Download KVM for IBM z Systems

Author: m | 2025-04-24

Exercise 2 - KVM for IBM z System Installation. Unit 3- KVM for IBM z System Post-Installation Task. Day 2. Exercise 3 - KVM for IBM z System Post-Installation Task. Unit 4 - KVM for IBM z

KVM for IBM z Systems

KVM for IBM Z® and LinuxONE is an open-source alternative to the IBM z/VM hypervisor for the virtualization of Linux® workloads on IBM Z and IBM LinuxONE systems. Faced with rising data demands and security concerns, Kernel-based Virtual Machine (KVM) open-source virtualization can help you to effectively meet these demands on your IBM Z and LinuxONE systems. KVM’s flexibility as a hypervisor, coupled with its open-source nature makes it a perfect choice for virtualization. KVM on IBM Z and LinuxONE on Blogspot Browse KVM documentation to learn how to get started, find news and get hints about running KVM on IBM Z and LinuxONE. Benefits Standardizes configuration and operation Promotes operational standardization through its architecture-agnostic characteristics, which make it compatible with platforms such as IBM Z and LinuxONE. Enables confidential computing Provides confidential computing for VMs based on IBM® Secure Execution for Linux for maximum security. Leverages common Linux administration skills Provides a standard set of Linux tools and interfaces that offer a common user experience across various platforms, making it easy for clients looking for trained staff to administrate their KVM deployments. Features Security Using IBM Secure Execution IBM Secure Execution protects the data of workloads that run in a KVM and safeguards VMs from inspection, modification or compromise by other VMs or the KVM administrator. Explore IBM Secure Execution for Linux High availability Live virtual server migration Live virtual server migration enables the relocation of Linux guests around the KVM cluster without affecting the virtual server. Explore Live Virtual Server Migrate Infrastructure management Simplified infrastructure management Get simplified infrastructure-as-a-service management for the virtual infrastructure that is based on Red Hat® KVM. Explore IBM Cloud® Infrastructure Center Security Extensive use of encryption KVM supports the on-chip crypto acceleration and the Crypto Express adapter available with the IBM Z and LinuxONE platforms. Explore IBM® Crypto Express features Use cases Server consolidation Consolidate servers with KVM on the highly scalable IBM Z and LinuxONE systems to get high-density savings in terms of power consumption and floor space. Explore sustainability with IBM z16™ Explore sustainability with IBM LinuxONE 4 Confidential computing Protect digital assets by hosting them with KVM on IBM Z and LinuxONE, using IBM® Hyper Protect Virtual Servers for easy-to-use on-prem deployments. Explore Hyper Protect Virtual Servers Resources KVM on IBM Z See documentation on how to set up, configure and operate Linux as a guest of the KVM hypervisor. KVM as included with Red Hat Enterprise Linux Explore how Red Hat Enterprise Linux can run in the mainframe environment as virtualized by the KVM hypervisor. KVM as included with SUSE Linux Enterprise Server Learn how SUSE Linux Enterprise Server can run in the mainframe environment as virtualized by the

with KVM for IBM z Systems

KVM hypervisor. KVM as included with Canonical Ubuntu Explore how Canonical Ubuntu Server can run in the mainframe environment as virtualized by the KVM hypervisor. Red Hat OpenShift Container Platform on IBM LinuxONE Install a Red Hat OpenShift Container Platform by using minimum requirements and KVM hypervisor provided by Red Hat Enterprise Linux. Related products IBM Cloud Infrastructure Center Leverage lifecycle management for the virtual infrastructure provided by Cloud Infrastructure Center, based on Red Hat KVM (and IBM z/VM) and enabled by the automation of infrastructure services. IBM z16 Use IBM z16 as a hardware platform for KVM to take advantage of capabilities such as high performance, high availability, high scalability and security. IBM LinuxONE 4 Choose IBM LinuxONE 4 as a hardware platform for KVM to maximize the benefits of scalability, sustainability, superior performance and advanced security features. IBM Hyper Protect Virtual Servers Attain easy deployment of Secure Execution guests for digital assets use cases and scale the deployment of isolated workloads protected by Confidential Computing. IBM z/VM Use an operating system with highly secure and scalable hypervisor and virtualization technology designed to run Linux, z/OS®, z/VSE® and z/TPF virtual machines, as well as Red Hat® OpenShift® on IBM Z and LinuxONE servers.

