BigFix Inventory Red Hat OpenShift Virtualization

Purpose

Red Hat OpenShift Virtualization, a feature included with Red Hat OpenShift, provides a platform for running and deploying virtual machine (VM) workloads.

Attention: Only bare metal (physical) worker nodes are supported.

Collecting capacity data

Note: ServiceAccount created for the BigFix Inventory VM Manager Tool requires cluster-wide permissions to:

virtualmachineinstances
nodes

Configure the Red Hat Open Shift cluster:
1. Create a ServiceAccount for the BigFix Inventory VM Manager Tool by using the YAML configuration below. Apply it through the + button in the Open Shift Web Console or with the oc apply the command:
```
apiVersion: v1
kind: ServiceAccount
metadata:
  name: <SERVICE_ACCOUNT_NAME> 
  namespace: <SERVICE_ACCOUNT_NAMESPACE>
```
2. Create a token for the newly created ServiceAccount by using the YAML configuration below:
```
apiVersion: v1
kind: Secret
metadata:
  name: bfi-service-account-token
  namespace: <SERVICE_ACCOUNT_NAMESPACE>
  annotations:
    kubernetes.io/service-account.name: <SERVICE_ACCOUNT_NAME>
type: kubernetes.io/service-account-token
```
3. Assign the necessary permissions to the previously created ServiceAccount by using the YAML configuration below:
```
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: bfi-cluster-nodes-list
rules:
  - verbs:
      - list
    apiGroups:
      - ''
    resources:
      - nodes
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: bfi-cluster-nodes-list
subjects:
  - kind: ServiceAccount
    name: <SERVICE_ACCOUNT_NAME>
    namespace: <SERVICE_ACCOUNT_NAMESPACE> 
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: bfi-cluster-nodes-list
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: bfi-cluster-virtualmachineinstance-list
rules:
  - verbs:
      - list
    apiGroups:
      - kubevirt.io
    resources:
      - virtualmachineinstances
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: bfi-cluster-virtualmachineinstance-list
subjects:
  - kind: ServiceAccount
    name: <SERVICE_ACCOUNT_NAME> 
    namespace: <SERVICE_ACCOUNT_NAMESPACE>
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: bfi-cluster-virtualmachineinstance-list
```
  Note: Replace <SERVICE_ACCOUNT_NAME> with the name of your service account and <SERVICE_ACCOUNT_NAMESPACE> with a namespace in which the service account is created.
Since it is not possible to retrieve all the information required for subcapacity license calculation, such as processor type or the number of worker node sockets, it is necessary to either:
- Define a pair of custom node labels in each and every node that is a virtual machine's hypervisor:
  - ibm.ilmt.sockets_count - containing the number of sockets
  - ibm.ilmt.cpu-model.vendor_id - with possible values of AMD/Intel
- Install and configure a Node Feature Discovery (Red Hat provided, and not Community Edition) add-on to your cluster to automatically add a set of the following node labels to all your nodes:
  - feature.node.kubernetes.io/cpu-model.vendor_id
  - feature.node.kubernetes.io/ibm.ilmt.socket_count
  The first label is added automatically without any additional configuration of this add-on, immediately after installing the 'NodeFeatureDiscoverie' operand from the 'Node Feature Discovery' operator. However, to add a second label, an additional custom resource of the NodeFeatureRule type needs to be added. To do so, use the following YAML configuration:
```
apiVersion: nfd.openshift.io/v1alpha1
kind: NodeFeatureRule
metadata:
  name: ibm.ilmt.capacity-sockets
  namespace: openshift-nfd
spec:
  rules:
    - name: "ibm.ilmt.capacity-sockets"
      labelsTemplate: |
        {{ range .cpu.topology }}ibm.ilmt.{{ .Name }}={{ .Value }}
        {{ end }}
      matchFeatures:
        - feature: cpu.topology
          matchExpressions:
            socket_count: {op: Exists}
```
If the processor type or the number of sockets on a worker node cannot be detected, a default value of 120 PVUs per core will be used to calculate the PVU license consumption for applications installed on virtual machines running on that node.
To obtain the Service Account Token, follow these steps:
- Go to Workload > Secrets and search for ilmt-service-account-token.
- In the Secret details, locate the token in the Data section and copy it from there.
  
  Note: Do not copy the token from the YAML tab, as this token is encoded in Base64 and it will not work.
To obtain the Cluster API address:
- Go to Home > Overview.
- In the Details widget, search for Cluster API address. For example: api.test.hcl.com:6443.
Configure the BigFix Inventory server:
- For Central VM Manager Tool - Create a VM Manager connection as described in Adding VM managers in central mode.
- For Distributed VM Manager Tool - Create a VM Manager connection as described in Adding VM managers in distributed mode.

Supported versions

For information about supported versions, refer to Supported managed devices.