Accessing VPC regional file storage shares from IBM Power Virtual Server instances

This tutorial might incur costs. Use the Cost Estimator to generate a cost estimate based on your projected usage.

In this tutorial, you learn how to mount a file share with regional availability on IBM Power Virtual Server server instances. You cannot directly mount a file storage share on IBM Power Virtual Server instances and must instead use a path through a network load balancer (NLB). You create a file storage profile with regional availability and a mount target in IBM VPC. You create two network load balancers with routing mode in different availability zones in IBM VPC, and configure the route tables. Then, you mount the file storage share on the virtual server instances in IBM Power Virtual Server.

The following architecture overview diagram illustrates this scenario.

The virtual server instance in IBM Power Virtual Server sends a request through a transit gateway to the file storage share. According to the rule in the routing table of the VPC, the network traffic to the file storage share is directed to the network load balancer. Routing_mode is enabled for the network load balancer. It bypasses a back-end pool and sends requests directly to the destination IP address. The file storage share responds and the response is sent directly to the virtual server instance in IBM Power Virtual Server. The network load balancer (NLB) with routing mode has two IP addresses (active and standby). When a failover occurs, the route mode updates all routing rules that are created for the VPC with a next_hop of the standby IP. Both the active IP and the standby IP are used during the lifetime of an NLB with route mode.

A diagram that shows the architecture for accessing File Storage for VPC with regional availability.
Architecture overview diagram

Before you begin

  • Create a VPC spanning at least two availability zones, or use an existing one.

  • Create the address prefixes and the subnets for the multizone region VPC.

  • Create two IBM Power Virtual Server workspaces in the IBM Cloud region, with affinity to the availability zones of the VPC.

See the mapping between the VPC zones and the Power Virtual Server zones in IBM Cloud regions.

  • Create two virtual server instances in IBM Power Virtual Server. Deploy one virtual server instance in each of the two workspaces. Note the IP addresses of the virtual server instances.

  • Create a Transit Gateway and attach the VPC subnets and the IBM Power Virtual Server workspaces to the Transit Gateway.

  • Check the user permissions. Make sure that your user account has permissions to create and manage VPC resources. See Granting user permissions for VPC resources. Assign a viewer role or higher on the resource group used for the VPC resources. Assign an editor role or higher on the service VPC Infrastructure Services.

  • Use or create an SSH key to connect to the virtual server instances. If you don't have an SSH key, see Getting started with SSH keys.

Creating a security group to allow NFS V4 traffic

Create a security group and configure inbound rules for port 2049.

  1. Go to Security groups for VPC and click Create.
  2. Verify or set the Geography and Region fields.
  3. Enter nfs-server-sg for the Name.
  4. Select the same Resource group as the VPC resource group.
  5. Select your VPC in the Virtual private cloud list.
  6. Create an inbound rule for each virtual server instance (NFS client).
    1. In the Inbound rules section, click Create.
    2. Configure the rule as follows:
      • Protocol: Select TCP.
      • Port: Select Port range, and enter 2049 for both Port min and Port max.
      • Source type: Select IP or CIDR.
        • Enter the IP address of each virtual server instance.
        • If your instances are in a subnet and you want to allow access from all members of the subnet, enter the subnet's CIDR block.
      • Destination type: Select Any.
    3. Configure the rule as follows in addition to above when provisioning a mount target with in-transit encryption EIT:
      • Protocol: Select TCP.
      • Port: Select Port range, and enter 20049 for both Port min and Port max.
      • Source type: Select IP or CIDR.
        • Enter the IP address of each virtual server instance.
        • If your instances are in a subnet and you want to allow access from all members of the subnet, enter the subnet's CIDR block.
      • Destination type: Select Any.
    4. Click Create to save the rule.
  7. Create a common outbound rule.
    1. In the Outbound rules section, click Create.
    2. Configure the rule as follows:
      • Protocol: Select TCP.
      • Port: Select Any.
      • Destination type: Select Any.
      • Source type: Select Any.
    3. Click Create to save the rule.
  8. Finalize the security group.
    • Click Create security group to apply the configuration.

Provisioning file storage with regional availability

The availability cannot be modified after provisioning.

