New Features in 5.2.2

INSTALL & UPGRADE
- Automatic Upgrade of Drive Firmware
NETWORKING
- Open Telemetry-Based Ethernet Network Monitoring
ENCRYPTION
- TLS Cipher Restrictions
QUALITY OF SERVICE (QOS)
- Monitoring of Open S3 Connections
NFS
- Support for NFS RPC-over-TLS

Automatic Upgrade of Drive Firmware

VMS automatically checks the firmware on newly discovered QLC drives in DBoxes and EBoxes and upgrades it so that all drives in the cluster have their firmware versions aligned. The upgrade is performed prior to activating the drives as part of cluster deployment, expansion or field replacement procedures.

Automatic firmware upgrade is supported for the following drives:

Intel P4326 15TB on Mavericks/MLK
Solidigm/Intel P5316 15TB, 30TB on Ceres, Mavericks/MLK and EBoxes
Solidigm/Intel P5316 15TB E1.L on EBoxes
Solidigm P5336 15TB, 30TB, 61TB on Ceres and Mavericks/MLK and EBoxes

Note
The firmware version installed as a result of the automatic upgrade may be not the latest firmware version available at the drive manufacturer.

The following limitation applies:

Automatic drive FW upgrade is not performed on drives that have been moved manually from an old DBox to a new DBox during the DBox replacement procedure. (Note that this does not apply to EBoxes.)

This feature is enabled by default. You can alter its status as follows:

In VAST CLI:
- The new cluster set-drive-fw-upgrade command
- The --auto-drive-fw-upgrade option on the cluster create command
In VAST REST API:
- The new /clusters/{id}/set_drive_fw_upgrade/ endpoint

The progress and outcome of automatic driver firmware upgrade can be monitored in the Activities page of VAST Web UI.

Open Telemetry-Based Ethernet Network Monitoring

VAST Cluster 5.2.2 offers new metrics, alarms and analytics for cluster's network and switch monitoring. The monitoring is based on Open Telemetry (OTel) metrics collected from the cluster switches, such as:

Transmit/receive bandwidth
Amount of physical layer errors
BGP connection state
Amount of packets dropped due to exceeding the ARP packet policer limit
Amount of packets dropped within the switch due to lack of transmit/receive buffers for high-priority/low-priority traffic
Overall amount of discarded receive packets for high-priority traffic
Amount of paused transmit/receive packets for the high-priority traffic
Utilization (%) of switch transmit and receive buffers allocated to high-priority/low-priority traffic

VMS automatically discovers connected switches that have OTel configured (e.g. are sending telemetry data over gRPC to the VMS IP address using port 4317). A newly discovered OTel-enabled switch appears in the Switches page of VAST Web UI with the Unknown state. The cluster admin must right-click the switch entry and supply the username and password configured on the switch, after which VMS displays the switch state and other details.

To access the network monitoring analytics in VAST Web UI, go to Analytics -> Analytics and in the Predefined Analytics tab, click Switch and select one of the predefined reports. It is recommended to enable Intersampling mode when viewing the analytics.

Alarms are raised in case the switch metrics exceed the thresholds. Note that VMS reports rate-type switch alarms at every 10 minutes. This means that the underlying event could have occurred any time within the 10-minute period prior to the rate-type alarm raised.

Switch metrics can be exported using the /api/prometheusmetrics/switches endpoint of VAST Prometheus Exporter.

The following requirements and limitations apply:

Up to 70 switches per cluster
The switch must have OTel configured to send telemetry data over gRPC to the VMS IP address using port 4317.
TLS on the connection used to obtain the metrics from the switch is not supported.

TLS Cipher Restrictions

VAST Cluster 5.2.2 can restrict use of TLS ciphers based on the cluster's configuration settings. The restriction can be applied to VAST Web UI access, as well as to S3 and NFS workloads.

As a prerequisite, the cluster must be configured to have TLS v1.3 enforced.

When the cipher restriction is in force, only the TLS_AES_256_GCM_SHA384 cipher suite is accepted for S3 and NFS workloads, and also for VAST Web UI access.

To configure the cluster for cipher restriction:

For S3 and NFS workloads, contact VAST Support.
For VAST Web UI access:
1. To enforce use of TLS v1.3 on the cluster, run the vms modify --min-tls-version 1.3 command in VAST CLI.
2. To accept the TLS_AES_256_GCM_SHA384 cipher only, run the vms set_ssl_ciphers TLS_AES_256_GCM_SHA384 command.

Monitoring of Open S3 Connections

VMS can report the current number of open S3 connections for each user that has a QoS policy with an S3 connection limit set.

A user query returns a new field that indicates the amount of open S3 connections for the user. To access this field:

In VAST Web UI, open the User Details dialog for the user you want (User Management -> Users -> run a query -> right-click the user and select View or Edit) and look for the S3 Connections Count field.
In VAST CLI, run the user query command and look for the s3_connections_count field in the output.

The VAST Prometheus Exporter offers a new endpoint, /api/prometheusmetrics/user_connections, that lets you list top N users with largest number of open S3 connections (up to 100 users).

Support for NFS RPC-over-TLS

VAST Cluster 5.2.2 adds support for RPC over TLS, a protocol that enables encryption of in-transit Remote Procedure Call (RPC) transactions through the use of TLS. NFSv3 and NFSv4 clients can establish RPC-over-TLS sessions against the VAST NFS server by using the xprtsec=tls mount option.

To enable RPC-over-TLS support on your VAST cluster, contact VAST Support.

The following requirements apply:

TLS v1.3 is required. The cluster needs to be configured to allow TLS 1.3 for NFS (contact VAST Support to verify).
The TLS certificate and key must be uploaded to the cluster (in VAST Web UI: Settings -> Certificates -> choose NFS in the Certificate for field).

To allow for smooth use of RPC-over-TLS with the existing view policy option that sets the cluster to require TLS for all NFS connections, the following setting has been added to skip TLS enforcement in case the NFS connection is established using one of auxiliary NFSv3 protocols (such as MOUNT, NLM, NSM, RQUOTA, NFSACL):

In VAST Web UI, the Relaxed TLS enforcement flag in view policy settings (Element Store -> View Policies -> choose to create or edit a view policy -> NFS tab)
In VAST CLI, the --enable-nfs-enforce-tls-relaxed and --disable-nfs-enforce-tls-relaxed options on the viewpolicy create and viewpolicy modify commands.