Introducing KVM for IBM z Systems

The zipl command and reboot your system. KVM hosts that successfully start with support for IBM® Secure Execution for Linux issue the following kernel message: prot_virt: Reserving MB as ultravisor base storage. To verify that the KVM host now supports IBM® Secure Execution, run the following command: # cat /sys/firmware/uv/prot_virt_host The value of this attribute is 1 for Linux instances that detect their environment as consistent with that of a secure host. For other instances, the value is 0. Add your host keys to the KVM guest via Ignition. During the first boot, RHCOS looks for your host keys to re-encrypt itself with them. RHCOS searches for files starting with ibm-z-hostkey- in the /etc/se-hostkeys directory. All host keys, for each machine the cluster is running on, must be loaded into the directory by the administrator. After first boot, you cannot run the VM on any other machines. You need to prepare your Ignition file on a safe system. For example, another IBM® Secure Execution guest. For example: { "ignition": { "version": "3.0.0" }, "storage": { "files": [ { "path": "/etc/se-hostkeys/ibm-z-hostkey-.crt", "contents": { "source": "data:;base64," }, "mode": 420 }, { "path": "/etc/se-hostkeys/ibm-z-hostkey-.crt", "contents": { "source": "data:;base64," }, "mode": 420 } ] }}``` You can add as many host keys as required if you want your node to be able to run on multiple IBM Z® machines. To generate the Base64 encoded string, run the following command: base64 .crt Compared to guests not running IBM® Secure Execution, the first boot of the machine is longer because the entire image is encrypted with a randomly generated LUKS passphrase before the Ignition phase. Add Ignition protection To protect the secrets that are stored in the Ignition config file from being read or even modified, you must encrypt the Ignition config file. To achieve the desired security, Ignition logging and local login are disabled by default when running IBM® Secure Execution. Fetch the public GPG key for the secex-qemu.qcow2 image and encrypt the Ignition config with the key by running the following command: gpg --recipient-file /path/to/ignition.gpg.pub --yes --output /path/to/config.ign.gpg --verbose --armor --encrypt /path/to/config.ign Follow the. Exercise 2 - KVM for IBM z System Installation. Unit 3- KVM for IBM z System Post-Installation Task. Day 2. Exercise 3 - KVM for IBM z System Post-Installation Task. Unit 4 - KVM for IBM z Introduction to KVM for z Decem IBM now has three strategic virtualization platforms: IBM z/VM, IBM PR/SM, and KVM for IBM z Systems. KVM for IBM z

KVM for IBM z Systems and LinuxONE

OpenShift Container Platform 4.17Installing OpenShift Container Platform on IBM Z and IBM LinuxONERed Hat OpenShift Documentation TeamAbstract This document describes how to install OpenShift Container Platform on IBM Z and IBM LinuxONE. Chapter 1. Installation methods You can install an OpenShift Container Platform cluster on IBM Z® and IBM® LinuxONE using a variety of different installation methods. Each method has qualities that can make them more suitable for different use cases, such as installing a cluster in a disconnected environment or installing a cluster with minimal configuration and provisioning. While this document refers only to IBM Z®, all information in it also applies to IBM® LinuxONE. 1.1. Choosing a method to install OpenShift Container Platform on IBM Z or IBM LinuxONE The OpenShift Container Platform installation program offers the following methods for deploying a cluster on IBM Z®: Interactive: You can deploy a cluster with the web-based Assisted Installer. This method requires no setup for the installer, and is ideal for connected environments like IBM Z®. Local Agent-based: You can deploy a cluster locally with the Agent-based Installer. It provides many of the benefits of the Assisted Installer, but you must download and configure the Agent-based Installer first. Configuration is done with a command line interface (CLI). This approach is ideal for disconnected networks. Full control: You can deploy a cluster on infrastructure that you prepare and maintain, which provides maximum customizability. You can deploy clusters in connected or disconnected environments. Table 1.1. IBM Z(R) installation options Assisted InstallerAgent-based InstallerUser-provisioned installationInstaller-provisioned installation IBM Z® with z/VM ✓ ✓ ✓ Restricted network IBM Z® with z/VM ✓ ✓ IBM Z® with RHEL KVM ✓ ✓ ✓ Restricted network IBM Z® with RHEL KVM ✓ ✓ IBM Z® in an LPAR ✓ Restricted network IBM Z® in an LPAR ✓ For more information about the installation process, see the Installation process. 1.2. User-provisioned infrastructure installation of OpenShift Container Platform on IBM Z User-provisioned infrastructure requires the user to provision all resources required by OpenShift Container Platform. The steps for performing a user-provisioned infrastructure installation are provided as an example only. Installing a

