APEX Cloud Platform: How to Update CSI Configuration When PowerFlex Config Changes

This article describes how to update CSI configuration when a PowerFlex credential or certificate changes.

Actions Needed After PowerFlex Credential Changes

For OCP cluster, when the ACP software version < 3.0.5

1. Run the command below to find the secret, copy the value of "config" and "MDM" from the command output.
   

   oc get secret csi-vxflexos-config -n dell-acp -o yaml

   For example:
   
   
   
2.  Run the command below to decode the base64 encoded value of "config" and "MDM", and save them to a file. The encoded values of "config" and "MDM" are marked with yellow line in the figure above.
   

   echo -n "<base64 encoded config value>" | base64 --decode > config
   
   echo -n "<base64 encoded MDM value>" | base64 --decode > MDM

   For example:
    
3. Edit the saved "config" file, update password according to PowerFlex.
   For example:
    
   
   
4. Run the command below to update secrets.
   

   oc create secret generic csi-vxflexos-config -n dell-acp --save-config --from-file=./MDM --from-file=./config -o yaml --dry-run | oc apply -f -

5. Run the commands below to restart related resources.
   

   oc rollout restart deployment csi-vxflexos-controller -n dell-acp
   
   oc rollout restart daemonset csi-vxflexos-node -n dell-acp
   
   oc rollout restart deployment mcp-powerflex-operation -n dell-acp

For OCP cluster, when the ACP software version >= 3.0.5

1. Run the command below to find the secret, copy the value of "config" and "MDM" from the command output.
   

   oc get secret csi-vxflexos-config -n dell-acp -o yaml

   For example:
    
2. Run the command below to decode the base64 encoded value of "config" and "MDM". Save them to a file. The encoded values of "config" and "MDM" are marked with yellow line in the figure above.
   

   echo -n "<base64 encoded config value>" | base64 --decode > config
   
   echo -n "<base64 encoded MDM value>" | base64 --decode > MDM

   For example:
    
3. Edit the saved "config" file, update password according to PowerFlex.
   For example:
    
   
   
4. Run the command below to update secrets.
   

   oc create secret generic csi-vxflexos-config -n dell-acp --save-config --from-file=./MDM --from-file=./config -o yaml --dry-run | oc apply -f -
   
   oc create secret generic vxflexos-config -n vxflexos --save-config --from-file=./config -o yaml --dry-run | oc apply -f -

5. Run the commands below to restart related resources.
   

   oc rollout restart deployment vxflexos-controller -n vxflexos
   
   oc rollout restart daemonset vxflexos-node -n vxflexos
   
   oc rollout restart deployment mcp-powerflex-operation -n dell-acp

For Hosted Control Plane (HCP) cluster

1. Log in to Hub Cluster, follow above case "ACP software version >= 3.0.5" to update the Hub cluster secrets.
2. Log in to HCP Cluster: Run the command below to find the secret, copy the value of "config" from the command output.
   

   oc get secret csi-vxflexos-config -n dell-acp -o yaml

3. Run the command below to decode the base64 encoded value of "config", and save them to a file.
   

   echo -n "<base64 encoded config value>" | base64 --decode > config

4. Edit the saved "config" file, update password according to PowerFlex.
   For example:
    
   
   
5. Run the command below to update secrets.
   

   oc create secret generic vxflexos-config -n vxflexos --save-config --from-file=./config -o yaml --dry-run | oc apply -f -

6. Restart related resources.
   

   oc rollout restart deployment vxflexos-controller -n vxflexos
   
   oc rollout restart daemonset vxflexos-node -n vxflexos

Actions Needed After PowerFlex Certificate Changes

For OCP cluster, when the ACP software version < 3.0.5

1. Run the following command on VDI to fetch the updated certificate. The <Gateway IP> is PowerFlex manager ip/fqdn, <Port> is 443.
   

   openssl s_client -showcerts -connect <Gateway IP:Port> </dev/null 2>/dev/null | sed -n -e '/-.BEGIN/,/-.END/ p' > ca_cert_0.pem
   
   cat ca_cert_0.pem

   For example:
    
