ESS software deployment preparation

• Support for IBM Storage Scale 5.1.2.14
• Bug fixes and improvements
• Updated security patches

• This document (ESS Software Quick Deployment Guide)
• SSR completes physical hardware installation and code 20.
  • SSR uses Worldwide Customized Installation Instructions (WCII) for racking, cabling, and disk placement information.
  • SSR uses the respective ESS Hardware Guide (ESS 3000 or ESS 5000 or ESS 3200) for hardware checkout and setting IP addresses.
• Worksheet notes from the SSR
• Latest ESS tgz downloaded to the EMS node from Fix Central (If a newer version is available).
  • Data Access Edition or Data Management Edition: Must match the order. If the edition does not match your order, open a ticket with the IBM® Service.
• High-speed switch and cables have been run and configured.
• Low-speed host names are ready to be defined based on the IP addresses that the SSR have configured.
• High-speed host names (suffix of low speed) and IP addresses are ready to be defined.
• Container host name and IP address are ready to be defined in the /etc/hosts file.
• Host and domain name (FQDN) are defined in the /etc/hosts file.
• ESS Legacy 6.1.x.x Only: You must convert to mmvdisk before deploying the ESS Legacy 6.1.x.x container if you are coming from a non-container version such as ESS 5.3.x.x. If you have not done so already, convert to mmvdisk by using the following steps:

  1. Check whether there are any mmvdisk node classes.

     mmvdisk nodeclass list

     There should be one node class per ESS Legacy building-block. If the command output does not show mmvdisk for your ESS Legacy nodes, convert to mmvdisk before running the ESS Legacy 6.1.0.x container.

  2. Convert to mmvdisk by running the following command from one of the POWER8 I/O nodes or from the POWER8 EMS node.

     gssgenclusterrgs -G gss_ppc64 --suffix=-hs --convert 

     You can also use -N with a comma-separated list of nodes.

     Note: Wait for 5 minutes for daemons to recycle. The file system remains up.

• ESS 5000 tgz used in manufacturing (may not be the latest)
• ESS 3000 tgz used in manufacturing (may not be the latest)
• ESS Legacy tgz used in manufacturing (may not be the latest)
• ESS 3200 tgz used in manufacturing (may not be the latest)

The PGP key is located in /opt/ibm/ess/tools/conf.

-rw-r-xr-x 1 root root 907 Dec 1 07:45 SpectrumScale_public_key.pgp

You can check whether an ESS or IBM Spectrum Scale RPM is signed by IBM as follows.

1. Import the PGP key.

   rpm --import  /opt/ibm/ess/tools/conf/SpectrumScale_public_key.pgp

2. Verify the RPM.

   rpm -K RPMFile

In any scenario you must have an EMS node and a management switch. The management switch must be split into two VLANs.

• Management VLAN
• Service/FSP VLAN
  Note: To future proof your environment for ESS 3200, modify any existing management switches to the new VLAN configuration. For more information, see Switch VLAN configuration instructions.

You also need a high-speed switch (IB or Ethernet) for cluster communication.

It is recommended to buy a POWER9 EMS with ESS 3000. If you have a legacy environment (POWER8), it is recommended to migrate to IBM Spectrum Scale 5.1.x.x and use the POWER9 EMS as the single management server.

• If you are adding ESS 3000 to a POWER8 EMS:
  • An additional connection for the container to the management VLAN must be added. A C10-T2 cable must be run to this VLAN.
  • A public/campus connection is required in C10-T3.
  • A management connection must be run from C10-T1 (This should be already in place if adding to an existing POWER8 EMS with legacy nodes).
  • Port 1 on each ESS 3000 canister must be connected to the management VLAN.
• If you are using an ESS 3000 with a POWER9 EMS:
  • C11-T1 must be connected on the EMS to the management VLAN.
  • Port 1 on each ESS 3000 canister must be connected to the management VLAN.
  • C11-T2 must be connected on the EMS to the FSP VLAN.
  • HMC1 must be connected on the EMS to the FSP VLAN.

