Use this file to discover all available pages before exploring further.
The inventory file (such as hosts.inv) sets the configuration properties used for the installation. The Zettaset software includes an annotated sample file (such as hosts.inv.example). Additional information is provided here.
In the ALL NODES section, list each node in your deployment by using hostnames or IP addresses. For each node, include
the following variables:encrypted_blockdev: Enter the block device to be encrypted (/dev/sdb1). The disk partition name is expected. To use
disk partition labels, set use_labels=true.encrypted_mountpoint: Enter a mount point for the device (/data1). The mount point must exist before the install.encrypted_mountnames: Enter a partition name. Each name must be unique for each partition on the node.
(such as crypt1)encrypted_preserve: Use one of the following values:
y: Preserves existing data. The file system must be mounted before the install. If the partition is not mounted, the data will be overwritten. The partition must also be unmountable. If a process prevents the unmount, encryption cannot start. Only ext file systems can be preserved.
n: Does not preserve existing data. The partition must be unmounted.
w: Securely wipes the partition before the new encrypted file system is created. The partition must be unmounted.
fstype: Must be set to the type of file system to make when encrypted_preserve is y or w. Must be set to the
existing file system type when encrypted_preserve=n. Typical file system types include ext4 and xfs.newfsargs: A string of arguments to pass to the mkfs command. If there are spaces between multiple arguments,
surround the string in double quotes (for example, “-b 2048 -d su=64k,sw=4”). When no arguments are to be passed, set
this value to none.mountargs: A string of mount options to pass to the crypt_mount.sh script. If there are spaces between multiple
arguments, surround the string in double quotes (e.g., “noatime,inode64,allocsize=16m”). When no arguments
are to be passed, set this value to none.kmip_client_jks: The location of the keystore that contains the client certificate. The keystore must be in this
location on the installer node prior to installation.kmip_client_jks_password: The password for the jks file.When encrypting multiple partitions on a node, use commas to separate values. For newfsargs, use colons to separate
values. Include values for all settings. For example:
The preceding hostnames must resolve. If some nodes are separated by a proxy (such as if you are deploying to nodes in skytap from your laptop), use the ansible_ssh_host and ansible_ssh_port variables. Otherwise, do not use those variables.
Set to true to enable FIPS 140 mode. All ZTS processes run in FIPS mode. Setting fips_mode to true is currently only supported for OS versions 7.x and later.
Text
# DISK LABELSuse_labels=false
By default, the Zettaset software expects the encrypted_blockdev value used above to point to a disk partition, such as /dev/sdb. To use disk partition labels instead, set use_labels=true.
Text
# CA CONFIGURATIONinternal_ca=falseexternal_ca_cert_source=ca_org_name=ca_org_unit=ca_org_email=ca_org_locale=ca_org_state=ca_org_country=
You need a CA to authenticate nodes within your deployment. To use your pre-defined CA, set internal_ca=false and enter the full path to the CA PEM file in external_ca_cert_source. This is the location of the CA PEM file on the installer node.While using an external CA, you can ignore the ca_org values.
Text
# KMIP SERVER CONFIGURATIONinternal_kmip=falsekmip_master_ip=172.24.166.20kmip_server_port=9000kmip_client_timeout=300000kmip_compatible_user=trueinstall_ha=falsekmip_client_jks_test=kmip_client_jks_test_passwd=
You need a KMIP server to process key requests. To use an external KMIP server, set internal_kmip=false, and set the kmip_master_ip and kmip_master_port to point to your third-party device.Use kmip_client_timeout to configure the timeout setting, or keep the default value of 300000.When using an external KMIP server, use kmip_client_jks_test and kmip_client_jks_password to enter the jks path and password, and check the KMIP server connectivity before installing XCrypt. Using these values, install a KMIP client on the installation node. Leave these values blank if you do not need to check external KMIP connectivity or install a KMIP client on the installation node.
A software or hardware-based HSM is required for key storage. To use the CryptoHub for hardware-based key storage, set the values for each of the following parameters:hsm_so_pin and hsm_user_pin: CryptoHub identity password configured inside the <CRYPTO-OPR-PASS> tag in the fxpkcs11.cfg file.hsm_slot: Slot number configured in the FXPKCS11 configuration file (fxpkcs11.cfg). The slot number is 0 by default.hsm_lib_cfg_env_var: Specify COMPAT_MODE=3.hsm_lib_file: Path and filename for the FXPKCS11 module.
The bracketed values indicate the function a node has in the deployment. Be sure that these settings agree with the
other values in this file.[ca_master]: The node used to store licenses and generate the CA. If using an external CA, set this value to a node
within the cluster.[kmip]: List of the KMIP server and backup server nodes. The first entry must be the kmip_master. Ignore when using
an external KMIP server.[kmip_master]: The KMIP master node. Must be the same as kmip_master_ip. Ignore when using an external KMIP
server.[slave]: List of the nodes that will have encrypted partitions.[license_server]: List of the nodes where you plan to install the License server. Must not intersect with [kmip] or
[slave] nodes.[zookeeper]: List of the zookeeper nodes used when KMIP HA is enabled. List at least three nodes. These nodes
cannot be members of the [kmip] group.
Was this page helpful?
⌘I
Assistant
Responses are generated using AI and may contain mistakes.
