip={ip}::{default_gateway}:{subnet_mask_length}:{vn_name}:enc1:none:{MTU} nameserver={dns} coreos.inst.ignition_url={rhcos_ign}" \
	--extra-args "rd.neednet=1 coreos.inst.install_dev=/dev/vda coreos.live.rootfs_url={rhcos_liveos} ip={ip}::{default_gateway}:{subnet_mask_length}:{vn_name}:enc1:none:{MTU} nameserver={dns} coreos.inst.ignition_url={rhcos_ign}" \


		.Prerequisites

		* You set up the External Tang Server. See link:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/configuring-automated-unlocking-of-encrypted-volumes-using-policy-based-decryption_security-hardening#network-bound-disk-encryption_configuring-automated-unlocking-of-encrypted-volumes-using-policy-based-decryption[Network-bound disk encryption] for instructions.

	The following example Butane configuration for a control plane node creates a file named `master-storage.bu` for disk encryption:
	The following example of Butane configuration for a control plane node creates a file named `master-storage.bu` for disk encryption:


		.Procedure

		. Create Butane config files for the control plane and compute nodes.

	. Create Butane config files for the control plane and compute nodes.
	. Create Butane configuration files for the control plane and compute nodes.

	Before first boot, you must customize the initramfs for each node in the cluster and add PXE kernel parameters.
	Before first boot, you must customize the initramfs for each node in the cluster, and add PXE kernel parameters.

	Example kernel parameter file for the control plane machine:
	.Example kernel parameter file for the control plane machine:

	* xref:../../installing/install_config/installing-customizing.adoc#installing-customizing[Creating machine configs with Butane].
	* xref:../../installing/install_config/installing-customizing.adoc#installation-special-config-butane_installing-customizing[Creating machine configs with Butane]

[MULTIARCH-3164] add NBDE encryption for IBM Z #58373

[MULTIARCH-3164] add NBDE encryption for IBM Z #58373

Conversation

SNiemann15 commented Apr 6, 2023 • edited Loading

techrustlings left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ocpdocs-previewbot commented Apr 11, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

techrustlings left a comment

Choose a reason for hiding this comment

techrustlings Apr 17, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

SNiemann15 commented May 10, 2023

openshift-ci bot commented May 10, 2023

madhu-pillai commented May 10, 2023

snarayan-redhat left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

SNiemann15 commented May 11, 2023

adellape commented May 11, 2023

SNiemann15 commented May 12, 2023

SNiemann15 commented May 12, 2023

SNiemann15 commented Apr 6, 2023 •

edited

Loading

ocpdocs-previewbot commented Apr 11, 2023 •

edited

Loading

techrustlings Apr 17, 2023 •

edited

Loading