How to Install IBM Storage Scale Container Native Storage Access on AWS ROSA Like a Pro

Red Hat OpenShift Service on AWS (ROSA) is a hassle-free and fully-managed service that simplifies the deployment of OpenShift clusters on AWS. Since it is a completely managed service, there is no requirement to oversee the underlying infrastructure and allows you to quickly launch an operational OpenShift cluster for running your applications.

If you looking to deploy a ROSA cluster, but don’t know where to start? Don’t worry; you can learn about the various deployment options available, prerequisites, and step-by-step instructions to set up, configure from here.

Let’s shift our focus to the installation of IBM Storage Scale Container Native Storage Access on the ROSA platform. To ensure its proper functioning, “2” changes are required.

Before installing CNSA, it is necessary to carry out these changes.

Adding Scale Labels to the Machine Pool for MCO-Triggered kernel-devel Installation

In order for IBM Storage Scale to build its portability layer successfully, it is essential to install the kernel-devel package. Below steps are aimed to help you in installing kernel-devel via Machine Config Operator (MCO).

Note: The CNSA operator utilizes labels to obtain a list of worker nodes for its configuration. ROSA restricts you to modify the labels via “oc” command, hence it is advised to label workers via rosa CLI.

1. As an illustration, if you wish to assign the “scale” role to the worker nodes in the “Default” machine pool, you can use below;

# rosa edit machinepool -c <rosa-cluster-name> Default --labels node-role.kubernetes.io/scale=,scale.spectrum.ibm.com/daemon-selector= --replicas 3

2. If you are a standard user, you may not have permission to modify resources managed by Red Hat OpenShift. It is recommended to create a service account for the Machine Config Operator (MCO) by following the steps provided below:

# oc create serviceaccount scale-mco-sa
# oc adm policy add-cluster-role-to-user cluster-admin -z scale-mco-sa
# export MCO_SA_TOKEN=$(oc create token scale-mco-sa)
# oc login --token=$MCO_SA_TOKEN

3. Create a new machine config pool (this helps in separating out nodes with labels scale and worker into a new machine pool)

echo '
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfigPool
metadata:
  name: scale-mcp
spec:
  machineConfigSelector:
    matchExpressions:
      - {key: machineconfiguration.openshift.io/role, operator: In, values: [worker,scale]}
  nodeSelector:
    matchLabels:
      node-role.kubernetes.io/scale: ""
' | oc apply -f -

4. Apply the MCO settings (this installs the kernel-devel related packages on the workers used for CNSA configuration).

echo '
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  labels:
    machineconfiguration.openshift.io/role: "scale"
  name: 00-worker-ibm-spectrum-scale-kernel-devel
spec:
  selector:
    matchLabels:
      machineconfiguration.openshift.io/role: "scale"
  config:
    ignition:
      version: 3.2.0
  extensions:
     - kernel-devel
' | oc apply -f -

5. Cleanup the service account

# oc logout
# oc login <OpenShift_URL> -u <regular_user> -p <regular_user_password>
# oc delete sa scale-mco-sa

Authorising ROSA Worker Security Group for IBM Storage Scale Container Native Ports

IBM Storage Scale container native storage access application requires port 1234 (which is akin to port 22 for ssh on the host. SSH communication is required for administration), 1191 (port used by the daemon/mmfsd) and 60000–61000 (ephemeral port range required for concurrent intra-cluster activities).

1. In your AWS Management Console, navigate to the “EC2 Dashboard” in the region where ROSA is installed and select the “Security Groups” option from the navigation pane. Locate the Security Group for ROSA worker security group id and export the following variable.

export AWS_ROSA_WORKER_SECURITY_GROUP=<security_group_id>

2. Use the following commands to authorise ingress traffic to allow ports needed by IBM Spectrum Scale container native.

aws ec2 authorize-security-group-ingress --group-id ${AWS_ROSA_WORKER_SECURITY_GROUP} --protocol tcp --port 12345 --source-group ${AWS_ROSA_WORKER_SECURITY_GROUP}
aws ec2 authorize-security-group-ingress --group-id ${AWS_ROSA_WORKER_SECURITY_GROUP} --protocol tcp --port 1191 --source-group ${AWS_ROSA_WORKER_SECURITY_GROUP}
aws ec2 authorize-security-group-ingress --group-id ${AWS_ROSA_WORKER_SECURITY_GROUP} --protocol tcp --port 60000–61000 --source-group ${AWS_ROSA_WORKER_SECURITY_GROUP}

After the completion of these changes, you are ready to proceed with the installation of CNSA.

You can follow the documented steps here for installation. If you require additional information, you can refer to the CNSA documentation available here.