Creating a custom role for the fencing agent

Create a custom role in IAM and assign the actions that are required for fencing operations.

Grant access for the following actions:

• Read objects in the cloud_instance or workspace.
• List virtual server instances.
• Get information about a virtual server instance.
• Perform an action on a virtual server instance.

Create a custom role in IAM.

1. Click Roles > Create.

2. Enter the Role Name, Role ID, and Role description for the custom role.

3. Select Workspace for Power Virtual Server from the Service list.

4. Set View to Manager and Type to Service, and then search for power-iaas.pvm-instance. to simplify the list.

5. In the Actions list, select the following actions.

   • power-iaas.pvm-instance.action
   • power-iaas.pvm-instance.list
   • power-iaas.pvm-instance.read

6. Click Create to save the role.

Creating a custom role for the powervs-subnet resource agent

This step is only required if you are implementing a cluster in a multizone region environment with the powervs-subnet resource agent.

Create a custom role in IAM and assign the actions that are required for subnet move operations.

Grant access for the following actions:

• Read objects in the cloud_instance or workspace.
• List and get information for subnets in the workspace.
• Create and delete subnets in the workspace.
• Attach and detach subnets to or from a virtual server instance.
• Delete network ports.

Create a custom role in IAM.

1. Click Roles > Create.
2. Enter the Role Name, Role ID, and Role description for the custom role.
3. Select Workspace for Power Virtual Server from the Service list.
4. Set View to Manager and Type to Service to simplify the list.
5. Select the following actions in the Actions list.
   • power-iaas.cloud-instance.read
   • power-iaas.pvm-instance-network.list
   • power-iaas.pvm-instance-network.read
   • power-iaas.network.list
   • power-iaas.network.create
   • power-iaas.network.delete
   • power-iaas.network-port.delete
   • power-iaas.pvm-instance-network.create
   • power-iaas.pvm-instance-network.delete
6. Click Create to save the role.

Creating a custom role for the powervs-move-ip resource agent

This step is only required if you are implementing a cluster in a multizone region environment with the powervs-move-ip resource agent.

Create a custom role in IAM and assign the actions that are required for static route operations.

Grant access for the following actions:

• Read objects in the cloud_instance or workspace.
• Modify objects in the cloud_instance or workspace.

Create a custom role in IAM.

1. Click Roles > Create.
2. Enter the Role Name, Role ID, and Role description for the custom role.
3. Select Workspace for Power Virtual Server from the Service list.
4. Set View to Manager and Type to Service, and then search for route to simplify the list.
5. Select the following actions in the Actions list.
   • power-iaas.cloud-instance.read
   • power-iaas.cloud-instance.modify
6. Click Create to save the role.

Creating a Service ID

Create a Service ID for the agent and assign one or more custom roles to it.

If you configure the fence_ibm_powervs fence agent and either the powervs-move-ip or powervs-subnet resource agent in the cluster, you can create separate Service IDs for each agent or use a single shared Service ID. If you are using a common Service ID, assign both the custom role for fencing and the custom role for the powervs-move-ip or powervs-subnet resource agent.

Create a Service ID in IAM.

1. Click Service IDs > Create.
2. Enter a Name and Description for the service ID.
3. Click Create.
4. In the Access policies section, click Assign access.
5. In the Service section, select Workspace for Power Virtual Server and click Next.
6. In the Resource section, select Specific Resources > Service Instance > string equals > name of the first workspace that you created earlier. Click Next.
7. In the Roles and actions section, select one or more of the custom roles that you created earlier in Custom access and click Next.
8. You can skip the Conditions (Optional) section.
9. Click Add and then Assign to create the Service ID.

If you create a Service ID for the powervs-move-ip or powervs-subnet resource agent in a multizone region implementation, you must grant access to both workspace resources. In the Access policies section, click Assign access and repeat the steps to assign access also for the second workspace.

Creating an API key for the Service ID

When you configure an agent in a high availability cluster as a fencing device or cluster resource, you must specify an API key. The API key authorizes the fencing or resource agent to use the IBM Power Cloud API to perform the actions that are defined in the Service ID.

Create the API Key for the Service ID in the IAM.

1. Click Service IDs and select the Service ID that you created earlier.
2. Click API Keys to switch to the Create and manage API keys for this service ID tab.
3. Click Create.
4. Enter a Name and a Description for the key.
5. Click Create.

Click Download to save the API key to a JSON file. Keep the downloaded file in a safe place.

The key is available for 300 seconds. After 300 seconds, you won't be able to view or retrieve the key.