Mounting volumes

When you specify a volume, you attach the devices to your instance but don't mount or format the device. To mount and format the volumes when the node starts, set the optional attribute Mount to the name of the mountpoint configuration you want to use with that volume:

[[[volume reference-data]]]
Size = 100
Mount = data              # The name of the mountpoint to use with this volume

Define the mountpoint named data in the configuration section on the node:

[[[configuration cyclecloud.mounts.data]]]
mountpoint = /mount
fs_type = ext4

This configuration sets up a cyclecloud.mountpoint named data that uses all volumes with Mount = data. You format this volume with the ext4 filesystem, and it appears at /mount.

Devices

When you define volumes with a mountpoint attribute, the system automatically assigns device names for each mountpoint. However, you can customize a mountpoint with your own device names. For example:

[[node scheduler]]
  [[[configuration cyclecloud.mounts.data]]]
  mountpoint = /data
  Azure.LUN=0

In Azure, you assign devices by using Logical Unit Numbers (LUN).

In most cases, Azure CycleCloud automatically assigns devices for you. Manually specifying devices is an advanced usage. It's helpful when the image you use for your node includes volumes that the image automatically attaches. Manually specifying devices is also helpful when the order of devices matters.

Advanced usage

The previous example is a fairly simple one: mounting a single, pre-formatted snapshot to a node. However, you can use more advanced mounting techniques, including RAIDing multiple devices together, encrypting devices, and formatting new filesystems. For example, the following configuration RAIDs several volumes together and encrypts them before mounting them as a single device on a node:

[[node scheduler]]
....
  [[[volume vol1]]]
  VolumeId = vol-1234abcd
  Mount = giant

  [[[volume vol2]]]
  VolumeId = vol-5678abcd
  Mount = giant

  [[[volume vol3]]]
  VolumeId = vol-abcd1234
  Mount = giant

  [[[configuration cyclecloud.mounts.giant]]]
  mountpoint = /mnt/giant
  fs_type = xfs
  raid_level = 0
  encryption.bits = 256
  encryption.key = "0123456789abcdef9876543210"

This example shows that you attach three volumes to the node named scheduler, and their mountpoint is named giant. The configuration for the mountpoint says that you RAID these three volumes together using raid_level = 0 for RAID0, format them using the xfs filesystem, and mount the resulting device at /mnt/giant. You also use block level encryption with 256-bit AES and define the encryption key in the template.

Disk encryption

CycleCloud supports server-side encryption (SSE) for OS and data disk volumes using Azure Disk Encryption Sets. Azure uses Platform Managed Keys (PMK) by default. To use Customer Managed Keys (CMK), set up an Azure Disk Encryption Set and a Key Vault with your key. See the documentation for set up your Disk Encryption Set.

Record the Resource ID of the Disk Encryption Set when you create it. You can find this ID in the Azure portal under Properties in the Disk Encryption Sets blade.

To apply SSE with CMK to your CycleCloud node's volumes, add the following code to your [[[volume]]] definition:

DiskEncryptionSetId = /subscriptions/$SUBSCRIPTION-ID/resourceGroups/$RESOURCEGROUPNAME/providers/Microsoft.Compute/diskEncryptionSets/$DISK-ENCRYPTION-SET-NAME

For example:

[[node scheduler]]
....
  [[[volume encryptedVolume]]]
  VolumeId = vol-1234abcd
  Mount = encrypted

  # Insert your RESOURCE ID here:
  DiskEncryptionSetId = /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResouceGroup/providers/Microsoft.Compute/diskEncryptionSets/myCMKDiskEncryptionSet

  [[[configuration cyclecloud.mounts.encrypted]]]
  mountpoint = /mnt/encrypted
  fs_type = ext4
  raid_level = 0

CycleCloud 8.5 also supports Confidential disk encryption. This scheme protects all critical partitions of the disk and makes the protected disk content accessible only to the VM. Confidential disk encryption is per disk and requires the Security Encryption Type to be set to DiskWithVMGuestState.

For example, to use confidential encryption on the OS disk:

[[node scheduler]]
  [[[volume boot]]]

  ConfidentialDiskEncryptionSetId = /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResouceGroup/providers/Microsoft.Compute/diskEncryptionSets/myCMKDiskEncryptionSet
  SecurityEncryptionType = DiskWithVMGuestState

For more information, see the Volume Configuration Reference.

Mounting configuration options

Mounting configuration defaults

Use these options to set system defaults for mountpoints. The system uses these defaults unless you specify otherwise: