PowerMax

Configuring PowerMax CSI Driver with CSM for Authorization

Given a setup where Kubernetes, a storage system, and the CSM for Authorization Proxy Server are deployed, follow these steps to configure the CSI Drivers to work with the Authorization sidecar:

Apply the secret containing the tenant token data into the driver namespace. It’s assumed that the Kubernetes administrator has the token secret manifest, generated by your storage administrator via Generate a Token, saved in /tmp/token.yaml.

#It is assumed that array type powermax has the namespace “powermax”.
```
   kubectl apply -f /tmp/token.yaml -n powermax
```
Edit these parameters in samples/secret/karavi-authorization-config.json file in CSI PowerMax driver and update/add connection information for one or more backend storage arrays. In an instance where multiple CSI drivers are configured on the same Kubernetes cluster, the port range in the endpoint parameter must be different for each driver.

Parameter	Description	Required	Default
username	Username for connecting to the backend storage array. This parameter is ignored.	No	-
password	Password for connecting to to the backend storage array. This parameter is ignored.	No	-
intendedEndpoint	HTTPS REST API endpoint of the backend storage array.	Yes	-
endpoint	HTTPS localhost endpoint that the authorization sidecar will listen on.	Yes	https://localhost:9400
systemID	System ID of the backend storage array.	Yes	" "
skipCertificateValidation	A boolean that enables/disables certificate validation of the backend storage array. This parameter is not used.	No	true
isDefault	A boolean that indicates if the array is the default array. This parameter is not used.	No	default value from values.yaml

Create the karavi-authorization-config secret using this command:


kubectl -n powermax create secret generic karavi-authorization-config --from-file=config=samples/secret/karavi-authorization-config.json -o yaml --dry-run=client | kubectl apply -f -

Create the proxy-server-root-certificate secret.

If running in insecure mode, create the secret with empty data:


kubectl -n powermax create secret generic proxy-server-root-certificate --from-literal=rootCertificate.pem= -o yaml --dry-run=client | kubectl apply -f -

Otherwise, create the proxy-server-root-certificate secret with the appropriate file:


kubectl -n powermax create secret generic proxy-server-root-certificate --from-file=rootCertificate.pem=/path/to/rootCA -o yaml --dry-run=client | kubectl apply -f -

Enable CSM Authorization in the driver installation applicable to your installation method.

Helm

In Install the Driver where you edit samples/secret/secret.yaml with the credentials of the PowerMax, you can leave these with the default values as they will be ignored.

Refer to the Install the Driver section to edit the parameters in my-powermax-settings.yaml file to configure the driver to communicate with the CSM Authorization sidecar.
- Update global.storageArrays.endpoint to match the localhost endpoint in samples/secret/karavi-authorization-config.json.
- Update global.managementServers.endpoint to match the localhost endpoint in samples/secret/karavi-authorization-config.json.
- Update authorization.enabled to true.
- Update authorization.sidecarProxyImage to the image of the CSM Authorization sidecar. In most cases, you can leave the default value.
- Update authorization.proxyHost to the hostname of the CSM Authorization Proxy Server.
- Update authorization.skipCertificateValidation to true or false depending on if you want to disable or enable certificate validation of the CSM Authorization Proxy Server.
Example:
```
global:
  storageArrays:
    - storageArrayId: "123456789"
      endpoint: https://localhost:9400
  managementServers:
    - endpoint: https://localhost:9400

authorization:
  enabled: true

  # sidecarProxyImage: the container image used for the csm-authorization-sidecar.
  # Default value: dellemc/csm-authorization-sidecar:v1.8.0
  sidecarProxyImage: dellemc/csm-authorization-sidecar:v1.8.0

  # proxyHost: hostname of the csm-authorization server
  # Default value: None
  proxyHost: csm-authorization.com

  # skipCertificateValidation: certificate validation of the csm-authorization server
  # Allowed Values:
  #   "true" - TLS certificate verification will be skipped
  #   "false" - TLS certificate will be verified 
  # Default value: "true" 
  skipCertificateValidation: true
```
Install the Dell CSI PowerMax driver following the appropriate documenation for your installation method.
(Optional) Install dellctl to perform Kubernetes administrator commands for additional capabilities (e.g., list volumes). Please refer to the dellctl documentation page for the installation steps and command list.