The encryption setting of a mount target cannot be modified after it has been created. To change the encryption, you must delete the existing mount target and recreate it. This process does not affect the underlying data, and no data will be lost.

  1. Go to File storage shares for VPC.
  2. Click Create > Create file share.
  3. In the Availability section, choose Regional availability.
  4. In the Location section, select the Geography and the multizone Region (MZR).
  5. In the Details section, enter nfs-server in the Name field. Select the same Resource group as the VPC resource group.
    • The profile is chosen automatically based on your data availability selection. If you chose regional availability, your file share uses the rfs profile.
    • Select the Size and Max throughput for your file share. You can increase the capacity later, and you can also adjust the bandwidth as needed. The Mount target access mode is always Security groups. The previous access mode Virtual private cloud is not available for file storage with regional availability.
  6. In the Mount targets (optional) section, click Create.
    • In the Mount target details section, enter nfs-server-mount-target in the Mount target name field.
    • Select your VPC.
    • In the Network interfaces section, click the pencil icon on the new interface. Verify the selected subnet and click Next.
    • In the Security groups section, check the nfs-server-sg security group, clear the VPC default security group, and click Next.
    • Click Next to get to the Review section, then click Save.
  7. Click Next when you got back to the Create mount target screen.
  8. Click Create file share on the right to provision the file storage and the mount target.

Gathering the file storage IP address and mount path information

  1. Go to File storage shares for VPC.
  2. Click the Name nfs-server.
  3. In the Mount targets section, click the Name of the mount target in the VPC to view the mount target details.
  4. Make a note of the Mount path. In the example, the mount path is 10.20.30.40:/73a1ff96_4861_4463_aa09_8c8128b8e277fsf. The first part of the mount path is the Primary IP of the mount target: 10.20.30.40 .

Later, set the Destination parameter in the VPC route entry to the primary IP of the mount target. Use the Mount path parameter as an argument for the mount command on the IBM Power Virtual Server instance.

Creating the private network load balancers with routing mode

Creating the service-to-service authentication policy

To support routing mode, you must first create a service-to-service authentication policy for your NLB.

  1. Log in to IBM Access Management.
  2. Click Authorizations, then click Create.
  3. Select This account for Source account and click Next.
  4. Select VPC Infrastructure Services for Service and click Next.
  5. Select Specific resources > Resource Type > Load Balancer for VPC for the scope access and click Next.
  6. Select VPC Infrastructure Services for the target service and click Next.
  7. Select Specific resources > Resource Type > Virtual Private Cloud for the scope access and click Next.
  8. Select the Editor checkbox to grant the Editor access role.
  9. Click Authorize.

Creating the network load balancers

You need to create two load balancers, each of them for the specific subnet in an availability zone.

  1. Go to the Load balancers for VPC page and click Create.

  2. Select Network Load Balancer (NLB) as the Load balancer type.

  3. In the Location section, select the same Geography and Region that is used for the virtual private cloud.

  4. Enter nfs-server-nlb-1 in the Name field.

  5. Select the same Resource group as the VPC resource group.

  6. Select your VPC in the Virtual private cloud list.

  7. Select the Subnet according to the subnet of the availability zone.

  8. Check Private in the Type section.

  9. Set Routing mode to On to create a network load balancer with routing mode.

  10. In the Back-end pools section, click Create pool. Set the parameters to the following values.

    • Name: nfs-server-fwd-pool
    • Pool protocol: TCP
    • Session stickiness: None
    • Method: Round robin
    • Click Create.

  11. In the Front-end listeners section, click Create listener. Select your Back-end pool and click Save.

  12. In the Security Groups sections, check the nfs-server-sg security group, and clear the default security group.

  13. Click Create a load balancer to provision the load balancer.

As part of the process, you create a back-end pool. However, you cannot define the back-end pool Failsafe policy directly, and it must be updated in the next step.

Repeat the step and create the second load balancer nfs-server-nlb-2 in the other VPC zone.

Updating the network load balancer failsafe policy

Update the Failsafe policy for the nfs-server-fwd-pool back-end pool. The network load balancer then bypasses the back-end pool and sends requests directly to the destination IP address.

