In this recipe \OpenCHAMI{} uses {\em S3} to store and serve images and we need
to add configuration files that allow us to access and manage the {\em S3}
storage layer for {\em EFI} and boot image storage.


First lets install a CLI tool we can use to interact with the Minio service
% begin_ohpc_run
% ohpc_validation_comment Installing s3cmd CLI tool
\begin{lstlisting}[language=bash,keywords={}]
[sms](*\#*) (*\install*) s3cmd
\end{lstlisting}
% ohpc_validation_newline
% end_ohpc_run

Now we'll create a config file (maybe use a better passwd)
% begin_ohpc_run
% ohpc_validation_comment Setting S3cmd Config file
\begin{lstlisting}[language=bash,keywords={}]
[sms](*\#*) cat > ~/.s3cfg <<EOF
[sms](*\#*) # Setup endpoint
[sms](*\#*) host_base = ${sms_name}:9000
[sms](*\#*) host_bucket = ${sms_name}:9000
[sms](*\#*) bucket_location = us-east-1
[sms](*\#*) use_https = False
[sms](*\#*)
[sms](*\#*) # Setup access keys
[sms](*\#*) access_key = admin
[sms](*\#*) secret_key = password1234
[sms](*\#*)
[sms](*\#*) # Enable S3 v4 signature APIs
[sms](*\#*) signature_v2 = False
[sms](*\#*) EOF
\end{lstlisting}
% ohpc_validation_newline
% end_ohpc_run

Now we can use the tool to create the buckets we'll need and set ACLs to public
% begin_ohpc_run
% ohpc_validation_comment Creating S3 buckets
\begin{lstlisting}[language=bash,keywords={}]
[sms](*\#*) s3cmd mb s3://efi
[sms](*\#*) s3cmd setacl s3://efi --acl-public
[sms](*\#*) s3cmd mb s3://boot-images
[sms](*\#*) s3cmd setacl s3://boot-images --acl-public
\end{lstlisting}
% ohpc_validation_newline
% end_ohpc_run

The nodes need to be able to read from the S3 bucket without
authentication so we need to create some read policies
% begin_ohpc_run
% ohpc_validation_comment Setting S3 Bucket policies
\begin{lstlisting}[language=bash,keywords={}]
[sms](*\#*) cat > /opt/ohpc/admin/images/public-read-boot.json <<EOF
[sms](*\#*) {
[sms](*\#*)   "Version":"2012-10-17",
[sms](*\#*)   "Statement":[
[sms](*\#*)     {
[sms](*\#*)       "Effect":"Allow",
[sms](*\#*)      "Principal":"*",
[sms](*\#*)       "Action":["s3:GetObject"],
[sms](*\#*)       "Resource":["arn:aws:s3:::boot-images/*"]
[sms](*\#*)     }
[sms](*\#*)   ]
[sms](*\#*) }
[sms](*\#*) EOF
[sms](*\#*) cat > /opt/ohpc/admin/images/public-read-efi.json <<EOF
[sms](*\#*) {
[sms](*\#*)   "Version":"2012-10-17",
[sms](*\#*)   "Statement":[
[sms](*\#*)     {
[sms](*\#*)       "Effect":"Allow",
[sms](*\#*)       "Principal":"*",
[sms](*\#*)       "Action":["s3:GetObject"],
[sms](*\#*)       "Resource":["arn:aws:s3:::efi/*"]
[sms](*\#*)     }
[sms](*\#*)   ]
[sms](*\#*) }
[sms](*\#*) EOF
\end{lstlisting}
% ohpc_validation_newline
% end_ohpc_run

Lastly we can now apply these policies. Objects stored in the buckets should be "publicy" available
% begin_ohpc_run
% ohpc_validation_comment Applying S3 policies
\begin{lstlisting}[language=bash,keywords={}]
[sms](*\#*) s3cmd setpolicy /opt/ohpc/admin/images/public-read-boot.json s3://boot-images --host=${sms_ip}:9000 --host-bucket=${sms_ip}:9000
[sms](*\#*) s3cmd setpolicy /opt/ohpc/admin/images/public-read-efi.json s3://efi --host=${sms_ip}:9000 --host-bucket=${sms_ip}:9000
\end{lstlisting}
% ohpc_validation_newline
% end_ohpc_run
