Installation and configuration steps

Login into Azure and OpenShift cluster

From Azure VM, login into Azure with the command az login

Note: Logging into Azure connects you to your default subscription by default. If you have multiple subscriptions, ensure you switch to the correct context before connecting to ARO cluster.

From Azure VM, login into Azure Red Hat OpenShift (ARO) cluster with the command oc login

Example of Linux login script:


# Define your variables
RESOURCE_GROUP="<ARO cluster resource group name>"
CLUSTER_NAME="<ARO cluster name>"

# Retrieve the admin password
ADMIN_PW=$(az aro list-credentials \
  --name $CLUSTER_NAME \
  --resource-group $RESOURCE_GROUP \
  --query "kubeadminPassword" -o tsv)

# Retrieve the API server URL
API_URL=$(az aro show \
  --name $CLUSTER_NAME \
  --resource-group $RESOURCE_GROUP \
  --query "apiserverProfile.url" -o tsv)

# ARO login
oc login $API_URL -u kubeadmin -p $ADMIN_PW

Create portworx namespace

On the ARO cluster, create the portworx namespace:

oc create namespace portworx

Enable user‑workload monitoring for Portworx

Create the cluster-monitoring-config ConfigMap in openshift-monitoring namespace. This lets OpenShift monitoring scrape Portworx metrics.

Create cluster-monitoring-config.yaml file:


apiVersion: v1
kind: ConfigMap
metadata:
  name: cluster-monitoring-config
  namespace: openshift-monitoring
data:
  config.yaml: |
    enableUserWorkload: true

and apply it:


oc apply -f cluster-monitoring-config.yaml

Install Portworx Operator on ARO cluster

Log into the ARO web console.
Go to OperatorHub (Ecosystem → Software Catalog), search for Portworx Operator, select it, and click on Install.
Choose “A specific namespace on the cluster” and create/select the portworx namespace.
Optional - for the Console plugin, choose Enable to get the Portworx console inside the ARO UI.
Click Install to deploy the operator into portworx namespace.

Configure multipath and udev rules on ARO worker nodes

Create multipath.conf file for Everpure Cloud Dedicated array (example configuration file is here) and set:

○ Disable user‑friendly names: user_friendly_names no

○ Set: find_multipaths no (each controller has a single path)
Create udev rules file to set appropriate queue depth and tuning per Linux with Everpure Cloud Dedicated recommendations here.

Create an OpenShift MachineConfig file with base64‑encoded contents of those two files:


# Example how to create single-line base64 for MachineConfig

base64 -w0 multipath.conf
base64 -w0 udev.rules

MachineConfig file (98-worker-pure-multipath.yaml) with base64 output of previous command inserted:


apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  name: 98-worker-pure-multipath
  labels:
    machineconfiguration.openshift.io/role: worker
spec:
  config:
    ignition:
      version: 3.2.0
    storage:
      files:
      - path: /etc/multipath.conf
        mode: 0644
        contents:
          source: data:text/plain;charset=utf-8;base64,<insert base64-multipath-conf>
      - path: /etc/udev/rules.d/99-pure-storage.rules
        mode: 0644
        contents:
          source: data:text/plain;charset=utf-8;base64,<insert base64-udev-rules>
    systemd:
      units:
      - name: iscsid.service
        enabled: true
      - name: multipathd.service
        enabled: true

Apply the MachineConfig file and wait for all worker nodes to roll.


oc apply -f 98-worker-pure-multipath.yaml 

# watch worker pool update/merge
oc get mcp

After the roll-out is finished, verify the configuration is applied to all worker nodes (verify that multipath.conf and udev rules are applied.):


# 1) Get node name
oc get nodes

# 2) Start a debug pod on that node and chroot into the host
oc debug node/<worker-node-name> -T -- chroot /host

# Check config files 
cat /etc/multipath.conf 
cat /etc/udev/rules.d/99-pure-storage.rules 

# Check services (ensure iscsid and multipathd services are enabled and restarted on workers)
systemctl restart iscsid 
systemctl restart multipathd
systemctl status iscsid 
systemctl status multipathd

Create Everpure Cloud Dedicated user and API token

Create user and configure API token for PX-CSI driver connection to the Everpure Cloud Dedicated array.

