Use pxctl with security enabled on ARO

Summary and Key concepts

Summary:

This article guides administrators on how to set up pxctl contexts for Portworx clusters with PX-Security enabled. It provides steps for retrieving an admin token and setting up the pxctl context on individual nodes of a Kubernetes or OpenShift cluster. The process involves retrieving the admin token, finding the relevant Portworx pod, and executing commands within the Portworx container using kubectl or oc. Additionally, administrators are reminded that the pxctl context must be refreshed whenever the token expires (24 hours by default) and are provided with a link to documentation on customizing token lifetimes.

Kubernetes Concepts:

• Context
• Pods

Portworx Concepts:

• PX-Security
• pxctl CLI
• Customizing Security
• Cluster Token

Once a storage cluster with PX-Security enabled is running, a cluster admin must set up a pxctl context on each node in order to interact with the system.

The following steps will guide a storage admin to setup pxctl contexts on each node.

1. Retrieve the admin token from the namespace in which Portworx was installed and store it in the ADMIN_TOKEN variable:

   ADMIN_TOKEN=$(oc -n portworx get secret px-admin-token --template='{{index .data "auth-token" | base64decode}}')

2. Find the Portworx pod that is running on the node in which the admin wants to interact with:

   Find the node name.

   oc get nodes

   Now, save the node name in the variable.

   K8_NODE_NAME=kubernetes-worker-3.mylab.lan

   Once the node name is known, run the command below. Ensure that Portworx is installed in the correct namespace. In the below command, it is assumed to be installed in portworx.

   PX_POD=$(oc -n portworx get pods -l name=portworx -o jsonpath="{.items[?(@.spec.nodeName == '$K8_NODE_NAME')].metadata.name}")

3. Save the admin token in the pxctl context for that pod:

   oc -n portworx exec -ti $PX_POD -- /opt/pwx/bin/pxctl context create admin --token=$ADMIN_TOKEN

4. Use oc exec to access the Portworx container and perform any pxctl operations:

   oc -n portworx exec -ti $PX_POD -- /opt/pwx/bin/pxctl status

note

This pxctl context will need to be refreshed every time the token expires. This is 24 hours by default, but this default can be changed. See customizing security for more information.