PowerMax

CSI Driver for Dell PowerMax can be deployed by using the provided Helm v3 charts and installation scripts on both Kubernetes and OpenShift platforms. For more detailed information on the installation scripts, see the script documentation.

The controller section of the Helm chart installs the following components in a Deployment in the specified namespace:

• CSI Driver for Dell PowerMax
• Kubernetes External Provisioner, which provisions the volumes
• Kubernetes External Attacher, which attaches the volumes to the containers
• Kubernetes External Snapshotter, which provides snapshot support-
• CSI PowerMax ReverseProxy, which maximizes CSI driver and Unisphere performance
• Kubernetes External Resizer, which resizes the volume
• (optional) Kubernetes External health monitor, which provides volume health status
• (optional) Dell CSI Replicator, which provides Replication capability.
• (optional) Dell CSI Migrator, which provides migrating capability within and across arrays
• (optional) Node rescanner, which rescans the node for new data paths after migration

The node section of the Helm chart installs the following component in a DaemonSet in the specified namespace:

• CSI Driver for Dell PowerMax
• Kubernetes Node Registrar, which handles the driver registration

Prerequisites

The following requirements must be met before installing CSI Driver for Dell PowerMax:

• Install Kubernetes or OpenShift (see supported versions)
• Install Helm 3
• Fibre Channel requirements
• iSCSI requirements
• Auto RDM for vSphere over FC requirements
• Certificate validation for Unisphere REST API calls
• Mount propagation is enabled on container runtime that is being used
• Linux multipathing requirements
• If using Snapshot feature, satisfy all Volume Snapshot requirements
• If enabling CSM for Authorization, please refer to the Authorization deployment steps first
• If using Powerpath , install the PowerPath for Linux requirements

Prerequisite for CSI Reverse Proxy

CSI PowerMax Reverse Proxy is an HTTPS server and has to be configured with an SSL certificate and a private key.

The certificate and key are provided to the proxy via a Kubernetes TLS secret (in the same namespace). The SSL certificate must be an X.509 certificate encoded in PEM format. The certificates can be obtained via a Certificate Authority or can be self-signed and generated by a tool such as openssl.

Here is an example showing how to generate a private key and use that to sign an SSL certificate using the openssl tool:

openssl genrsa -out tls.key 2048
openssl req -new -x509 -sha256 -key tls.key -out tls.crt -days 3650
kubectl create secret -n <namespace> tls revproxy-certs --cert=tls.crt --key=tls.key
kubectl create secret -n <namespace> tls csirevproxy-tls-secret --cert=tls.crt --
key=tls.key

Install Helm 3

Install Helm 3 on the master node before you install CSI Driver for Dell PowerMax.

Steps

Run the curl https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | bash command to install Helm 3.

Fibre Channel Requirements

CSI Driver for Dell PowerMax supports Fibre Channel communication. Ensure that the following requirements are met before you install CSI Driver:

• Zoning of the Host Bus Adapters (HBAs) to the Fibre Channel port director must be completed.
• Ensure that the HBA WWNs (initiators) appear on the list of initiators that are logged into the array.
• If the number of volumes that will be published to nodes is high, then configure the maximum number of LUNs for your HBAs on each node. See the appropriate HBA document to configure the maximum number of LUNs.

iSCSI Requirements

The CSI Driver for Dell PowerMax supports iSCSI connectivity. These requirements are applicable for the nodes that use iSCSI initiator to connect to the PowerMax arrays.

Set up the iSCSI initiators as follows:

• All Kubernetes nodes must have the iscsi-initiator-utils package installed.
• Ensure that the iSCSI initiators are available on all the nodes where the driver node plugin will be installed.
• Kubernetes nodes should have access (network connectivity) to an iSCSI director on the Dell PowerMax array that has IP interfaces. Manually create IP routes for each node that connects to the Dell PowerMax if required.
• Ensure that the iSCSI initiators on the nodes are not a part of any existing Host (Initiator Group) on the Dell PowerMax array.
• The CSI Driver needs the port group names containing the required iSCSI director ports. These port groups must be set up on each Dell PowerMax array. All the port group names supplied to the driver must exist on each Dell PowerMax with the same name.

For more information about configuring iSCSI, see Dell Host Connectivity guide.

Auto RDM for vSphere over FC requirements

The CSI Driver for Dell PowerMax supports auto RDM for vSphere over FC. These requirements are applicable for the clusters deployed on ESX/ESXi using virtualized environement.

Set up the environment as follows:

• Requires VMware vCenter management software to manage all ESX/ESXis where the cluster is hosted.

• Add all FC array ports zoned to the ESX/ESXis to a port group where the cluster is hosted .

• Add initiators from all ESX/ESXis to a host(initiator group) where the cluster is hosted.

• Edit samples/secret/vcenter-secret.yaml file, to point to the correct namespace, and replace the values for the username and password parameters. These values can be obtained using base64 encoding as described in the following example:

  echo -n "myusername" | base64
  echo -n "mypassword" | base64
  

  where myusername and mypassword are credentials for a user with vCenter privileges.