  1. Go to Load balancers for VPC.
  2. Click the load balancer nfs-server-nlb-1.
  3. Click the Back-end pools tab and select the pool nfs-server-fwd-pool.
  4. Click nfs-server-fwd-pool and then Edit.
  5. In the Failsafe policy section, select Bypass as the Action.
  6. Click Save.

Repeat those steps for load balancer nfs-server-nlb-2.

Collecting the private IP addresses of the load balancer

  1. Go to Load balancers for VPC.

  2. Click nfs-server-nlb-1.

  3. In the Load balancer details - Private IPs section, make a note of the first IP address entry in the list.

Repeat those steps for load balancer nfs-server-nlb-2.

Later, you set the Next hop parameter in the VPC route entries to the active Private IP address of the load balancer.

Creating a routing table and routes for VPC

Creating a routing table

Customize the Ingress routes to route incoming traffic from external sources such as the IBM Cloud Transit Gateway. Only one custom routing table is associated with an ingress source. If an ingress routing table exists for the IBM Cloud Transit Gateway source, add the route to that table.

  1. Go to Routing tables for VPC.
  2. Click Create.
  3. In the Location section, select the same Geography and Region that is used for the virtual private cloud.
  4. Enter nfs-server-routing in the Name field.
  5. Select your VPC in the Virtual private cloud list.
  6. Enable the Transit gateway flag in the Traffic source (optional) section.
  7. Click Create routing table to provision the routing table.

Updating the routing table

To propagate routes outside the VPC address prefix range, enable Advertise to for the transit gateway.

  1. Go to Routing tables for VPC.
  2. Click on the name of the ingress route that you created earlier.
  3. In the Traffic section, click Edit to open the Edit traffic panel.
  4. Under Traffic source, expand the Transit Gateway section.
  5. Toggle the Advertise to switch to On.
  6. Click Save to apply the changes to the routing table.

Creating routes

  1. Go to Routing tables for VPC.

  2. Click the name nfs-server-routing.

  3. Click Create.

  4. Select the zone, according to the zone of the network load balancer, in the Zone field.

  5. Enter rfs-route-1 in the Name field.

  6. Using CIDR notation, enter the IP address of the mount target as Destination CIDR.

  7. Select Deliver as the Action.

  8. Enter the IP address of the network load balancer #1 as the Next hop (IP address).

  9. Switch Advertiseto On.

  10. Click Save to add the route to the table.

Repeat those steps, and use the name rfs-route-2, for the IP address of the network load balancer #2.

Mounting the file share on the IBM Power Virtual Server instance

Log on as the root user to the server instance in IBM Power Virtual Server where you want to mount the file share.

  • Mounting when not using in-transit encryption

    1. Install the NFS client packages on the instance.

      dnf install nfs-utils

    2. Create a directory for the mount point.

      mkdir <mount_point>

    3. Mount the remote file share.

      mount -t nfs4 -o <options> <host:/mount_target> <mount_point>

      See the following example.

      mkdir /mnt/test
mount -t nfs4 -o rw,sec=sys 10.20.30.40:/ea90ea14_0a1b_4f36_85c0_1cf83a2c8065 /mnt/test

  • Mounting when using in-transit encryption EIT

    The utility installs stunnel on the compute host. Stunnel needs a pem file. Because stunnel is used in client mode, you can use the pem that that comes with the distribution.

    1. Install the NFS client packages on the instance.

      dnf install nfs-utils

    2. Download the Mount Helper package from GitHub.

      curl -LO https://github.com/IBM/vpc-file-storage-mount-helper/releases/download/latest/mount.ibmshare-latest.tar.gz

    3. Extract the compressed file.

      tar -xvf mount.ibmshare-latest.tar.gz

    4. Install the Mount Helper and all the dependencies.

      ./install.sh --stunnel

    5. Create a directory for the mount point.

      mkdir <mount_point>

    6. Mount the remote file share.

      mount -t ibmshare -o stunnel <host:/mount_target> <mount_point>

      See the following example.

      mkdir /mnt/test
mount -t ibmshare -o stunnel,rw,sec=sys 10.20.30.40:/ea90ea14_0a1b_4f36_85c0_1cf83a2c8065 /mnt/test