Creating the GREP11 container

By using the yaml configuration file and hpvs deploy command

This is the recommended option to provision the instance because of it's ease of use and is also an easier method of creating multiple instances quickly.

1. Update the template file $HOME/hpvs/config/templates/virtualserver.template.yml based on the networking configuration of the Hyper Protect Virtual Server instance if necessary. The vs_grep11.yml that has the configuration details for the virtual server refers to the corresponding sections of the virtualserver.template.yml when you run the hpvs deploy command. For example, the network: ref value refers to the networktemplates definition in the template file.

   version: v1
   type: virtualserver-template
   networktemplates:
   -  name: external_network
      subnet: "10.20.4.0/22"
      gateway: "10.20.4.1"
      parent: encf900
      driver: macvlan
   -  name: internal_network
      subnet: "192.168.40.0/24"
      gateway: "192.168.40.1"
      parent: encf900
      driver: bridge
   quotagrouptemplates:
   # Passthrough quotagroup templates - A quotagroup will be dynamically created based
   # on the template and attached as single volume mount point to the virtual server.
   # Allowed filesystem types for the passthrough type quogagroup are btrfs, ext4, xfs
   -  name: p-small
      size: 20GB
      filesystem : ext4
      passthrough: true
   -  name: p-medium
      size: 50GB
      filesystem : ext4
      passthrough: true
   -  name: p-large
      size: 100GB
      filesystem : ext4
      passthrough: true
   -  name: p-xlarge
      size: 200GB
      filesystem : ext4
      passthrough: true
   -  name: p-xxlarge
      size: 400GB
      filesystem : ext4
      passthrough: true
   # Non passthrough quotagroup definitions - This quotagroups can be shared by
   # creating multiple volume mountpoints with the same virtual server or multiple
   # virtual server.  A non passthrough quotagroup will be dynamically created based
   # on the template and attached as volume mount points to the virtual server.
   # Only brtfs filesystem is supported in non passthrough quotagroups
   # mount points attached to virtual server can have filesystem btrfs, ext4, xfs
   -  name: np-small
      size: 20GB
      passthrough: false
   -  name: np-medium
      size: 50GB
      passthrough: false
   -  name: np-large
      size: 100GB
      passthrough: false
   -  name: np-xlarge
      size: 200GB
      passthrough: false
   -  name: np-xxlarge
      size: 400GB
      passthrough: false
   resourcedefinitiontemplates:
   -  name: default
      cpu: 1
      memory: 1024
   -  name: small
      cpu: 2
      memory: 2048
   -  name: large
      cpu: 4
      memory: 4096
   -  name: xl
      cpu: 8
      memory: 8192
   -  name: xxl
      cpu: 12
      memory: 12288
   

2. Create the configuration yaml file $HOME/hpvs/config/grep11/demo_grep11.yml for the instance by referring to the example file $HOME/hpvs/config/grep11/vs_grep11.yml.

   The following is an example of a vs_grep11.yml file that uses port mapping for the network.

   version: v1
   type: virtualserver
   virtualservers:
   - name: test-grep11
     host: SSC_LPAR_NAME
     repoid: hpcsKpGrep11_runq
     imagetag: 1.2.7.9
     hostname: grep11.example.com
     imagefile: hpcsKpGrep11_runq.tar.gz
     imagecache: true
     crypto:
        crypto_matrix:
         - 07.0007
     networks:
      - ref:  external_network
        ipaddress: 10.20.4.12
     environment:
      - key: EP11SERVER_EP11CRYPTO_DOMAIN
        value: "07.0007"
      - key: EP11SERVER_EP11CRYPTO_CONNECTION_TLS_CERTFILEBYTES
        value: "@/root/hpvs/config/grep11/keys/server.pem"
      - key: EP11SERVER_EP11CRYPTO_CONNECTION_TLS_KEYFILEBYTES
        value: "@/root/hpvs/config/grep11/keys/server-key.pem"
      - key: EP11SERVER_EP11CRYPTO_CONNECTION_TLS_CACERTBYTES
        value: "@/root/hpvs/config/grep11/keys/ca.pem"
      - key: EP11SERVER_EP11CRYPTO_CONNECTION_TLS_ENABLED
        value: "true"
      - key: EP11SERVER_EP11CRYPTO_CONNECTION_TLS_MUTUAL
        value: "true"
      - key: TLS_GRPC_CERTS_DOMAIN_CRT
        value: "\\n"
      - key: TLS_GRPC_CERTS_DOMAIN_KEY
        value: "\\n"
      - key: TLS_GRPC_CERTS_ROOTCA_CRT
        value: "\\n"
   

