PowerFlex: SFTP For Automated SDC Driver Delivery For New Kernel

PowerFlex is decommissioning the legacy way to retrieve the Storage Data Client (SDC) driver. Customers are required to transition to Secure File Transfer Protocol (SFTP) to retain automatic Storage Data Client (SDC) driver update capabilities.

Username: PowerFlexRepo
Password: V3Die83$BK

This is possible only if no volumes are in use by the operating system.

• • Option B: to restart compute server running SDC: If needed, plan for a reboot cycle of the operating system for this setting to take effect.

6. Check that the scini service is running:

systemctl status scini

7. Once you are finished, perform an operating system update and reboot to load the new kernel. The Storage Data Client (SDC) driver sync automatically downloads the kernel object (KO) file, if available.

Instructions for container Storage Data Client (SDC)

1. Validate that the Secure File Transfer Protocol (SFTP) contains the kernel your operating system requires. 

• • SFTP: sftp://mft.dell.com
  • HTTPS: https://mft.dell.com

Username: PowerFlexRepo
Password: V3Die83$BK

1. Download and extract the attached sftp_keys to your Storage Data Client (SDC) host, as user root, to any folder on the Linux machine.

2. Rename both files from the zip to:

   • scini_key -> user_private_rsa_key

   • scini_repo_key.pub -> user_public_rsa_key

3. Change the private key file’s permissions.

   • chmod 600 user_private_rsa_key

   • chmod 600 user_public_rsa_key

4. When running the container of the Storage Data Client (SDC) add the following: 

   -e REPO_ADDRESS=sftp://mft.dell.com
   -e REPO_USER=PowerFlexRepo
   -v PLACE_OF_THE_KEYS:/config

   Example: 

   podman run --rm -it --privileged -e NODENAME="$(hostname)" -e MDM="192.168.220.74,172.16.220.74" -e MODULE_SIGCHECK=0 -e REPO_ADDRESS=sftp://mft.dell.com -e REPO_USER=PowerFlexRepo -v /dev:/dev -v /etc/os-release:/host-os-release -v /etc/udev/rules.d:/rules.d -v /var/home/sio:/config -v /var/emc/scaleio:/host_drv_cfg_path amaas-eos-mw1.cec.lab.emc.com:5044/container/sdc:3.6.600.113

Option 2: Steps to update the driver_sync file on the Storage Data Client (SDC) for HTTPS Repo.

1. Optional: First go to the Catalog file to validate the SDC kernel and matching SDC version file are located in this repo (The catalog is updated all the time).
   Catalog link: https://powerflexsdc.dell.com/PowerFlexSdc/catalog/catalog.txt

Example of list output:

2. Validate you have /etc/emc/scaleio/scini_sync/emc_key.pub that must exist on the OS in the relevant location.

   • In case it does not exist, use LIA and the following commands to create it:

   • Download the RPM-GPG-KEY-ScaleIO from the PowerFlex software download page.

     gpg --with-fingerprint /opt/emc/scaleio/lia/cfg/GPG/RPM-GPG-KEY-ScaleIO
     gpg --import /opt/emc/scaleio/lia/cfg/GPG/RPM-GPG-KEY-ScaleIO
     gpg --list-keys
     gpg --export --armor > /etc/emc/scaleio/scini_sync/emc_key.pub

3. Deploy\Upgrade SDC to a version with HTTPS support

   • The DELL HTTPS repo should already be configured on it, and the SDC will try to fetch the tar file from it.

     This can be verified by looking into /etc/emc/scaleio/scini_sync/driver_sync.conf

4. If needed, edit /etc/emc/scaleio/scini_sync/driver_sync.conf file:

   • Add\modify:

5. Restart the Storage Data Client (SDC) driver:

   • • Option A: Live SDC reload if no volumes are mapped Run from the operating system command prompt:  

       systemctl restart scini

   
   This is possible only if no volumes are in use by the operating system.

   • • Option B: to restart SDC: If needed, plan for a reboot cycle of the operating system for this setting to take effect.

6. Check that the scini service is running: 

   systemctl status scini.

7. Open the sync log: /bin/emc/scaleio/scini_sync/driver_sync.log

8. Once you are finished, perform an operating system update and reboot to load the new kernel. The Storage Data Client (SDC) driver sync automatically downloads the kernel object (KO) file, if available.

Instructions for container Storage Data Client (SDC)

1. If you are using a Private HTTPS repository copy the HTTPS certificate file to your Storage Data Client (SDC) host, as user root, to any folder on the Linux machine.

