Preparing the IBM Cloud environment for a high availability cluster

Creating a custom role for the fencing agent

Create a custom role in IAM and assign the set of actions that are required for a fencing operation to the role. Grant access for the following actions.

• Reading objects in the cloud_instance or workspace
• Listing virtual server instances
• Getting information about a virtual server instance
• Performing an action on a virtual server instance

The action set of a custom role must be unique within the account. You cannot create multiple custom roles with the same action set.

Create a custom role in IAM.

1. Click Roles > Create.

2. Enter the Name, ID, and Description for the custom role.

3. Select Power Virtual Server Workspace from the Service list.

4. Select Manager from the View the actions for list.

5. In the Actions list, locate the following actions. Click Add for each of them.

   • power-iaas.pvm-instance.list
   • power-iaas.pvm-instance.read
   • power-iaas.pvm-instance.action

6. Click Create to save the role.

Creating a custom role for the powervs-subnet resource agent

This step is only required if you are implementing a cluster in a multizone region environment with the powervs-subnet resource agent.

Create a custom role in IAM and assign the set of actions that are required for a subnet move operation in the role. Grant access for the following actions.

• Reading objects in the cloud_instance or workspace
• Listing and getting information for subnets in the workspace
• Creating and deleting subnets in the workspace
• Attaching and detaching subnets to or from a virtual server instance
• Deleting network ports

Create a custom role in IAM.

1. Click Roles > Create.
2. Enter the Name, ID, and Description for the custom role.
3. Select Power Virtual Server Workspace in the Service list.
4. Select Manager from the View the actions for list.
5. In the Actions list, locate the following actions. Click Add for each of them.
   • power-iaas.cloud-instance.read
   • power-iaas.pvm-instance-network.list
   • power-iaas.pvm-instance-network.read
   • power-iaas.network.list
   • power-iaas.network.create
   • power-iaas.network.delete
   • power-iaas.network-port.delete
   • power-iaas.pvm-instance-network.create
   • power-iaas.pvm-instance-network.delete
6. Click Create to save the role.

Creating a custom role for the powervs-move-ip resource agent

This step is only required if you are implementing a cluster in a multizone region environment with the powervs-move-ip resource agent.

Create a custom role in IAM and assign the set of actions that are required for static route operations. Grant access for the following actions.

• Reading objects in the cloud_instance or workspace
• Modifying objects in the cloud_instance or workspace

Create a custom role in IAM.

1. Click Roles > Create.
2. Enter the Name, ID, and Description for the custom role.
3. Select Power Virtual Server Workspace in the Service list.
4. Select Manager from the View the actions for list.
5. In the Actions list, locate the following actions. Click Add for each of them.
   • power-iaas.cloud-instance.read
   • power-iaas.cloud-instance.modify
6. Click Create to save the role.

Creating a Service ID

Create a Service ID for the agent and assign one or more custom roles to it.

If you configure the fence_ibm_powervs fence agent and either the powervs-move-ip or powervs-subnet resource agent in the cluster, you can create separate Service IDs for each agent or use a single shared Service ID. If you are using a common Service ID, assign both the custom role for fencing and the custom role for the powervs-move-ip or powervs-subnet resource agent.

Create a Service ID in IAM.

1. Click Service IDs > Create.
2. Enter a Name and Description for the service ID.
3. Click Create.
4. In the Access policies section, click Assign access.
5. In the Service section, select Workspace for Power Virtual Server and click Next.
6. In the Resource section, select Specific Resources > Service Instance > string equals > name of the first workspace that you created earlier. Click Next.
7. In the Roles and actions section, select one or more of the custom roles that you created earlier in Custom access and click next.
8. You can skip the Conditions (Optional) section.
9. Click Add and then Assign to create the Service ID.

If you create a Service ID for the powervs-move-ip or powervs-subnet resource agent in a multizone region implementation, you must grant access to both workspace resources. In the Access policies section, click Assign access and repeat the steps to assign access also for the second workspace.

Creating an API key for the Service ID

When you configure an agent in a high availability cluster as a fencing device or cluster resource, you must specify an API key. The API key authorizes the fencing or resource agent to use the IBM Power Cloud API to perform the actions that are defined in the Service ID.

Create the API Key for the Service ID in the IAM.

1. Click Service IDs and select the Service ID that you created earlier.
2. Click API Keys to switch to the Create and manage API keys for this service ID tab.
3. Click Create.
4. Enter a Name and a Description for the key.
5. Click Create.

Click download to save the API key to a JSON file. Keep the downloaded file in a safe place.

The key is available for 300 seconds. After 300 seconds, you won't be able to view or retrieve the key.