KVM for IBM z Systems prerequisites

Sufficient compute resources. Resource sharing is one of the key strengths of IBM Z®. However, you must adjust the capacity correctly on each hypervisor layer and ensure that there are sufficient resources for every OpenShift Container Platform cluster. Since the overall performance of the cluster can be impacted, the LPARs that are used to set up the OpenShift Container Platform clusters must provide sufficient compute capacity. In this context, LPAR weight management, entitlements, and CPU shares on the hypervisor level play an important role. For more information, see "Recommended host practices for IBM Z & IBM LinuxONE environments". IBM Z operating system requirementsTable 2.4. Operating system requirements z/VMLPARRHEL KVM Hypervisor One instance of z/VM 7.2 or later IBM® z14 or later with DPM or PR/SM One LPAR running on RHEL 8.6 or later with KVM, which is managed by libvirt OpenShift Container Platform control plane machines Three guest virtual machines Three LPARs Three guest virtual machines OpenShift Container Platform compute machines Two guest virtual machines Two LPARs Two guest virtual machines Temporary OpenShift Container Platform bootstrap machine One machine One machine One machine IBM Z network connectivityTable 2.5. Network connectivity requirements z/VMLPARRHEL KVM Network Interface Card (NIC) One single z/VM virtual NIC in layer 2 mode - - Virtual switch (vSwitch) z/VM VSWITCH in layer 2 Ethernet mode - - Network adapter Direct-attached OSA, RoCE, or HiperSockets Direct-attached OSA, RoCE, or HiperSockets A RHEL KVM host configured with OSA, RoCE, or HiperSockets Either a RHEL KVM host that is configured to use bridged networking in libvirt or MacVTap to connect the network to the guests. See Types of virtual network connections. Disk storageTable 2.6. Disk storage requirements z/VMLPARRHEL KVM Fibre Connection (FICON) z/VM minidisks, fullpack minidisks, or dedicated DASDs, all of which must be formatted as CDL, which is the default. To reach the minimum required DASD size for Red Hat Enterprise Linux CoreOS (RHCOS) installations, you need extended address volumes (EAV). If available, use HyperPAV to ensure optimal performance. Dedicated DASDs that must be formatted as CDL, which is the default. To reach the minimum required DASD size for

KVM for IBM z Systems - Your.org

Using IBM® Secure Execution before proceeding to the fast-track installation. 2.6.7.1. Installing RHCOS using IBM Secure Execution Before you install RHCOS using IBM® Secure Execution, you must prepare the underlying infrastructure. Prerequisites IBM® z15 or later, or IBM® LinuxONE III or later. Red Hat Enterprise Linux (RHEL) 8 or later. You have a bootstrap Ignition file. The file is not protected, enabling others to view and edit it. You have verified that the boot image has not been altered after installation. You must run all your nodes as IBM® Secure Execution guests. Procedure Prepare your RHEL KVM host to support IBM® Secure Execution. By default, KVM hosts do not support guests in IBM® Secure Execution mode. To support guests in IBM® Secure Execution mode, KVM hosts must boot in LPAR mode with the kernel parameter specification prot_virt=1. To enable prot_virt=1 on RHEL 8, follow these steps: Navigate to /boot/loader/entries/ to modify your bootloader configuration file *.conf. Add the kernel command line parameter prot_virt=1. Run the zipl command and reboot your system. KVM hosts that successfully start with support for IBM® Secure Execution for Linux issue the following kernel message: prot_virt: Reserving MB as ultravisor base storage. To verify that the KVM host now supports IBM® Secure Execution, run the following command: # cat /sys/firmware/uv/prot_virt_host The value of this attribute is 1 for Linux instances that detect their environment as consistent with that of a secure host. For other instances, the value is 0. Add your host keys to the KVM guest via Ignition. During the first boot, RHCOS looks for your host keys to re-encrypt itself with them. RHCOS searches for files starting with ibm-z-hostkey- in the /etc/se-hostkeys directory. All host keys, for each machine the cluster is running on, must be loaded into the directory by the administrator. After first boot, you cannot run the VM on any other machines. You need to prepare your Ignition file on a safe system. For example, another IBM® Secure Execution guest. For example: { "ignition": { "version": "3.0.0" }, "storage": { "files": [ { "path": "/etc/se-hostkeys/ibm-z-hostkey-.crt", "contents": { "source": "data:;base64," }, "mode":. Exercise 2 - KVM for IBM z System Installation. Unit 3- KVM for IBM z System Post-Installation Task. Day 2. Exercise 3 - KVM for IBM z System Post-Installation Task. Unit 4 - KVM for IBM z