EMS must have the following connections:

• C11-T1 to the management VLAN
• C11-T2 to the FSP VLAN
• C11-T3 to the campus network
• HMC1 to the FSP VLAN

ESS 5000 nodes must have the following connections:

• C11-T1 to the management VLAN
• HMC1 to the FSP VLAN

ESS 3200 nodes must have the following connections:

• Single management connection per canister:
  • Each connection is split between 2 MAC addresses:
    1. BMC
    2. Operating system
  • The BMC connection requires a VLAN tag to be set for proper communication with the EMS node.

ESS 3200 requirements

• Management connections
  • Shared management port (visible to OS)
• BMC connection
  • Shared management port (visible to BMC)
• High-speed connections
  • InfiniBand or Ethernet

Management switch

• Typically, a 48-port switch
• Two VLANs required
  • Management VLAN (VLAN 102)
  • FSP/BMC VLAN (VLAN101)
• ESS 3200 dedicated trunk ports
  • Routes BMC traffic to VLAN 101

Note: The VLANs shown here are default for the IBM Cumulus switch. The VLAN value can be modified according to your environment.

The ports highlighted in green are the ESS 3200 trunk ports. These are special ports that are for the ESS 3200 only. The reason for these ports is that each ESS 3200 canister has a single interface for both the BMC and the OS but unique MAC addresses. By using a VLAN tag, canister BMC MAC addresses are routed to the BMC/FSP/Service VLAN (Default is 101).
IBM racked orders have the switch preconfigured. Only the VLAN tag needs to be set. If you have an existing IBM Cumulus switch or customer supplied switch, it needs to be modified to accommodate the ESS 3200 trunk port requirement. For more information, see Switch VLAN configuration instructions.

POWER8 EMS must have the following connections:

• C10-T1 to the management VLAN
• C10-T4 to the FSP/Service VLAN
• C10-T2 to the management VLAN
• C10-T3 optional campus connection
• HMC1 to the FSP/Service VLAN

POWER9 EMS must have the following connections:

• C11-T1 to the management VLAN
• C11-T2 to the FSP VLAN
• HMC1 to the FSP VLAN
• C11-T3 to the campus or management network/VLAN

POWER8 nodes:

• C12-T1 to the management VLAN
• HMC1 to the FSP VLAN

You can download the latest 6.1.x.x code (6.1.2.8 is the latest) from IBM Fix Central by using the following link.

• IBM Fix Central download link

There are (4) containers offered with (2) versions each (Data management + Data access). Example package names for each container are as follows:

ESS_DME_BASEIMAGE-6.1.2.8-x86_64-3200-Linux.tgz
ESS_DAE_BASEIMAGE-6.1.2.8-x86_64-3200-Linux.tgz
ESS_DME_BASEIMAGE-6.1.2.8-ppc64LE-5000-Linux.tgz
ESS_DAE_BASEIMAGE-6.1.2.8-ppc64LE-5000-Linux.tgz
ESS_DME_BASEIMAGE-6.1.2.8-x86_64-3000-Linux.tgz
ESS_DAE_BASEIMAGE-6.1.2.8-x86_64-3000-Linux.tgz
ESS_DME_BASEIMAGE-6.1.2.8-ppc64LE-Legacy-Linux.tgz
ESS_DAE_BASEIMAGE-6.1.2.8-ppc64LE-Legacy-Linux.tgz

If you are moving from an xCAT-based release (5.3.x) to a container-based release (6.1.x.x), the following considerations apply:

• You must add an additional management network connection to C10-T2.
• A public or additional management connection is mandatory in C10-T3.
• You must stop and uninstall xCAT and all xCAT dependencies before installing the container.

Data center access has become more restrictive nowadays. Here are some considerations to enable remote support:

• Always add a campus connection to the EMS (POWER8 and POWER9).
• Consider adding campus connections to the HMC2 ports on all POWER servers (ESS Legacy, ESS 5000, POWER8 or POWER9 EMS). Consider cabling this port to a public network and setting a campus IP. This will allow remote recovery or debug of the EMS in case of an outage.
• Consider adding campus connections to C11-T3 (POWER9 nodes) or C10-T3 (POWER8 nodes).
• Consult with service about adding USB to Ethernet dongle to enable campus connections on the ESS 3200 system.
• Add campus connection to a free port on each ESS 3000 canister. Also consider adding SMART PDUs on ESS 3000 frames to help remotely power cycle the system.