Note: Initiators from all ESX/ESXi should be part of a single host(initiator group) and not hostgroup(cascaded intitiator group).

Create the secret by running the below command, kubectl create -f samples/secret/vcenter-secret.yaml.

Certificate validation for Unisphere REST API calls

As part of the CSI driver installation, the CSI driver requires a secret with the name powermax-certs present in the namespace powermax. This secret contains the X509 certificates of the CA which signed the Unisphere SSL certificate in PEM format. This secret is mounted as a volume in the driver container. In earlier releases, if the install script did not find the secret, it created an empty secret with the same name. From the 1.2.0 release, the secret volume has been made optional. The install script no longer attempts to create an empty secret.

The CSI driver exposes an install parameter skipCertificateValidation which determines if the driver performs client-side verification of the Unisphere certificates. The skipCertificateValidation parameter is set to true by default, and the driver does not verify the Unisphere certificates.

If the skipCertificateValidation parameter is set to false and a previous installation attempt created an empty secret, then this secret must be deleted and re-created using the CA certs.

If the Unisphere certificate is self-signed or if you are using an embedded Unisphere, then perform the following steps:

1. To fetch the certificate, run openssl s_client -showcerts -connect [Unisphere IP]:8443 </dev/null 2> /dev/null | openssl x509 -outform PEM > ca_cert.pem

   NOTE: The IP address varies for each user.

2. To create the secret, run kubectl create secret generic powermax-certs --from-file=ca_cert.pem -n powermax

Ports in the port group

There are no restrictions to how many ports can be present in the iSCSI port groups provided to the driver.

The same applies to Fibre Channel where there are no restrictions on the number of FA directors a host HBA can be zoned to. See the best practices for host connectivity to Dell PowerMax to ensure that you have multiple paths to your data volumes.

Linux multipathing requirements

CSI Driver for Dell PowerMax supports Linux multipathing. Configure Linux multipathing before installing the CSI Driver.

Set up Linux multipathing as follows:

• All the nodes must have the Device Mapper Multipathing package installed.
  NOTE: When this package is installed it creates a multipath configuration file which is located at /etc/multipath.conf. Please ensure that this file always exists.
• Enable multipathing using mpathconf --enable --with_multipathd y
• Enable user_friendly_names and find_multipaths in the multipath.conf file.

As a best practice, use the following options to help the operating system and the mulitpathing software detect path changes efficiently:

path_grouping_policy multibus
path_checker tur
features "1 queue_if_no_path"
path_selector "round-robin 0"
no_path_retry 10

PowerPath for Linux requirements

CSI Driver for Dell PowerMax supports PowerPath for Linux. Configure Linux PowerPath before installing the CSI Driver.

Set up the PowerPath for Linux as follows:

• All the nodes must have the PowerPath package installed . Download the PowerPath archive for the environment from Dell Online Support.
• Untar the PowerPath archive, Copy the RPM package into a temporary folder and Install PowerPath using rpm -ivh DellEMCPower.LINUX-<version>-<build>.<platform>.x86_64.rpm
• Start the PowerPath service using systemctl start PowerPath

Note: Do not install Dell PowerPath if multi-path software is already installed, as they cannot co-exist with native multi-path software.

(Optional) Volume Snapshot Requirements

For detailed snapshot setup procedure, click here.

(Optional) Replication feature Requirements

Applicable only if you decided to enable the Replication feature in values.yaml

replication:
  enabled: true

Replication CRD’s

The CRDs for replication can be obtained and installed from the csm-replication project on Github. Use csm-replication/deploy/replicationcrds.all.yaml located in the csm-replication git repo for the installation.

CRDs should be configured during replication prepare stage with repctl as described in install-repctl

Install the Driver

Steps

1. Run git clone -b v2.6.0 https://github.com/dell/csi-powermax.git to clone the git repository. This will include the Helm charts and dell-csi-helm-installer scripts.
2. Ensure that you have created a namespace where you want to install the driver. You can run kubectl create namespace powermax to create a new one
3. Edit the samples/secret/secret.yaml file,to point to the correct namespace, and replace the values for the username and password parameters. These values can be obtained using base64 encoding as described in the following example:

   echo -n "myusername" | base64
   echo -n "mypassword" | base64
   

   where myusername and mypassword are credentials for a user with PowerMax privileges.
4. Create the secret by running kubectl create -f samples/secret/secret.yaml.
5. Create a TLS secret with the name - csireverseproxy-tls-secret which holds an SSL certificate and the corresponding private key in the namespace where you are installing the driver.
6. Copy the default values.yaml file cd helm && cp csi-powermax/values.yaml my-powermax-settings.yaml
7. Ensure the unisphere have 10.0 REST endpoint support by clicking on Unisphere -> Help (?) -> About in Unisphere for PowerMax GUI.
8. Edit the newly created file and provide values for the following parameters vi my-powermax-settings.yaml

