HPE 3PAR Driver for OpenStack Manila¶
The HPE 3PAR driver provides NFS and CIFS shared file systems to OpenStack using HPE 3PAR’s File Persona capabilities.
For information on HPE 3PAR Driver for OpenStack Manila, refer to content kit page.
HPE 3PAR File Persona Software Suite concepts and terminology¶
The software suite comprises the following managed objects:
- File Provisioning Groups (FPGs)
- Virtual File Servers (VFSs)
- File Stores
- File Shares
The File Persona Software Suite is built upon the resilient mesh-active
architecture of HPE 3PAR StoreServ and benefits from HPE 3PAR storage
foundation of wide-striped logical disks and autonomic
Common Provisioning Groups (CPGs). A CPG can be shared between file and
block to create the File Shares or the logical unit numbers (LUNs) to
provide true convergence.
A File Provisioning Group (FPG) is an instance of the HPE intellectual
property Adaptive File System. It controls how files are stored and retrieved.
Each FPG is transparently constructed from one or multiple
Virtual Volumes (VVs) and is the unit for replication and disaster recovery
for File Persona Software Suite. There are up to 16 FPGs supported on a
node pair.
A Virtual File Server (VFS) is conceptually like a server. As such, it
presents virtual IP addresses to clients, participates in user authentication
services, and can have properties for such things as user/group quota
management and antivirus policies. Up to 16 VFSs are supported on a node pair,
one per FPG.
File Stores are the slice of a VFS and FPG at which snapshots are taken,
capacity quota management can be performed, and antivirus scan service
policies customized. There are up to 256 File Stores supported on a node pair,
16 File Stores per VFS.
File Shares are what provide data access to clients via SMB, NFS, and the
Object Access API, subject to the share permissions applied to them. Multiple
File Shares can be created for a File Store and at different directory levels
within a File Store.
Operations supported¶
Create a share.
– Share is not accessible until access rules allow access.
Delete a share.
Allow share access.
Note the following limitations:
– IP access rules are required for NFS share access.
– User access rules are not allowed for NFS shares.
– User access rules are required for SMB share access.
– User access requires a File Persona local user for SMB shares.
– Shares are read/write (and subject to ACLs).
Deny share access.
Create a snapshot.
Delete a snapshot.
Create a share from a snapshot.
Extend a share.
Shrink a share.
Share networks.
HPE 3PAR File Persona driver can be configured to work with or without share networks. When using share networks, the HPE 3PAR driver allocates an FSIP on the back end FPG (VFS) to match the share network’s subnet and segmentation ID. Security groups associated with share networks are ignored.
Operations not supported¶
- Manage and unmanage
- Manila Experimental APIs (consistency groups, replication, and migration) were added in Mitaka but have not yet been implemented by the HPE 3PAR File Persona driver.
Requirements¶
On the OpenStack host running the Manila share service:
- python-3parclient version 4.2.0 or newer from PyPI.
On the HPE 3PAR array:
- HPE 3PAR Operating System software version 3.2.1 MU3 or higher.
- The array class and hardware configuration must support File Persona.
Pre-configuration on the HPE 3PAR StoreServ¶
The following HPE 3PAR CLI commands show how to set up the HPE 3PAR StoreServ to use File Persona with OpenStack Manila. HPE 3PAR File Persona must be initialized, and started on the HPE 3PAR storage.
cli% startfs 0:2:1 1:2:1
cli% setfs nodeip -ipaddress 10.10.10.11 -subnet 255.255.240.0 0
cli% setfs nodeip -ipaddress 10.10.10.12 -subnet 255.255.240.0 1
cli% setfs dns 192.168.8.80,127.127.5.50 foo.com,bar.com
cli% setfs gw 10.10.10.10
A File Provisioning Group (FPG) must be created for use with the Shared File Systems service.
cli% createfpg examplecpg examplefpg 18TA Virtual File Server (VFS) must be created on the FPG.