• If both POWER8 and POWER9 EMS nodes are in an environment, it is recommended that you use only the POWER9 EMS for management functions (containers, GUI, ESA, collector).
• Only a single instance of all management services is recommended and solely on the POWER9 EMS.
• POWER8 only needs to exist as a management node if you are mixing a non-container-based release (5.3.x) with a container-based release (6.x.x.x).
• It is recommended that all nodes in the storage cluster contain the same ESS release and IBM Spectrum Scale version.
• It is recommended that you upgrade to the latest level before adding a building block.

The following guidance is for customers migrating from an xCAT-based release to a container-based release for POWER8 offerings.

POWER9 EMS

You cannot run both POWER8 and POWER9 EMS nodes in the same environment for ESS Legacy. If you are moving a POWER9 EMS, migrate all services from the POWER8 EMS and uninstall xCAT. You can then re-use the POWER8 EMS for other purposes such as quorum node, client node, or spare EMS. The preference is to always use a POWER9 EMS if possible and you must not run multiple instances of GUI, performance monitoring collectors, etc. in the same cluster. For this requirement, there are exceptions for certain stretch cluster environments and if you are mixing ESS Legacy and container-based deployments such as ESS 5.3.7 on POWER8 and ESS 6.0.2.x on POWER9.

POWER8 EMS

If you are migrating from ESS 5.3.x to ESS 6.1.0.x on a POWER8 EMS, do the following steps.

1. Stop and uninstall xCAT by doing the following steps on a POWER8 EMS, outside of the container.
   1. Stop xCAT.

      systemctl stop xcatd

   2. Uninstall xCAT.

      yum remove xCAT*

   3. Remove dependencies.

      yum remove dbus-devel dhcp bind java-1.8.0-openjdk

2. Add a container connection to C10-T2.
3. Add a campus connection to C10-T3, if it is not done already.
4. Update /etc/hosts with the desired container host name and IP address.

• The following tasks must be complete before starting a new installation (tasks done by manufacturing and the SSR):
  • SSR has ensured all hardware is clean, and IP addresses are set and pinging over the proper networks (through the code 20 operation).
  • /etc/hosts is blank.
  • The ESS tgz file (for the correct edition) is in the /home/deploy directory. If upgrade is needed, download from Fix Central and replace.
  • Network bridges are cleared.
  • Images and containers are removed.
  • SSH keys are cleaned up and regenerated.
  • All code levels are at the latest at time of manufacturing ship.
• Customer must make sure that the high-speed connections are cabled and the switch is ready before starting.
• All node names and IP addresses in this document are examples.
• Changed root password should be same on each node, if possible. The default password is ibmesscluster. It is recommended to change the password after deployment is completed.
• Each server's IPMI and ASMI passwords (POWER nodes only) are set to the server serial number. Consider changing these passwords when the deployment is complete.
• Check whether the SSSD service is running on EMS and other nodes. Shut down the SSSD service on those nodes manually, before you upgrade the nodes.

• ESS 6.x.x.x uses a new embedded license. It is important to know that installation of any Red Hat packages outside of the deployment upgrade flow is not supported. The container image provides everything required for a successful ESS deployment. If additional packages are needed, contact IBM for possible inclusion in future versions.
• For ESS 3000, consider enabling TRIM support. This is outlined in detail in IBM Spectrum Scale RAID Administration. By default, ESS 3000 only allocates 80% of available space. Consult with IBM development, if going beyond 80% makes sense for your environment, that is if you are not concerned about the performance implications due to this change.
• You must setup a campus or additional management connection before deploying the container.
• If running with a POWER8 and a POWER9 EMS in the same environment, it is best to move all containers to the POWER9 EMS. If there is a legacy PPC64LE system in the environment, it is best to migrate all nodes to ESS 6.1.x.x and decommission the POWER8 EMS altogether. This way you do not need to run multiple ESS GUI instances.
• If you have a POWER8 EMS, you must upgrade the EMS by using the legacy flow if there are xCAT based PPC64LE nodes in the environment (including protocol nodes). If there are just an ESS 3000 system and a POWER8 EMS, you can upgrade the EMS from the ESS 3000 container.
• If you are migrating the legacy nodes to ESS 6.1.x.x on the POWER8 EMS, you must first uninstall xCAT and all dependencies. It is best to migrate over to the POWER9 EMS if applicable.
• You must be at ESS 5.3.7 (Red Hat Enterprise Linux 7.7 / Python3) or later to run the ESS 3000 container on the POWER8 EMS.
• You must run the essrun config load command against all the storage nodes (including EMS and protocol nodes) in the cluster before enabling admin mode central or deploying the protocol nodes by using the installation toolkit. For more information, see Deploying protocols.
• If you are running a stretch cluster, you must ensure that each node has a unique hostid. The hostid might be non-unique if the same IP addresses and host names are being used on both sides of the stretch cluster. Run gnrhealthcheck before creating recovery groups when adding nodes in a stretch cluster environment. You can manually check the hostid on all nodes as follows:

