Chapter 23. Setting up Stratis file systems Stratis runs as a service to manage pools of physical storage devices, simplifying local storage management with ease of use while helping you set up and manage complex storage configurations. 23.1. What is Stratis Stratis is a local storage-management solution for Linux. It is focused on simplicity and ease of use, and gives you access to advanced storage features. Stratis makes the following activities easier: Initial configuration of storage Making changes later Using advanced storage features Stratis is a local storage management system that supports advanced storage features. The central concept of Stratis is a storage pool . This pool is created from one or more local disks or partitions, and file systems are created from the pool. The pool enables many useful features, such as: File system snapshots Thin provisioning Tiering Encryption Additional resources Stratis website 23.2. Components of a Stratis volume Learn about the components that comprise a Stratis volume. Externally, Stratis presents the following volume components on the command line and the API: blockdev Block devices, such as a disk or a disk partition. pool Composed of one or more block devices. A pool has a fixed total size, equal to the size of the block devices. The pool contains most Stratis layers, such as the non-volatile data cache using the dm-cache target. Stratis creates a /dev/stratis/ my-pool / directory for each pool. This directory contains links to devices that represent Stratis file systems in the pool. filesystem Each pool can contain one or more file systems, which store files. File systems are thinly provisioned and do not have a fixed total size. The actual size of a file system grows with the data stored on it. If the size of the data approaches the virtual size of the file system, Stratis grows the thin volume and the file system automatically. The file systems are formatted with XFS. Important Stratis tracks information about file systems created using Stratis that XFS is not aware of, and changes made using XFS do not automatically create updates in Stratis. Users must not reformat or reconfigure XFS file systems that are managed by Stratis. Stratis creates links to file systems at the /dev/stratis/ my-pool / my-fs path. Note Stratis uses many Device Mapper devices, which show up in dmsetup listings and the /proc/partitions file. Similarly, the lsblk command output reflects the internal workings and layers of Stratis. 23.3. Block devices usable with Stratis Storage devices that can be used with Stratis. Supported devices Stratis pools have been tested to work on these types of block devices: LUKS LVM logical volumes MD RAID DM Multipath iSCSI HDDs and SSDs NVMe devices Unsupported devices Because Stratis contains a thin-provisioning layer, Red Hat does not recommend placing a Stratis pool on block devices that are already thinly-provisioned. 23.4. Installing Stratis Install the required packages for Stratis. Procedure Install packages that provide the Stratis service and command-line utilities: Verify that the stratisd service is enabled: 23.5. Creating an unencrypted Stratis pool You can create an unencrypted Stratis pool from one or more block devices. Prerequisites Stratis is installed. For more information, see Installing Stratis . The stratisd service is running. The block devices on which you are creating a Stratis pool are not in use and are not mounted. Each block device on which you are creating a Stratis pool is at least 1 GB. On the IBM Z architecture, the /dev/dasd* block devices must be partitioned. Use the partition device for creating the Stratis pool. For information about partitioning DASD devices, see Configuring a Linux instance on IBM Z . Note You cannot encrypt an unencrypted Stratis pool. Procedure Erase any file system, partition table, or RAID signatures that exist on each block device that you want to use in the Stratis pool: where block-device is the path to the block device; for example, /dev/sdb . Create the new unencrypted Stratis pool on the selected block device: where block-device is the path to an empty or wiped block device. You can also specify multiple block devices on a single line by using the following command: Verification Verify that the new Stratis pool was created: 23.6. Creating an unencrypted Stratis pool by using the web console You can use the web console to create an unencrypted Stratis pool from one or more block devices. Prerequisites You have installed the RHEL 9 web console. You have enabled the cockpit service. Your user account is allowed to log in to the web console. For instructions, see Installing and enabling the web console . The stratisd service is running. The block devices on which you are creating a Stratis pool are not in use and are not mounted. Each block device on which you are creating a Stratis pool is at least 1 GB. Note You cannot encrypt an unencrypted Stratis pool after it is created. Procedure Log in to the RHEL 9 web console. For details, see Logging in to the web console . Click Storage . In the Storage table, click the menu button and select Create Stratis pool . In the Name field, enter a name for the Stratis pool. Select the Block devices from which you want to create the Stratis pool. Optional: If you want to specify the maximum size for each file system that is created in pool, select Manage filesystem sizes . Click Create . Verification Go to the Storage section and verify that you can see the new Stratis pool in the Devices table. 