Create a user with Storage Admin role (or an equivalent realm‑scoped role in secure multi‑tenancy setups).
Generate an API token for this user.
If using secure multi‑tenancy:

○ Create realm, pod, and management‑access policy objects.

○ Associate the user with that policy.

○ Generate an API token scoped to the correct realm/pod.

Build pure.json configuration file for PX-CSI

Create a pure.json file describing the Everpure Cloud Dedicated array(s) for PX‑CSI driver, for example:


{
  "FlashArrays": [
    {
      "MgmtEndPoint": "<pure-storage-cloud-dedicated-management-endpoint-IP>",
      "APIToken": "<pure-storage-cloud-dedicated-api-token>"
    }
  ]
}

Note:

For secure multi‑tenancy, include a Realm (and if needed, Pod) field in each array entry.
If you want topology‑aware provisioning, you can add topology labels in pure.json file and plan to label Kubernetes nodes accordingly (e.g. availability zone / rack).

Create the px-pure-secret in ARO cluster

Create a secret from pure.json file in the namespace where PX‑CSI is installed:


oc create secret generic px-pure-secret \
  --namespace <px-csi-namespace> \
  --from-file=pure.json=/path/to/pure.json

Important: The secret name must be px-pure-secret — PX‑CSI will look for that name by default.

Verify connectivity from ARO nodes to Everpure Cloud Dedicated

Login to ARO worker nodes and verify if Everpure Cloud Dedicated iSCSI endpoint is reachable:


# 1) Get node name
oc get nodes

# 2) Start a debug pod on that node and chroot into the host
oc debug node/<worker-node-name> -T -- chroot /host

# 3) Discover targets from a worker node
iscsiadm -m discovery -t st -p <pure-storage-cloud-dedicated-iscsi-interface-endpoint>

# 4) Confirm unique initiator per worker node
cat /etc/iscsi/initiatorname.iscsi

# 5) If you need to set a new initiator name:
echo "InitiatorName=`/sbin/iscsi-iname`" > /etc/iscsi/initiatorname.iscsi
systemctl restart iscsid

Generate the PX-CSI StorageCluster spec (Portworx Central)

Use Portworx Central to get a correct ARO-flavoured StorageCluster spec file:

Go to Portworx Central → Spec List → Create New Spec → PX-CSI.
On **Generate PX-CSI Spec** fill following information:

○ PX-CSI Version: choose a supported release (e.g. 26.1.x).

○ Namespace: the namespace where the Portworx Operator is already installed (e.g. portworx).

○ Distribution Name: Azure Red Hat OpenShift (ARO)+ if exposed, otherwise generic OpenShift is fine (the YAML is valid for both).

○ Access type: Block Storage

○ Storage Area Network Type: iSCSI

○ Optionally Install Prometheus if you want CSI metrics.

Leave other fields with their defaults.
Click Save and Download to get the StorageCluster manifest file.

Apply PX-CSI StorageCluster manifest on ARO cluster

Important:

Ensure the operator is present (you have this already, but for completeness):

ARO UI → Ecosystem → Software Catalog → search Portworx Operator → Install into portworx namespace.

Ensure px-pure-secret is created in the portworx namespace

Apply the PX-CSI StorageCluster YAML file into the cluster:


# if operator + px-pure-secret are in "portworx"
oc project portworx
oc apply -f px-csi-storagecluster.yaml

The Storage Cluster will be created with name like px-cluster-xxxxxxxx-..., monitor Storage Cluster status in ARO UI until the status will be "Running".

PX-CSI auto-discovers Everpure Cloud Dedicated credentials. After the Storage Cluster is created, PX-CSI will:

Read px-pure-secret in its namespace.
Parse pure.json file (FlashArrays list).
Use those Everpure Cloud Dedicated endpoints + token to manage storage volumes.