   You must access the GREP11 service via port 9876. In this example, the network definition is for an external network. For more information on other network configurations, see Network requirements for Hyper Protect Virtual Server.

3. Create the instance by using the configurations in the yaml file.

   hpvs deploy --config $HOME/hpvs/config/grep11/demo_grep11.yml
   

   Note:

   • You can use the hpvs undeploy command to delete this virtual server. For more information, see Undeploying virtual servers.
   • You can update the resources or configuration of a virtual server after the completion of the deploy operation by using the -u, or the --update flag of the hpvs deploy command. For more information, see Updating virtual servers.

By using the hpvs vs create command

1. Upload the GREP11 image to the Secure Service Container partition by using the hpvs image load command.

    hpvs image load --file $HOME/hpvs/config/grep11/images/hpcsKpGrep11_runq.tar.gz
   

2. Create the grep11_env.json file as shown below.

    {
     "EP11SERVER_EP11CRYPTO_DOMAIN":"07.0007",
     "EP11SERVER_EP11CRYPTO_CONNECTION_TLS_CERTFILEBYTES":"@/$HOME/hpvs/config/grep11/keys/server.pem",
     "EP11SERVER_EP11CRYPTO_CONNECTION_TLS_KEYFILEBYTES":"@/$HOME/hpvs/config/grep11/keys/server-key.pem",
     "EP11SERVER_EP11CRYPTO_CONNECTION_TLS_CACERTBYTES":"@/$HOME/hpvs/config/grep11/keys/ca.pem",
     "EP11SERVER_EP11CRYPTO_CONNECTION_TLS_ENABLED":true,
     "EP11SERVER_EP11CRYPTO_CONNECTION_TLS_MUTUAL":true,
     "EP11SERVER_EP11CRYPTO_ENABLED":"true",
     "TLS_GRPC_CERTS_DOMAIN_CRT":"\\n",
     "TLS_GRPC_CERTS_DOMAIN_KEY":"\\n",
     "TLS_GRPC_CERTS_ROOTCA_CRT":"\\n"
    }
   

   Note: The "server.pem", "server-key.pem", and "ca.pem" files are created as a part of the generation of certificates for the secure communication between the Hyper Protect GREP11 container and the grep11 client.

3. Create the external network for the GREP11 virtual server.

   hpvs network create --name external_net --driver macvlan --parent encf900 --subnet 10.20.4.0/22 --gateway 10.20.4.1
   

   For more information about the hpvs network command, see Commands in IBM Hyper Protect Virtual Servers. For more information about the network in IBM Hyper Protect Virtual Servers, see Network requirements for Hyper Protect Virtual Server.

4. Create the GREP11 container by running the hpvs vs create command.

   hpvs vs create --name grep11container --repo hpcsKpGrep11_runq --tag 1.2.7.9 --crypto_matrix=07.0007 --cpu 2 --ram 2048 --envjsonpath /Users/username/hpvs_config/crypto/grep11_env.json --network "{name = external_network, ip = 10.20.4.12}"
   

   Note: You can update the resources or configuration of a virtual server after the virtual server is created by using the hpvs vs update command. For more information, see Updating Hyper Protect Virtual Server containers.

For more information about the TKE, check out the video on YouTube - TKE Introduction Videos 1 Introduction to TKE.