23.7. Creating an encrypted Stratis pool To secure your data, you can create an encrypted Stratis pool from one or more block devices. When you create an encrypted Stratis pool, the kernel keyring is used as the primary encryption mechanism. After subsequent system reboots this kernel keyring is used to unlock the encrypted Stratis pool. When creating an encrypted Stratis pool from one or more block devices, note the following: Each block device is encrypted using the cryptsetup library and implements the LUKS2 format. Each Stratis pool can either have a unique key or share the same key with other pools. These keys are stored in the kernel keyring. The block devices that comprise a Stratis pool must be either all encrypted or all unencrypted. It is not possible to have both encrypted and unencrypted block devices in the same Stratis pool. Block devices added to the data tier of an encrypted Stratis pool are automatically encrypted. Prerequisites Stratis v2.1.0 or later is installed. For more information, see Installing Stratis . The stratisd service is running. The block devices on which you are creating a Stratis pool are not in use and are not mounted. The block devices on which you are creating a Stratis pool are at least 1GB in size each. On the IBM Z architecture, the /dev/dasd* block devices must be partitioned. Use the partition in the Stratis pool. For information about partitioning DASD devices, see Configuring a Linux instance on IBM Z . Procedure Erase any file system, partition table, or RAID signatures that exist on each block device that you want to use in the Stratis pool: where block-device is the path to the block device; for example, /dev/sdb . If you have not created a key set already, run the following command and follow the prompts to create a key set to use for the encryption. where key-description is a reference to the key that gets created in the kernel keyring. Create the encrypted Stratis pool and specify the key description to use for the encryption. You can also specify the key path using the --keyfile-path option instead of using the key-description option. where key-description References the key that exists in the kernel keyring, which you created in the step. my-pool Specifies the name of the new Stratis pool. block-device Specifies the path to an empty or wiped block device. You can also specify multiple block devices on a single line by using the following command: Verification Verify that the new Stratis pool was created: 23.8. Creating an encrypted Stratis pool by using the storage RHEL system role To secure your data, you can create an encrypted Stratis pool with the storage RHEL system role. In addition to a passphrase, you can use Clevis and Tang or TPM protection as an encryption method. Important You can configure Stratis encryption only on the entire pool. Prerequisites You have prepared the control node and the managed nodes You are logged in to the control node as a user who can run playbooks on the managed nodes. The account you use to connect to the managed nodes has sudo permissions on them. Procedure Store your sensitive variables in an encrypted file: Create the vault: After the ansible-vault create command opens an editor, enter the sensitive data in the <key> : <value> format: luks_password: <password> Save the changes, and close the editor. Ansible encrypts the data in the vault. Create a playbook file, for example ~/playbook.yml , with the following content: --- - name: Manage local storage hosts: managed-node-01.example.com vars_files: - vault.yml tasks: - name: Create a new encrypted Stratis pool with Clevis and Tang ansible.builtin.include_role: name: rhel-system-roles.storage vars: storage_pools: - name: mypool disks: - sdd - sde type: stratis encryption: true encryption_password: "{{ luks_password }}" encryption_clevis_pin: tang encryption_tang_url: tang-server.example.com:7500 The settings specified in the example playbook include the following: encryption_password Password or passphrase used to unlock the LUKS volumes. encryption_clevis_pin Clevis method that you can use to encrypt the created pool. You can use tang and tpm2 . encryption_tang_url URL of the Tang server. For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.storage/README.md file on the control node. Validate the playbook syntax: Note that this command only validates the syntax and does not protect against a wrong but valid configuration. Run the playbook: Verification Verify that the pool was created with Clevis and Tang configured: Additional