Overview

About Hitachi Storage Plug-in for Containers

Storage Plug-in for Containers integrates Kubernetes or OpenShift with Hitachi storage systems using Container Storage Interface (CSI).

The following diagram illustrates a container environment where Storage Plug-in for Containers is deployed.

The following table lists and describes the components of Storage Plug-in for Containers.

Component	Purpose
csi-controller	Implements the CSI controller service, which is mainly for storage operations. This is deployed as Deployment and runs only on a control plane.
csi-node	Implements the CSI node service, which primarily manages volumes on each node. This is deployed as DaemonSet, and all nodes must have this component.
Hitachi storage systems	Provides storage volumes for the containers.

About the environment setup tasks

Storage Plug-in for Containers enables dynamic operation of storage systems when containers are used. In order to use Storage Plug-in for Containers pre-installation tasks must be completed.

Check and apply the requirements for the server (where you plan to install Storage Plug-in for Containers, Kubernetes, and OpenShift),Hitachi storage systems, Kubernetes, and OpenShift.
Execute pre-installation tasks.
1. Set up the Kubernetes and OpenShift environment.
2. Configure the Hitachi storage systems.
Install Storage Plug-in for Containers.

Requirements

Before you install Storage Plug-in for Containers, check that your server and storage meet the following minimum requirements.

Container orchestrators to be supported

Container orchestrator	Remarks
Red Hat OpenShift Container Platform	—
Kubernetes	—

For details on supported versions, see the Release Notes.

Server requirements

Component	Requirement
CPU	x86_64
Operating system	Refer to the release notes for details. NoteYou can also use Red Hat Enterprise Linux CoreOS as a worker node of OpenShift environments.

Storage requirements

Storage requirements for Virtual Storage Platform (VSP) family.

Component	Requirement
Model	Refer to the release notes for details.
SVOS	Refer to the release notes for details.
Interface	Fibre Channel and iSCSI for bare metal servers. iSCSI for vSphere virtual machines.
Host group	Must be dedicated to Storage Plug-in for Containers. Do not use a host group used for Storage Plug-in for Containers for purposes other than Storage Plug-in for Containers.
User account	The built-in Storage administrator (View & Modify) user group. If you are using a customized user group, make sure it has the same roles as the built-in Storage Administrator (View & Modify) user group.
License	Hitachi Dynamic Provisioning (HDP), required. Hitachi Thin Image (HTI), required.
SVP	Single and dual SVP configurations are supported.

Storage requirements for Virtual Storage Software block (VSSB).

Component	Requirement
Version	Refer to the release notes for details.
Interface	Fibre Channel and iSCSI for bare metal servers. iSCSI for vSphere virtual machines.
User account	If multitenancy functionality is not used: The user must be assigned the Storage role. If multitenancy functionality is used: See Multitenancy functionality settings and set a user.

Network requirements

Storage Plug-in for Containers uses the following ports. Use this information for reference when configuring the firewall.

Component	Port	Usage	Remarks
Storage	80 or 443	REST API connection	None

Pre-installation tasks

Before you install Storage Plug-in for Containers, review and apply the server and storage pre-installation requirements.

Server pre-installation

The following table outlines the pre-installation tasks for each server component.

If you are using VSSB, for information on the server settings, see the Hitachi Virtual Storage Software Block Storage Administrator Guide.

Component		Tasks
Hypervisor		If you want to use virtual machines, setup the hypervisor. NoteStorage Plug-in for Containers is tested with VMware vSphere 7.0.
Fibre Channel		Verify if Fibre Channel HBA is installed on all hosts.
iSCSI		Verify if iSCSI initiator software is installed on all hosts. If not, refer to: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/storage_administration_guide/osm-create-iscsi-initiator Note Storage Plug-in for Containers does not support the following items: IQN including upper-case letters. IPv6 (same for components other than iSCSI).
multipathd		See Multipath settings.

Multipath settings

Enable multipathd and make sure that the user_friendly_names option is set to yes.

For example:

defaults {
        user_friendly_names yes
        find_multipaths yes
}
blacklist {
}

If you are using VSSB, for information on VSSB-specific settings, see the sections describing the operating environment settings and the ALUA settings in the Hitachi Virtual Storage Software Block Operation Guide.

NoteThe setting values might differ depending on the environment. Also see the documentation for your OS.

Red Hat Enterprise Linux 7: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/dm_multipath/mpio_setup
Red Hat Enterprise Linux 8: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_device_mapper_multipath/configuring-dm-multipath_configuring-device-mapper-multipath
Ubuntu: https://ubuntu.com/server/docs/device-mapper-multipathing-introduction

For OpenShift, you will need to use the MachineConfig YAML file. For details, see the official documentation: https://docs.openshift.com/container-platform/latest/post_installation_configuration/machine-configuration-tasks.html

The following is an example:

Procedure

Obtain the base64 contents from the multipath.conf file.

# echo 'defaults {
user_friendly_names yes
find_multipaths yes
}
blacklist {
}' | base64 -w0

Specify the base64 contents for spec.config.storage.files.contents.source in the MachineConfig YAML file that is provided as a sample.

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  name: multipath-machineconfig-sample
  labels:
    machineconfiguration.openshift.io/role: worker
spec:
  config:
    ignition:
      version: 3.2.0
    storage:
      files:
      - contents:
          source: data:text/plain;charset=utf-8;base64,ZGVmYXVsdHMgewp1c2VyX2ZyaWVuZGx5X25hbWVzIHllcwpmaW5kX211bHRpcGF0aHMgeWVzCn0KCmJsYWNrbGlzdCB7Cn0K
          verification: {}
        filesystem: root
        mode: 400
        path: /etc/multipath.conf

Run the following command:
```
# oc create -f <MachineConfig YAML file>
```
NoteMachineConfig applies to compute nodes only. After MachineConfig is created, all compute nodes are automatically restarted one by one.

