Customizing nodes

Register a RHEL 8 system:

# subscription-manager register

Attach a subscription to the RHEL 8 system:

# subscription-manager attach --auto

Install software that is required to build the software and container:

# yum install podman make git -y

Clone the kmod-via-containers repository:

Install a KVC framework instance on your RHEL 8 build host to test the module. This adds a kmods-via-container systemd service and loads it:

Get the kernel module source code. The source code might be used to build a third-party module that you do not have control over, but is supplied by others. You will need content similar to the content shown in the kvc-simple-kmod example that can be cloned to your system as follows:

$ cd .. ; git clone https://github.com/kmods-via-containers/kvc-simple-kmod

Edit the configuration file, simple-kmod.conf file, in this example, and change the name of the Dockerfile to Dockerfile.rhel:

Create an instance of kmods-via-containers@.service for your kernel module, simple-kmod in this example:

$ sudo make install

Enable the kmods-via-containers@.service instance:

$ sudo kmods-via-containers build simple-kmod $(uname -r)

Enable and start the systemd service:

To confirm that the kernel modules are loaded, use the lsmod command to list the modules:

$ lsmod | grep simple_

simple_procfs_kmod     16384  0
simple_kmod            16384  0

Optional. Use other methods to check that the simple-kmod example is working:

Check to see if TPM v2 encryption needs to be enabled in the BIOS on each node. This is required on most Dell systems. Check the manual for your computer.

Generate the Kubernetes manifests for the cluster:

$ ./openshift-install create manifests --dir=<installation_directory>

In the openshift directory, create master or worker files to encrypt disks for those nodes.

Make a backup copy of the YAML file. You should do this because the file will be deleted when you create the cluster.

Continue with the remainder of the OpenShift Container Platform deployment.

Access a Red Hat Enterprise Linux server from which you can configure the encryption settings and run openshift-install to install a cluster and oc to work with it.

Set up or access an existing Tang server. See Network-bound disk encryption for instructions. See Securing Automated Decryption New Cryptography and Techniques for a presentation on Tang.

Add kernel arguments to configure networking when you do the Red Hat Enterprise Linux CoreOS (RHCOS) installations for your cluster. For example, to configure DHCP networking, identify ip=dhcp, or set static networking when you add parameters to the kernel command line. For both DHCP and static networking, you also must provide the rd.neednet=1 kernel argument.

Install the clevis package, if it is not already installed:

Generate a thumbprint from the Tang server.

Create a Base64 encoded file, replacing the URL of the Tang server (url) and thumbprint (thp) you just generated:

$ (cat <<EOM
{
 "url": "https://tang.example.com",
 "thp": "PLjNyRdGw03zlRoGjQYMahSZGu9"
}
EOM
) | base64 -w0

ewogInVybCI6ICJodHRwczovL3RhbmcuZXhhbXBsZS5jb20iLAogInRocCI6ICJaUk1leTFjR3cwN3psVExHYlhuUWFoUzBHdTAiCn0K

In the openshift directory, create master or worker files to encrypt disks for those nodes.

Add the rd.neednet=1 kernel argument, as shown in the following example:

  apiVersion: machineconfiguration.openshift.io/v1
  kind: MachineConfig
  metadata:
    name: <node_type>-tang (1)
  spec:
    config:
      ignition:
        version: 3.1.0
    kernelArguments:
      - rd.neednet=1 (2)

Continue with the remainder of the OpenShift Container Platform deployment.