resources /usr/share/ansible/roles/rhel-system-roles.storage/README.md file /usr/share/doc/rhel-system-roles/storage/ directory Ansible vault 23.9. Creating an encrypted Stratis pool by using the web console To secure your data, you can use the web console to create an encrypted Stratis pool from one or more block devices. When creating an encrypted Stratis pool from one or more block devices, note the following: Each block device is encrypted using the cryptsetup library and implements the LUKS2 format. Each Stratis pool can either have a unique key or share the same key with other pools. These keys are stored in the kernel keyring. The block devices that comprise a Stratis pool must be either all encrypted or all unencrypted. It is not possible to have both encrypted and unencrypted block devices in the same Stratis pool. Block devices added to the data tier of an encrypted Stratis pool are automatically encrypted. Prerequisites You have installed the RHEL 9 web console. You have enabled the cockpit service. Your user account is allowed to log in to the web console. For instructions, see Installing and enabling the web console . Stratis v2.1.0 or later is installed. The stratisd service is running. The block devices on which you are creating a Stratis pool are not in use and are not mounted. Each block device on which you are creating a Stratis pool is at least 1 GB. Procedure Log in to the RHEL 9 web console. For details, see Logging in to the web console . Click Storage . In the Storage table, click the menu button and select Create Stratis pool . In the Name field, enter a name for the Stratis pool. Select the Block devices from which you want to create the Stratis pool. Select the type of encryption, you can use a passphrase, a Tang keyserver, or both: Passphrase: Enter a passphrase. Confirm the passphrase. Tang keyserver: Enter the keyserver address. For more information, see Deploying a Tang server with SELinux in enforcing mode . Optional: If you want to specify the maximum size for each file system that is created in pool, select Manage filesystem sizes . Click Create . Verification Go to the Storage section and verify that you can see the new Stratis pool in the Devices table. 23.10. Renaming a Stratis pool by using the web console You can use the web console to rename an existing Stratis pool. Prerequisites You have installed the RHEL 9 web console. You have enabled the cockpit service. Your user account is allowed to log in to the web console. For instructions, see Installing and enabling the web console . Stratis is installed. The web console detects and installs Stratis by default. However, for manually installing Stratis, see Installing Stratis . The stratisd service is running. A Stratis pool is created. Procedure Log in to the RHEL 9 web console. For details, see Logging in to the web console . Click Storage . In the Storage table, click the Stratis pool you want to rename. On the Stratis pool page, click edit to the Name field. In the Rename Stratis pool dialog box, enter a new name. Click Rename . 23.11. Setting overprovisioning mode in Stratis file system A storage stack can reach a state of overprovision. If the file system size becomes bigger than the pool backing it, the pool becomes full. To prevent this, disable overprovisioning, which ensures that the size of all file systems on the pool does not exceed the available physical storage provided by the pool. If you use Stratis for critical applications or the root file system, this mode prevents certain failure cases. If you enable overprovisioning, an API signal notifies you when your storage has been fully allocated. The notification serves as a warning to the user to inform them that when all the remaining pool space fills up, Stratis has no space left to extend to. Prerequisites Stratis is installed. For more information, see Installing Stratis . Procedure To set up the pool correctly, you have two possibilities: Create a pool from one or more block devices: By using the --no-overprovision option, the pool cannot allocate more logical space than actual available physical space. Set overprovisioning mode in the existing pool: If set to "yes", you enable overprovisioning to the pool. This means that the sum of the logical sizes of the Stratis file systems, supported by the pool, can exceed the amount of available data space. Verification Run the following to view the full list of Stratis pools: Check if there is an indication of the pool overprovisioning mode flag in the stratis pool list output. The " ~ " is a math symbol for "NOT", so ~Op means no-overprovisioning. Optional: Run the following to check overprovisioning on a specific pool: 23.12. Binding a Stratis pool to NBDE Binding an encrypted Stratis pool to Network Bound Disk Encryption (NBDE) requires a Tang server. When a system containing the Stratis pool reboots, it connects with the Tang server to automatically unlock the encrypted pool without you having to provide the kernel keyring description. Note Binding a Stratis