  mmdsh -N { NodeClass | CommaSeparatedListofNodes } hostid

  If hostid on any node is not unique, you must fix by running genhostid. These steps must be done when creating a recovery group in a stretch cluster.

• Consider placing your protocol nodes in file system maintenance mode before upgrades. This is not a requirement but you should strongly consider doing it. For more information, see File system maintenance mode.
• Do not try to update the EMS node while you are logged in over the high-speed network. Update the EMS node only through the management or the campus connection.
• After adding an I/O node to the cluster, run the gnrhealthcheck command to ensure that there are no issues before creating vdisk sets. For example, duplicate host IDs. Duplicate host IDs cause issues in the ESS environment.
• Run the container from a direct SSH connection. Do not SSH from an I/O node or any node that might be rebooted by the container.
• Do not log in and run the container over the high-speed network. You must log in through the campus connection.
• You must stop Spectrum Scale tracing (mmtrace | mmtracectl) before starting the container or deploying any node. The container attempts to block if tracing is detected, it is recommended to manually inspect each ESS node before attempting to deploy.

• Multiple EMS nodes are not supported in the same cluster. If you are adding a POWER9 EMS to an existing cluster run by a POWER8 EMS, the POWER9 EMS must be the only one used for management functions such as GUI, performance monitoring collector, etc.
• Multiple GUI instances are not supported in the same cluster.
• One collector node must be run at a time in the cluster. This must be on the same node as the GUI.
• You cannot mix majoresagent.pLinux-4.5 IBM Spectrum Scale versions in the storage cluster. All nodes must be updated to the latest level.
• ESA must be running on the EMS.
• You can run call home on the EMS.
• If possible, run the client nodes in a separate cluster than the storage.
• The essrun (ESS deployment Ansible wrapper tool run within the container) tool does not use the GPFS admin network. It uses the management network only to communicate from the container to each of the nodes.
• If POWER8 EMS only, consolidate potential xCAT and non-xCAT offerings to container versions.

  Example: If you have ESS 5.3.7.x (Legacy POWER8 offering on Scale 5.0.5.x) and ESS 3000 (Containerized support for ESS 3000 on Scale 5.x.x.x and above), convert the Legacy 5.3.7.x to 6.1.x.x so that only containers are running on POWER8 EMS.

  Note: This only applies to situations where there was already Scale 5.1.x.x+ in the environment.

  Note: There is no container offering for BE so environments with BE would have to remain at 5.0.5 release level (but the POWER8 EMS could still move to all container version).
• If POWER8 EMS and POWER9 EMS are owned by the customer, it is recommended to consolidate to POWER9 EMS (all container versions).

  Example: If POWER8 EMS was running 5.1.x.x (ESS 3000, ESS Legacy or both) and customer has a POWER9 EMS (running ESS 5000 or ESS 3200) then should migrate the containers from POWER8 EMS to POWER9 and discard the POWER8 EMS (single management node).

• If migrating from xCAT-based legacy offering to container based you must go from ESS 5.3.7.x.
• When you update ESS to 6.1.2.x for the first time, you must consider the implications of moving to MOFED 5.x. Review this flash carefully for more informationMellanox OFED 5.x considerations in IBM ESS V6.1.2.x.
• Spectrum Fusion, Spectrum Scale Container Native, and Spectrum Scale CSI all utilize the GUI rest-api server for provisioning of storage to container applications. Persistent Volume (PV) provisioning will halt when the ESS GUI is shut down and remain halted for the duration of the ESS upgrade, until the GUI is restarted. Ensure that the OpenShift and Kubernetes administrators are aware before proceeding.