Storage pre-installation for VSP family

The following table outlines the pre-installation tasks to be completed for each storage component.

Component	Task
Program products	Enable Hitachi Dynamic Provisioning (HDP) license Enable Hitachi Thin Image (HTI) license
Pool	Create an HDP pool Hitachi Dynamic Tiering is not supported.
Fibre Channel connection	Use a Fibre Channel switch for communication between the storage and servers. Set the following parameters for storage ports using Storage Navigator: Connection Type: P-to-P Fabric: ON Security: Enabled Host groups required for Storage Plug-in for Containers are automatically created by Storage Plug-in for Containers. If you want to use existing host groups, rename them according to the naming rule. For details, see Host group and iSCSI target naming rules). To the host group, add a WWN for each host that joins the Kubernetes cluster. For example, if you have 10 hosts in your Kubernetes cluster, you must prepare 10 host groups. NoteStorage Plug-in for Containers will overwrite host mode options even if existing host groups have other host mode options.
iSCSI connection	Enable port security by Storage Navigator. Storage Plug-in for Containers automatically performs the following actions: Creates iSCSI targets for each host if there is no iSCSI target. If you want to use existing iSCSI targets, rename them according to the naming rule (see Host group and iSCSI target naming rules). Adds an IQN to the iSCSI target of each host that will join the Kubernetes cluster. Logs in to the iSCSI target on each host. If you want to use CHAP, do the following: Create an iSCSI target (see Host group and iSCSI target naming rules). Set CHAP for the port and iSCSI target. Log in to the iSCSI target with CHAP authentication. NoteStorage Plug-in for Containers will overwrite host mode options even if existing iSCSI targets have other host mode options.

Host group and iSCSI target naming rules

Storage Plug-in for Containers automatically searches host groups and iSCSI targets based on the name.

If you want to use an already existing host group or iSCSI target, refer to either the naming rule of host groups or iSCSI targets depending on your storage connection:

Naming rule of host groups

Storage Plug-in for Containers searches host groups by the naming rule. If Storage Plug-in for Containers cannot find any host group in the port, it automatically creates the host group. If you already have host groups, you need to delete them or rename them according to the following naming rule:

"spc-<wwn1>-<wwn2>-<wwn3>"

Naming rule details:

<wwn1>, <wwn2>, <wwn3> are the world wide name of each host.
<wwn1>, <wwn2>, <wwn3> are sorted by name.
If the host has more than three WWNs, Storage Plug-in for Containers sorts <wwn1>, <wwn2> ... <wwnN> and uses lower three names.
If the host has only one or two WWNs, the names are "spc-<wwn1>" or "spc-<wwn1>-<wwn2>".

Naming rule of iSCSI targets

Storage Plug-in for Containers searches iSCSI targets by the naming rule. If Storage Plug-in for Containers cannot find any iSCSI target, it automatically creates the iSCSI target, "spc-<hashed IQN>". If you already have iSCSI targets, you need to delete them or rename them according to the following naming rule: "spc-<any string>"

Storage pre-installation for VSSB

Component	Task
Fibre Channel connection	Use the Fibre Channel switch for communication between storage and servers.
Server resource	If you have already created a Server resource in VSSB, verify the following: Storage Plug-in for Containers automatically performs the following actions: Finds an existing Server resource with the host WWN or IQN configured. If an existing Server resource is not found, it creates a new Server resource and configures it with a host WWN or IQN. Verifies and configures the Server resource to connect to the all compute ports. If you want to use CHAP, do the following: Set CHAP for the compute port. Log in to the iSCSI target with CHAP authentication. NoteDo not add a WWN or IQN of multiple hosts to the same Server resource. Only one Server resource can be associated with a single host.

Component

Task

Fibre Channel connection

Use the Fibre Channel switch for communication between storage and servers.

Server resource

If you have already created a Server resource in VSSB, verify the following:

Storage Plug-in for Containers automatically performs the following actions:

Finds an existing Server resource with the host WWN or IQN configured.
If an existing Server resource is not found, it creates a new Server resource and configures it with a host WWN or IQN.
Verifies and configures the Server resource to connect to the all compute ports.

If you want to use CHAP, do the following:

Set CHAP for the compute port.
Log in to the iSCSI target with CHAP authentication.

NoteDo not add a WWN or IQN of multiple hosts to the same Server resource. Only one Server resource can be associated with a single host.

Multitenancy functionality settings

If you use the multitenancy functionality, set the items in the following table.

NoteA VSSB used in one Kubernetes/OpenShift cluster has the following restrictions related to Virtual Private Storage (VPS):

Multiple VPSs cannot be used.
VPS and resources that do not belong to the VPS cannot be used at the same time.

Component	Task
VPS	Create VPS. For the maximum number of compute nodes set for VPS, set a number greater than the number of nodes that make up the Kubernetes/OpenShift cluster. For the maximum number of sessions, set at least 20.
User group	Create a user group that belongs to the created VPS. For the scope, set only the created VPS. For the role, set VpsStorage.
User	Create users and assign them to the user group you created in the preceding task. Do not assign the users to a user group other than the user group you created in the preceding task.

Quick Links