The VFS must be configured with an appropriate share export IP address.
cli% createvfs -fpg examplefpg 10.10.10.101 255.255.0.0 examplevfsA local user in the Administrators group is needed for CIFS (SMB) shares.
cli% createfsgroup fsusers cli% createfsuser –passwd <password> -enable true -grplist Users,Administrators –primarygroup fsusers fsadmin
The WSAPI with HTTP and/or HTTPS must be enabled and started.
cli% setwsapi -https enable cli% startwsapi
Driver options¶
The following table contains the configuration options specific to the share driver.
| Configuration option = Default value | Description |
|---|---|
| [DEFAULT] | |
hpe3par_api_url = |
(String) 3PAR WSAPI Server Url like https://<3par ip>:8080/api/v1 |
hpe3par_cifs_admin_access_domain = LOCAL_CLUSTER |
(String) File system domain for the CIFS admin user. |
hpe3par_cifs_admin_access_password = |
(String) File system admin password for CIFS. |
hpe3par_cifs_admin_access_username = |
(String) File system admin user name for CIFS. |
hpe3par_debug = False |
(Boolean) Enable HTTP debugging to 3PAR |
hpe3par_fpg = None |
(Unknown) The File Provisioning Group (FPG) to use |
hpe3par_fstore_per_share = False |
(Boolean) Use one filestore per share |
hpe3par_password = |
(String) 3PAR password for the user specified in hpe3par_username |
hpe3par_require_cifs_ip = False |
(Boolean) Require IP access rules for CIFS (in addition to user) |
hpe3par_san_ip = |
(String) IP address of SAN controller |
hpe3par_san_login = |
(String) Username for SAN controller |
hpe3par_san_password = |
(String) Password for SAN controller |
hpe3par_san_ssh_port = 22 |
(Port number) SSH port to use with SAN |
hpe3par_share_mount_path = /mnt/ |
(String) The path where shares will be mounted when deleting nested file trees. |
hpe3par_username = |
(String) 3PAR username with the ‘edit’ role |
HPE 3PAR Manila driver configuration example¶
The following parameters shows a sample subset of the manila.conf file,
which configures two backends and the relevant [DEFAULT] options. A real
configuration would include additional [DEFAULT] options and additional
sections that are not discussed in this document. In this example, the
backends are using different FPGs on the same array:
[DEFAULT]
enabled_share_backends = HPE1,HPE2
enabled_share_protocols = NFS,CIFS
default_share_type = default
[HPE1]
share_backend_name = HPE3PAR1
share_driver = manila.share.drivers.hpe.hpe_3par_driver.HPE3ParShareDriver
driver_handles_share_servers = False
max_over_subscription_ratio = 1
hpe3par_fpg = examplefpg,10.10.10.101
hpe3par_san_ip = 10.20.30.40
hpe3par_api_url = https://10.20.30.40:8080/api/v1
hpe3par_username = <username>
hpe3par_password = <password>
hpe3par_san_login = <san_username>
hpe3par_san_password = <san_password>
hpe3par_debug = False
hpe3par_cifs_admin_access_username = <fs_admin>
hpe3par_cifs_admin_access_password = <fs_password>
[HPE2]
share_backend_name = HPE3PAR2
share_driver = manila.share.drivers.hpe.hpe_3par_driver.HPE3ParShareDriver
driver_handles_share_servers = False
max_over_subscription_ratio = 1
hpe3par_fpg = examplefpg2,10.10.10.102
hpe3par_san_ip = 10.20.30.40
hpe3par_api_url = https://10.20.30.40:8080/api/v1
hpe3par_username = <username>
hpe3par_password = <password>
hpe3par_san_login = <san_username>
hpe3par_san_password = <san_password>
hpe3par_debug = False
hpe3par_cifs_admin_access_username = <fs_admin>
hpe3par_cifs_admin_access_password = <password>
Network approach¶
Network connectivity between the storage array (SSH/CLI and WSAPI) and the Manila host is required for share management. Network connectivity between the clients and the VFS is required for mounting and using the shares. This includes:
- Routing from the client to the external network.
- Assigning the client an external IP address, for example a floating IP.
- Configuring the Shared File Systems service host networking properly for IP forwarding.
- Configuring the VFS networking properly for client subnets.
- Configuring network segmentation, if applicable.
In the OpenStack Kilo release, the HPE 3PAR driver did not support share networks. Share access from clients to HPE 3PAR shares required external network access (external to OpenStack) and was set up and configured outside of Manila.
