Appendix B. Understanding the luks_tang_inventory.yml file B.1. Configuration parameters for disk encryption hc_nodes (required) A list of hyperconverged hosts that uses the back-end FQDN of the host, and the configuration details of those hosts. Configuration that is specific to a host is defined under that host's back-end FQDN. Configuration that is common to all hosts is defined in the vars: section. blacklist_mpath_devices (optional) By default, Red Hat Virtualization Host enables multipath configuration, which provides unique multipath names and worldwide identifiers for all disks, even when disks do not have underlying multipath configuration. Include this section if you do not have multipath configuration so that the multipath device names are not used for listed devices. Disks that are not listed here are assumed to have multipath configuration available, and require the path format /dev/mapper/<WWID> instead of /dev/sdx when defined in subsequent sections of the inventory file. On a server with four devices (sda, sdb, sdc and sdd), the following configuration blacklists only two devices. The path format /dev/mapper/<WWID> is expected for devices not in this list. gluster_infra_luks_devices (required) A list of devices to encrypt and the encryption passphrase to use for each device. devicename The name of the device in the format /dev/sdx . passphrase The password to use for this device when configuring encryption. After disk encryption with Network-Bound Disk Encryption (NBDE) is configured, a new random key is generated, providing greater security. rootpassphrase (required) The password that you used when you selected Encrypt my data during operating system installation on this host. rootdevice (required) The root device that was encrypted when you selected Encrypt my data during operating system installation on this host. networkinterface (required) The network interface this host uses to reach the NBDE key server. ip_version (required) Whether to use IPv4 or IPv6 networking. Valid values are IPv4 and IPv6 . There is no default value. Mixed networks are not supported. ip_config_method (required) Whether to use DHCP or static networking. Valid values are dhcp and static . There is no default value. The other valid value for this option is static , which requires the following additional parameters and is defined individually for each host: gluster_infra_tangservers The address of your NBDE key server or servers, including http:// . If your servers use a port other than the default (80), specify a port by appending :_port_ to the end of the URL. B.2. Example luks_tang_inventory.yml Dynamically allocated IP addresses Static IP addresses

Commands:
hc_nodes: hosts: host1backend.example.com: [configuration specific to this host] host2backend.example.com: host3backend.example.com: host4backend.example.com: host5backend.example.com: host6backend.example.com: vars: [configuration common to all hosts]
hc_nodes: hosts: host1backend.example.com: blacklist_mpath_devices: - sdb - sdc
hc_nodes: hosts: host1backend.example.com: gluster_infra_luks_devices: - devicename: /dev/sdb passphrase: Str0ngPa55#
hc_nodes: hosts: host1backend.example.com: rootpassphrase: h1-Str0ngPa55#
hc_nodes: hosts: host1backend.example.com: rootdevice: /dev/sda2
hc_nodes: hosts: host1backend.example.com: networkinterface: ens3s0f0
hc_nodes: vars: ip_version: IPv4
hc_nodes: vars: ip_config_method: dhcp
hc_nodes: hosts: host1backend.example.com : ip_config_method: static host_ip_addr: 192.168.1.101 host_ip_prefix: 24 host_net_gateway: 192.168.1.100 host2backend.example.com : ip_config_method: static host_ip_addr: 192.168.1.102 host_ip_prefix: 24 host_net_gateway: 192.168.1.100 host3backend.example.com : ip_config_method: static host_ip_addr: 192.168.1.102 host_ip_prefix: 24 host_net_gateway: 192.168.1.100
hc_nodes: vars: gluster_infra_tangservers: - url: http:// key-server1.example.com - url: http:// key-server2.example.com : 80
hc_nodes: hosts: host1-backend.example.com : blacklist_mpath_devices: - sda - sdb - sdc gluster_infra_luks_devices: - devicename: /dev/sdb passphrase: dev-sdb-encrypt-passphrase - devicename: /dev/sdc passphrase: dev-sdc-encrypt-passphrase rootpassphrase: host1-root-passphrase rootdevice: /dev/sda2 networkinterface: eth0 host2-backend.example.com : blacklist_mpath_devices: - sda - sdb - sdc gluster_infra_luks_devices: - devicename: /dev/sdb passphrase: dev-sdb-encrypt-passphrase - devicename: /dev/sdc passphrase: dev-sdc-encrypt-passphrase rootpassphrase: host2-root-passphrase rootdevice: /dev/sda2 networkinterface: eth0 host3-backend.example.com : blacklist_mpath_devices: - sda - sdb - sdc gluster_infra_luks_devices: - devicename: /dev/sdb passphrase: dev-sdb-encrypt-passphrase - devicename: /dev/sdc passphrase: dev-sdc-encrypt-passphrase rootpassphrase: host3-root-passphrase rootdevice: /dev/sda2 networkinterface: eth0 vars: ip_version: IPv4 ip_config_method: dhcp gluster_infra_tangservers: - url: http:// key-server1.example.com :80 - url: http:// key-server2.example.com :80
hc_nodes: hosts: host1-backend.example.com : blacklist_mpath_devices: - sda - sdb - sdc gluster_infra_luks_devices: - devicename: /dev/sdb passphrase: dev-sdb-encrypt-passphrase - devicename: /dev/sdc passphrase: dev-sdc-encrypt-passphrase rootpassphrase: host1-root-passphrase rootdevice: /dev/sda2 networkinterface: eth0 host_ip_addr: host1-static-ip host_ip_prefix: network-prefix host_net_gateway: default-network-gateway host2-backend.example.com : blacklist_mpath_devices: - sda - sdb - sdc gluster_infra_luks_devices: - devicename: /dev/sdb passphrase: dev-sdb-encrypt-passphrase - devicename: /dev/sdc passphrase: dev-sdc-encrypt-passphrase rootpassphrase: host2-root-passphrase rootdevice: /dev/sda2 networkinterface: eth0 host_ip_addr: host1-static-ip host_ip_prefix: network-prefix host_net_gateway: default-network-gateway host3-backend.example.com : blacklist_mpath_devices: - sda - sdb - sdc gluster_infra_luks_devices: - devicename: /dev/sdb passphrase: dev-sdb-encrypt-passphrase - devicename: /dev/sdc passphrase: dev-sdc-encrypt-passphrase rootpassphrase: host3-root-passphrase rootdevice: /dev/sda2 networkinterface: eth0 host_ip_addr: host1-static-ip host_ip_prefix: network-prefix host_net_gateway: default-network-gateway vars: ip_version: IPv4 ip_config_method: static gluster_infra_tangservers: - url: http:// key-server1.example.com :80 - url: http:// key-server2.example.com :80