pool to a supplementary Clevis encryption mechanism does not remove the primary kernel keyring encryption. Prerequisites Stratis v2.3.0 or later is installed. For more information, see Installing Stratis . The stratisd service is running. You have created an encrypted Stratis pool, and you have the key description of the key that was used for the encryption. For more information, see Creating an encrypted Stratis pool . You can connect to the Tang server. For more information, see Deploying a Tang server with SELinux in enforcing mode . Procedure Bind an encrypted Stratis pool to NBDE: where my-pool Specifies the name of the encrypted Stratis pool. tang-server Specifies the IP address or URL of the Tang server. Additional resources Configuring automated unlocking of encrypted volumes using policy-based decryption 23.13. Binding a Stratis pool to TPM When you bind an encrypted Stratis pool to the Trusted Platform Module (TPM) 2.0, the system containing the pool reboots, and the pool is automatically unlocked without you having to provide the kernel keyring description. Prerequisites Stratis v2.3.0 or later is installed. For more information, see Installing Stratis . The stratisd service is running. You have created an encrypted Stratis pool. For more information, see Creating an encrypted Stratis pool . Procedure Bind an encrypted Stratis pool to TPM: where my-pool Specifies the name of the encrypted Stratis pool. key-description References the key that exists in the kernel keyring, which was generated when you created the encrypted Stratis pool. 23.14. Unlocking an encrypted Stratis pool with kernel keyring After a system reboot, your encrypted Stratis pool or the block devices that comprise it might not be visible. You can unlock the pool using the kernel keyring that was used to encrypt the pool. Prerequisites Stratis v2.1.0 is installed. For more information, see Installing Stratis . The stratisd service is running. You have created an encrypted Stratis pool. For more information, see Creating an encrypted Stratis pool . Procedure Re-create the key set using the same key description that was used previously: where key-description references the key that exists in the kernel keyring, which was generated when you created the encrypted Stratis pool. Verify that the Stratis pool is visible: 23.15. Unbinding a Stratis pool from supplementary encryption When you unbind an encrypted Stratis pool from a supported supplementary encryption mechanism, the primary kernel keyring encryption remains in place. This is not true for pools that are created with Clevis encryption from the start. Prerequisites Stratis v2.3.0 or later is installed on your system. For more information, see Installing Stratis . You have created an encrypted Stratis pool. For more information, see Creating an encrypted Stratis pool . The encrypted Stratis pool is bound to a supported supplementary encryption mechanism. Procedure Unbind an encrypted Stratis pool from a supplementary encryption mechanism: where my-pool specifies the name of the Stratis pool you want to unbind. Additional resources Binding an encrypted Stratis pool to NBDE Binding an encrypted Stratis pool to TPM 23.16. Starting and stopping Stratis pool You can start and stop Stratis pools. This gives you the option to dissasemble or bring down all the objects that were used to construct the pool, such as file systems, cache devices, thin pool, and encrypted devices. Note that if the pool actively uses any device or file system, it might issue a warning and not be able to stop. The stopped state is recorded in the pool's metadata. These pools do not start on the following boot, until the pool receives a start command. Prerequisites Stratis is installed. For more information, see Installing Stratis . The stratisd service is running. You have created either an unencrypted or an encrypted Stratis pool. See Creating an unencrypted Stratis pool or Creating an encrypted Stratis pool . Procedure Use the following command to start the Stratis pool. The --unlock-method option specifies the method of unlocking the pool if it is encrypted: Alternatively, use the following command to stop the Stratis pool. This tears down the storage stack but leaves all metadata intact: Verification Use the following command to list all pools on the system: Use the following command to list all not previously started pools. If the UUID is specified, the command prints detailed information about the pool corresponding to the UUID: 23.17. Creating a Stratis file system Create a Stratis file system on an existing Stratis pool. Prerequisites Stratis is installed. For more information, see Installing Stratis . The stratisd service is running. You have created a Stratis pool. See Creating an unencrypted Stratis pool or Creating an encrypted Stratis pool . Procedure Create a Stratis file system on a pool: where number-and-unit Specifies the size of a file system. The specification format must follow the standard size specification format for input, that is B, KiB, MiB, GiB, TiB