   1. /bin/emc/scleio/scini_sync/certs/powerflexsdc.crt

2.  Add the following when running the container of the Storage Data Client (SDC):

   -e REPO_ADDRESS=https://powerflexsdc.dell.com/PowerFlexSdc
   -e file_path=%OSNAME/%SDCVER/%KERNEL/
   -e https_ca_cert=/bin/emc/scaleio/scini_sync/certs/powerflexscd.crt

 Or, if a private HTTP repository use:

-e cert_opt=/bin/emc/scaleio/scini_sync/certs/powerflexscd.crt

Example:

podman run --rm -it --privileged -e NODENAME="$(hostname)" -e MDM="192.168.X.Y,172.16.X.Y" -e MODULE_SIGCHECK=0 -e REPO_ADDRESS=https://powerflexsdc.dell.com/PowerFlexSdc -e file_path=%OSNAME/%SDCVER/%KERNEL/scini.ko -e https_ca_cert=/bin/emc/scaleio/scini_sync/certs/powerflexscd.crt -e -v /dev:/dev -v /etc/os-release:/host-os-release -v /etc/udev/rules.d:/rules.d -v /var/home/sio:/config -v /var/emc/scaleio:/host_drv_cfg_path docker.io/dellemc/sdc:3.6.5

Validate the POD can start successfully.

This option applies to Kubernetes environments running the PowerFlex CSI Driver where SDC kernel modules are downloaded automatically from the Dell-hosted SFTP repository. The Dell FTP service has been replaced with an SFTP repository that uses key-based authentication.

• Verify that the required kernel module exists in the Dell MFT repository:
• SFTP: sftp://mft.dell.com
• HTTPS: https://mft.dell.com

Username: PowerFlexRepo
Password: V3Die83$BK

• Download and extract the sftp_keys_pkb.tar package. The package contains the private key file scini_key.

Create a dedicated namespace where the PowerFlex CSI components and related secrets will be deployed.

kubectl create namespace vxflexos

Extract the Dell-provided SFTP key package and create a Kubernetes secret containing the private key used for authenticating to the Dell MFT repository.

tar -xvf sftp_keys_pkb.tar

Extracts the contents of the downloaded key package, including the scini_key private key file.

cp scini_key user_private_rsa_key

Copies the private key to the filename expected by the PowerFlex CSI Driver.

chmod 600 user_private_rsa_key

Restricts access permissions so that only the file owner can read and modify the private key.

kubectl create secret generic sdcsftprepo-private-secret -n vxflexos --from-file=user_private_rsa_key=user_private_rsa_key

Creates a Kubernetes secret containing the SFTP private key that the CSI Driver uses to authenticate to the Dell MFT repository.

Obtain the Dell MFT server's public host key and store it as a Kubernetes secret for host verification during SFTP connections.

ssh-keyscan -t rsa mft.dell.com > /tmp/mft-public-key

Retrieves the RSA public host key from mft.dell.com and saves it locally.

kubectl create secret generic sdcsftprepo-public-secret -n vxflexos --from-file=repo_public_rsa_key=/tmp/mft-public-key

Creates a Kubernetes secret containing the server's public host key, allowing the CSI Driver to validate the identity of the Dell MFT repository.

The CSI Driver expects the host key to be obtained using ssh-keyscan and stored in the Kubernetes secret as shown above.

node:
  sdc:
    sdcSFTPRepo:
      enabled: true
      sdcSFTPRepoAddress: "sftp://mft.dell.com"
      sdcSFTPRepoUser: "PowerFlexRepo"
      sdcSFTPRepoPrivateSecret: "sdcsftprepo-private-secret"
      sdcSFTPRepoPublicSecret: "sdcsftprepo-public-secret"

Deploy a new PowerFlex CSI installation or update an existing deployment with the SFTP repository configuration.

helm install vxflexos csi-vxflexos --namespace vxflexos --values values.yaml

Installs the PowerFlex CSI Driver using the configuration specified in values.yaml.

helm upgrade vxflexos csi-vxflexos --namespace vxflexos --values values.yaml

Updates an existing PowerFlex CSI Driver deployment with the latest configuration.

Verify that the CSI components are running and that the SDC module download process completed successfully.

kubectl get pods -n vxflexos

Lists the PowerFlex CSI pods and confirms that they are running successfully.

kubectl logs -n vxflexos daemonset/vxflexos-node -c sdc

Displays logs from the SDC container to verify connectivity to the Dell MFT repository and the kernel module installation process.

Confirm the following in the logs:

• The SDC init container successfully connects to mft.dell.com.
• The appropriate scini.ko module is downloaded automatically.
• The kernel module loads successfully.
• The scini service starts normally.
• The node becomes operational with PowerFlex CSI.