   
   
2. If the certificate file ca_cert_0.pem contains the whole certificate chain of the PowerFlex cluster, trim the file ca_cert_0.pem and only keep the last certificate. (The last certificate is at the bottom of the file, it starts with "-----BEGIN CERTIFICATE-----" and ends with "-----END CERTIFICATE-----")
   
   
3. Run the following commands on the host which can connect to OCP to update csi certificate configuration.
   

   oc patch secret csi-vxflexos-certs-0 -n dell-acp --patch="{\"data\": { \"cert-0\": \"$(cat ca_cert_0.pem |base64 -w0)\" }}"

4. Restart related resources.
   

   oc rollout restart deployment csi-vxflexos-controller -n dell-acp
   
   oc rollout restart daemonset csi-vxflexos-node -n dell-acp
   
   oc rollout restart deployment mcp-powerflex-operation -n dell-acp

For OCP cluster, when the ACP software version >= 3.0.5

1. Run the following command on VDI to fetch the updated certificate. The <Gateway IP> is PowerFlex manager ip/fqdn, <Port> is 443.
   

   openssl s_client -showcerts -connect <Gateway IP:Port> </dev/null 2>/dev/null | sed -n -e '/-.BEGIN/,/-.END/ p' > ca_cert_0.pem
   
   cat ca_cert_0.pem

   For example:
    
   
   
2. If the certificate file ca_cert_0.pem contains the whole certificate chain of the PowerFlex cluster, trim the file ca_cert_0.pem and only keep the last certificate. (The last certificate is at the bottom of the file, it starts with "-----BEGIN CERTIFICATE-----" and ends with "-----END CERTIFICATE-----")
   
   
3. Run the following commands on the host which can connect to OCP to update csi certificate configuration.
   

   oc patch secret csi-vxflexos-certs-0 -n dell-acp --patch="{\"data\": { \"cert-0\": \"$(cat ca_cert_0.pem |base64 -w0)\" }}"
   
   oc patch secret vxflexos-certs-0 -n vxflexos --patch="{\"data\": { \"cert-0\": \"$(cat ca_cert_0.pem |base64 -w0)\" }}"

4. Restart related resources.
   

   oc rollout restart deployment vxflexos-controller -n vxflexos
   
   oc rollout restart daemonset vxflexos-node -n vxflexos
   
   oc rollout restart deployment mcp-powerflex-operation -n dell-acp

For Hosted Control Plane (HCP) cluster

1. Log in to Hub Cluster, follow the above case "ACP software version >= 3.0.5" to update the Hub cluster certificate.
2. Log in to HCP Cluster: Run the following command on VDI to fetch the updated certificate. The <Gateway IP> is PowerFlex manager ip/fqdn, <Port> is 443.
   

   openssl s_client -showcerts -connect <Gateway IP:Port> </dev/null 2>/dev/null | sed -n -e '/-.BEGIN/,/-.END/ p' > ca_cert_0.pem
   
   cat ca_cert_0.pem

   For example:
    
3. If the certificate file ca_cert_0.pem contains the whole certificate chain of the PowerFlex cluster, trim the file ca_cert_0.pem and only keep the last certificate. (The last certificate is at the bottom of the file, it starts with "-----BEGIN CERTIFICATE-----" and ends with "-----END CERTIFICATE-----")
   
   
4. Run the following commands on the host which can connect to HCP cluster to update csi certificate configuration.
   

   oc patch secret csi-vxflexos-certs-0 -n dell-acp --patch="{\"data\": { \"cert-0\": \"$(cat ca_cert_0.pem |base64 -w0)\" }}"
   
   oc patch secret vxflexos-certs-0 -n vxflexos --patch="{\"data\": { \"cert-0\": \"$(cat ca_cert_0.pem |base64 -w0)\" }}"

5. Restart related resources.
   

   oc rollout restart deployment vxflexos-controller -n vxflexos
   
   oc rollout restart daemonset vxflexos-node -n vxflexos