or PiB. my-pool Specifies the name of the Stratis pool. my-fs Specifies an arbitrary name for the file system. For example: Example 23.1. Creating a Stratis file system Verification List file systems within the pool to check if the Stratis file system is created: Additional resources Mounting a Stratis file system 23.18. Creating a file system on a Stratis pool by using the web console You can use the web console to create a file system on an existing Stratis pool. Prerequisites You have installed the RHEL 9 web console. You have enabled the cockpit service. Your user account is allowed to log in to the web console. For instructions, see Installing and enabling the web console . The stratisd service is running. A Stratis pool is created. Procedure Log in to the RHEL 9 web console. For details, see Logging in to the web console . Click Storage . Click the Stratis pool on which you want to create a file system. On the Stratis pool page, scroll to the Stratis filesystems section and click Create new filesystem . Enter a name for the file system. Enter a mount point for the file system. Select the mount option. In the At boot drop-down menu, select when you want to mount your file system. Create the file system: If you want to create and mount the file system, click Create and mount . If you want to only create the file system, click Create only . Verification The new file system is visible on the Stratis pool page under the Stratis filesystems tab. 23.19. Mounting a Stratis file system Mount an existing Stratis file system to access the content. Prerequisites Stratis is installed. For more information, see Installing Stratis . The stratisd service is running. You have created a Stratis file system. For more information, see Creating a Stratis file system . Procedure To mount the file system, use the entries that Stratis maintains in the /dev/stratis/ directory: The file system is now mounted on the mount-point directory and ready to use. 23.20. Setting up non-root Stratis file systems in /etc/fstab using a systemd service You can manage setting up non-root file systems in /etc/fstab using a systemd service. Prerequisites Stratis is installed. See Installing Stratis . The stratisd service is running. You have created a Stratis file system. See Creating a Stratis file system . Procedure As root, edit the /etc/fstab file and add a line to set up non-root file systems: Additional resources Persistently mounting file systems

Commands:
dnf install stratisd stratis-cli
systemctl enable --now stratisd
wipefs --all block-device
stratis pool create my-pool block-device
stratis pool create my-pool block-device-1 block-device-2
stratis pool list
wipefs --all block-device
stratis key set --capture-key key-description
stratis pool create --key-desc key-description my-pool block-device
stratis pool create --key-desc key-description my-pool block-device-1 block-device-2
stratis pool list
ansible-vault create vault.yml New Vault password: <vault_password> Confirm New Vault password: <vault_password>
luks_password: <password>
--- - name: Manage local storage hosts: managed-node-01.example.com vars_files: - vault.yml tasks: - name: Create a new encrypted Stratis pool with Clevis and Tang ansible.builtin.include_role: name: rhel-system-roles.storage vars: storage_pools: - name: mypool disks: - sdd - sde type: stratis encryption: true encryption_password: "{{ luks_password }}" encryption_clevis_pin: tang encryption_tang_url: tang-server.example.com:7500
ansible-playbook --ask-vault-pass --syntax-check ~/playbook.yml
ansible-playbook --ask-vault-pass ~/playbook.yml
ansible managed-node-01.example.com -m command -a 'sudo stratis report' "clevis_config": { "thp": "j-G4ddvdbVfxpnUbgxlpbe3KutSKmcHttILAtAkMTNA", "url": "tang-server.example.com:7500" }, "clevis_pin": "tang", "in_use": true, "key_description": "blivet-mypool",
stratis pool create --no-overprovision pool-name /dev/sdb
stratis pool overprovision pool-name <yes|no>
stratis pool list Name Total Physical Properties UUID Alerts pool-name 1.42 TiB / 23.96 MiB / 1.42 TiB ~Ca,~Cr,~Op cb7cb4d8-9322-4ac4-a6fd-eb7ae9e1e540
stratis pool overprovision pool-name yes stratis pool list Name Total Physical Properties UUID Alerts pool-name 1.42 TiB / 23.96 MiB / 1.42 TiB ~Ca,~Cr,~Op cb7cb4d8-9322-4ac4-a6fd-eb7ae9e1e540
stratis pool bind nbde --trust-url my-pool tang-server
stratis pool bind tpm my-pool key-description
stratis key set --capture-key key-description
stratis pool list
stratis pool unbind clevis my-pool
stratis pool start pool-uuid --unlock-method <keyring|clevis>
stratis pool stop pool-name
stratis pool list
stratis pool list --stopped --uuid UUID
stratis filesystem create --size number-and-unit my-pool my-fs
stratis filesystem create --size 10GiB pool1 filesystem1
stratis fs list my-pool
mount /dev/stratis/ my-pool / my-fs mount-point
/dev/stratis/ my-pool/my-fs mount-point xfs defaults,x-systemd.requires=stratis-fstab-setup@ pool-uuid .service,x-systemd.after=stratis-fstab-setup@ pool-uuid .service dump-value fsck_value