iSCSI Target Setup

This guide covers setting up iSCSI targets using the Linux-IO (LIO) target subsystem (targetcli) or iscsiman to expose shared block storage backends to PiVirt clusters.

Prerequisites

# Install LIO tools
apt-get install -y targetcli-fb

# Load kernel modules
modprobe target_core_mod
modprobe target_core_file
modprobe target_core_block

Create Target

Using pvcli

# Create target
pvcli storage target create \
  --iqn iqn.2024-01.hu.pilab:vm-storage \
  --alias "VM Storage Pool" \
  --portal 0.0.0.0:3260

# Add LUN
pvcli storage target lun add \
  --target iqn.2024-01.hu.pilab:vm-storage \
  --lun 1 \
  --device /dev/pivirtd-vg/vm-disk-01

Using targetcli

# Enter targetcli
targetcli

# Create backstore
/backstores/block create name=disk01 dev=/dev/pivirtd-vg/vm-disk-01

# Create target
/iscsi create iqn.2024-01.hu.pilab:vm-storage

# Create TPG
/iscsi/iqn.2024-01.hu.pilab:vm-storage/tpg1 create

# Create LUN
/iscsi/iqn.2024-01.hu.pilab:vm-storage/tpg1/luns create /backstores/block/disk01

# Create portal
/iscsi/iqn.2024-01.hu.pilab:vm-storage/tpg1/portals create 0.0.0.0 3260

# Set CHAP authentication
/iscsi/iqn.2024-01.hu.pilab:vm-storage/tpg1/set attribute authentication=1
/iscsi/iqn.2024-01.hu.pilab:vm-storage/tpg1/set auth userid=iscsi-user
/iscsi/iqn.2024-01.hu.pilab:vm-storage/tpg1/set auth password=iscsi-password

# Save configuration
saveconfig
exit

Configure Authentication

CHAP Authentication

/etc/iscsiman/config.yaml

target:
  auth:
    method: "chap"
    incoming_user: "iscsi-user"
    incoming_password_ref: "vault:secret/data/iscsi/chap#incoming"
    outgoing_user: "iscsi-target"
    outgoing_password_ref: "vault:secret/data/iscsi/chap#outgoing"

ACL Configuration

# Create initiator ACL
/iscsi/iqn.2024-01.hu.pilab:vm-storage/tpg1/acls create iqn.2024-01.hu.pilab:initiator-01

# Set CHAP for initiator
/iscsi/iqn.2024-01.hu.pilab:vm-storage/tpg1/acls/iqn.2024-01.hu.pilab:initiator-01 set auth userid=initiator-user
/iscsi/iqn.2024-01.hu.pilab:vm-storage/tpg1/acls/iqn.2024-01.hu.pilab:initiator-01 set auth password=initiator-password

ALUA Configuration

# Enable ALUA
/iscsi/iqn.2024-01.hu.pilab:vm-storage/tpg1 set attribute alua_support=1

# Create ALUA group
/iscsi/iqn.2024-01.hu.pilab:vm-storage/tpg1/alua create name=default_alua

# Set ALUA state
/iscsi/iqn.2024-01.hu.pilab:vm-storage/tpg1/alua/default_alua set alua_access_state=0

Monitoring

Check Target Status

# List targets
targetcli ls

# Check LIO status
cat /sys/kernel/config/target/iscsi/iqn.2024-01.hu.pilab:vm-storage/tpgt_1/enable

Check Sessions

# List active sessions
targetcli ls /iscsi/iqn.2024-01.hu.pilab:vm-storage/tpg1/acls

Troubleshooting

Target Not Visible

# Check target service
systemctl status target

# Check firewall
nft list ruleset | grep 3260

# Check LIO config
targetcli ls

Authentication Failed

# Verify CHAP credentials
cat /etc/target/saveconfig.json | grep -A5 auth

# Check initiator config
cat /etc/iscsi/iscsid.conf | grep -i chap

Related

• Storage Guide
• iscsiman Guide
• iSCSI Initiator Setup