In the OpenStack Liberty release, the HPE 3PAR driver could run with or
without share networks. The configuration option
driver_handles_share_servers``( ``True or False ) indicated whether
share networks could be used. When set to False, the HPE 3PAR driver
behaved as described earlier for Kilo. When set to True, the share
network’s subnet, segmentation ID and IP address range were used to allocate
an FSIP on the HPE 3PAR. There is a limit of four FSIPs per VFS. For clients
to communicate with shares via this FSIP, the client must have access to the
external network using the subnet and segmentation ID of the share network.
For example, the client must be routed to the neutron provider network with external access. The Manila host networking configuration and network switches must support the subnet routing. If the VLAN segmentation ID is used, communication with the share will use the FSIP IP address. Neutron networking is required for HPE 3PAR share network support. Flat and VLAN provider networks are supported, but the HPE 3PAR driver does not support share network security groups.
Implementation characteristics¶
Shares from snapshots
- When a share is created from a snapshot, the share must be deleted before the snapshot can be deleted. This is enforced by the driver.
- A snapshot of an empty share will appear to work correctly, but
attempting to create a share from an empty share snapshot may fail with
an
NFS Create exporterror. - HPE 3PAR File Persona snapshots are for an entire File Store. In Manila,
they appear as snapshots of shares. A share sub-directory is used to
give the appearance of a share snapshot when using
create share from snapshot.
Snapshots
- For HPE 3PAR File Persona, snapshots are per File Store and not per share. So, the HPE 3PAR limit of 1024 snapshots per File Store results in a Manila limit of 1024 snapshots per tenant on each back end FPG.
- Before deleting a share, you must delete its snapshots. This is enforced by Manila. For HPE 3PAR File Persona, this also kicks off a snapshot reclamation.
Size enforcement
Manila users create shares with size limits. HPE 3PAR enforces size limits by using File Store quotas. When using
hpe3par_fstore_per_share``= ``True``(the non-default setting) there is only one share per File Store, so the size enforcement acts as expected. When using ``hpe3par_fstore_per_share=False(the default), the HPE 3PAR Manila driver uses one File Store for multiple shares. In this case, the size of the File Store limit is set to the cumulative limit of its Manila share sizes. This can allow one tenant share to exceed the limit and affect the space available for the same tenant’s other shares. One tenant cannot use another tenant’s File Store.File removal
When shares are removed and the
hpe3par_fstore_per_share``=``Falsesetting is used (the default), files may be left behind in the File Store. Prior to Mitaka, removal of obsolete share directories and files that have been stranded would require tools outside of OpenStack/Manila. In Mitaka and later, the driver mounts the File Store to remove the deleted share’s subdirectory and files. For SMB/CIFS share, it requires thehpe3par_cifs_admin_access_usernameandhpe3par_cifs_admin_access_passwordconfiguration. If the mount and delete cannot be performed, an error is logged and the share is deleted in Manila. Due to the potential space held by leftover files, File Store quotas are not reduced when shares are removed.Multi-tenancy
Network
The
driver_handles_share_serversconfiguration setting determines whether share networks are supported. Whendriver_handles_share_serversis set toTrue, a share network is required to create a share. The administrator creates share networks with the desired network, subnet, IP range, and segmentation ID. The HPE 3PAR is configured with an FSIP using the same subnet and segmentation ID and an IP address allocated from the neutron network. Using share network-specific IP addresses, subnets, and segmentation IDs give the appearance of better tenant isolation. Shares on an FPG, however, are accessible via any of the FSIPs (subject to access rules). Back end filtering should be used for further separation.Back end filtering
A Manila HPE 3PAR back end configuration refers to a specific array and a specific FPG. With multiple backends and multiple tenants, the scheduler determines where shares will be created. In a scenario where an array or back end needs to be restricted to one or more specific tenants, share types can be used to influence the selection of a back end. For more information on using share types, see Share types .
Tenant limit
The HPE 3PAR driver uses one File Store per tenant per protocol in each configured FPG. When only one back end is configured, this results in a limit of eight tenants (16 if only using one protocol). Use multiple back end configurations to introduce additional FPGs on the same array to increase the tenant limit.
When using share networks, an FSIP is created for each share network (when its first share is created on the back end). The HPE 3PAR supports 4 FSIPs per FPG (VFS). One of those 4 FSIPs is reserved for the initial VFS IP, so the share network limit is 48 share networks per node pair.
Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.