8. Install the driver using csi-install.sh bash script by running cd ../dell-csi-helm-installer && ./csi-install.sh --namespace powermax --values ../helm/my-powermax-settings.yaml
9. Or you can also install the driver using standalone helm chart using the command helm install --values my-powermax-settings.yaml --namespace powermax powermax ./csi-powermax

Note:

• For detailed instructions on how to run the install scripts, see the readme document in the dell-csi-helm-installer folder.
• There are a set of samples provided here to help you configure the driver with reverse proxy
• This script also runs the verify.sh script in the same directory. You will be prompted to enter the credentials for each of the Kubernetes nodes. The verify.sh script needs the credentials to check if the iSCSI initiators have been configured on all nodes. You can also skip the verification step by specifying the --skip-verify-node option
• In order to enable authorization, there should be an authorization proxy server already installed.
• PowerMax Array username must have role as StorageAdmin to be able to perform CRUD operations.
• If the user is using complex K8s version like “v1.23.3-mirantis-1”, use this kubeVersion check in helm Chart file. kubeVersion: “>= 1.23.0-0 < 1.27.0-0”.
• User should provide all boolean values with double-quotes. This applies only for values.yaml. Example: “true”/“false”.
• controllerCount parameter value should be <= number of nodes in the kubernetes cluster else install script fails.
• Endpoint should not have any special character at the end apart from port number.

Storage Classes

A wide set of annotated storage class manifests has been provided in the samples/storageclass folder. Please use these samples to create new storage classes to provision storage.

Volume Snapshot Class

Starting with CSI PowerMax v1.7.0, dell-csi-helm-installer will not create any Volume Snapshot Class during the driver installation. There is a sample Volume Snapshot Class manifest present in the samples/volumesnapshotclass folder. Please use this sample to create a new Volume Snapshot Class to create Volume Snapshots.

Sample values file

The following sections have useful snippets from values.yaml file which provides more information on how to configure the CSI PowerMax driver along with CSI PowerMax ReverseProxy in various modes

CSI PowerMax driver with Proxy in Linked mode

In this mode, the CSI PowerMax ReverseProxy acts as a passthrough for the RESTAPI calls and only provides limited functionality such as rate limiting, backup Unisphere server. The CSI PowerMax driver is still responsible for the authentication with the Unisphere server.

The first endpoint in the list of management servers is the primary Unisphere server and if you provide a second endpoint, then it will be considered as the backup Unisphere’s endpoint.

global:
  defaultCredentialsSecret: powermax-creds
  storageArrays:
    - storageArrayId: "000000000001"
    - storageArrayId: "000000000002"
  managementServers:
    - endpoint: https://primary-unisphere:8443
      skipCertificateValidation: false
      certSecret: primary-cert
      limits:
        maxActiveRead: 5
        maxActiveWrite: 4
        maxOutStandingRead: 50
        maxOutStandingWrite: 50
    - endpoint: https://backup-unisphere:8443 

# "csireverseproxy" refers to the subchart csireverseproxy
csireverseproxy:
  # Set enabled to true if you want to use proxy
  image: dellemc/csipowermax-reverseproxy:v2.4.0
  tlsSecret: csirevproxy-tls-secret
  deployAsSidecar: true
  port: 2222
  mode: Linked

Note: Since the driver is still responsible for authentication when used with Proxy in Linked mode, the credentials for both primary and backup Unisphere need to be the same.

CSI PowerMax driver with Proxy in StandAlone mode

This is the most advanced configuration which provides you with the capability to connect to Multiple Unisphere servers. You can specify primary and backup Unisphere servers for each storage array. If you have different credentials for your Unisphere servers, you can also specify different credential secrets.

global:
  defaultCredentialsSecret: powermax-creds
  storageArrays:
    - storageArrayId: "000000000001"
      endpoint: https://primary-1.unisphe.re:8443
      backupEndpoint: https://backup-1.unisphe.re:8443
    - storageArrayId: "000000000002"
      endpoint: https://primary-2.unisphe.re:8443
      backupEndpoint: https://backup-2.unisphe.re:8443
  managementServers:
    - endpoint: https://primary-1.unisphe.re:8443
      credentialsSecret: primary-1-secret
      skipCertificateValidation: false
      certSecret: primary-cert
      limits:
        maxActiveRead: 5
        maxActiveWrite: 4
        maxOutStandingRead: 50
        maxOutStandingWrite: 50
    - endpoint: https://backup-1.unisphe.re:8443
      credentialsSecret: backup-1-secret
      skipCertificateValidation: true
    - endpoint: https://primary-2.unisphe.re:8443
      credentialsSecret: primary-2-secret
      skipCertificateValidation: true
    - endpoint: https://backup-2.unisphe.re:8443
      credentialsSecret: backup-2-secret
      skipCertificateValidation: true

# "csireverseproxy" refers to the subchart csireverseproxy
csireverseproxy:
  image: dellemc/csipowermax-reverseproxy:v2.4.0
  tlsSecret: csirevproxy-tls-secret
  deployAsSidecar: true
  port: 2222
  mode: StandAlone

Note: If the credential secret is missing from any management server details, the installer will try to use the defaultCredentialsSecret