view modify

Prev Next

This command modifies a view.

General Usage

view modify --id VIEW_ID
            [--path PATH]
            [--protocols PROTOCOLS] 
            [--alias ALIAS]
            [--share SHARE]
            [--policy-id ID]
            [--cluster-id ID]
            [--create-dir]
            [--enable-live-monitoring|--disable-live-monitoring]
            [--enable-s3-unverified-lookup]|--disable-s3-unverified-lookup
            [--s3-versioning]
            [--locking]
            [--default-retention-period DEFAULT_RETENTION_PERIOD]
            [--s3-locks-retention-mode NONE|GOVERNANCE|COMPLIANCE]
            [--bucket BUCKET]
            [--bucket-owner BUCKET_OWNER]
            [--bucket-creators BUCKET_CREATORS]
            [--bucket-creators-groups BUCKET_CREATORS_GROUPS]
            [--allow-s3-anonymous-access]|[--block-s3-anonymous-access]
            [--qos-policy-id QOS_POLICY_ID]
            [--delete_qos_policy]
            [--enable-acls|--disable-acls]
            [--enable-share-acl]|[--disable-share-acl]
            [--clear-share-acl]
            [--share-ace-grantee users|groups]
            [--share-ace-permissions FULL|READ|CHANGE]
            [--share-ace-identifier IDENTIFIER]
            [--remove-share-ace-name NAME --remove-share-ace-fqdn FQDN]
            [--abe-protocols [SMB]]
            [--abe-max-depth LEVEL]
            [--max-retention-period MAX_RETENTION_PERIOD]
            [--min-retention-period MIN_RETENTION_PERIOD]
            [--auto-commit AUTO_COMMIT]

Share-Level ACL Usage

To enable or disable share-level ACL on the view:

view modify --id VIEW_ID --enable-share-acl|--disable-share-acl

 To add an ACE to the view's share-level ACL:

view modify --id VIEW_ID
            --share-ace-grantee users|groups
            --share-ace-identifier IDENTIFIER
            --share-ace-permissions FULL|READ|CHANGE

To clear all ACEs from the view's share-level ACL:

view modify --id VIEW_ID
            --clear-share-acl

To remove an ACE:

view modify --id VIEW_ID
            --remove-share-ace-name NAME
            --remove-share-ace-fqdn FQDN

Required Parameters

--id VIEW_ID

Specifies the ID of the view you want to modify.

Options

--path PATH

Modifies the Element Store path to be exposed to clients. It can be a directory that was already created by a client inside an exposed parent directory, or it can be a new directory, in which case you must specify the --create_dir option to create the directory.

Example:

--path /a/b/c

--protocols PROTOCOLS

Specifies which protocol(s) the view will be exposed to.

Specify PROTOCOLS as a string value for a single protocol or a comma separated list of strings to enable multiple protocols. Valid string values are:

  • NFS. To expose the view as an NFS export to clients using NFS version 3.

  • NFS4. To expose the view as an NFS export to clients using NFS version 4.1.

  • SMB  (Not in combination with ENDPOINT).  To expose the view as an SMB share to SMB clients.

  • S3 (Not in combination with ENDPOINT). To expose the view as an S3 bucket.

  • ENDPOINT (Not in combination with SMB or S3). To create an S3 Endpoint, which is a template for creating buckets via S3 APIs. Whenever a bucket is created using this endpoint, a new view is created under the specified path. See Managing S3 Request-Initiated Bucket Creation for more information about S3 Endpoint buckets.

  • DATABASE. To expose the view as a VAST database. This option is used for each view that VAST Cluster creates when a user chooses to create a database on the cluster. For more information, see  Configuring the VAST Cluster for Database Access.

Examples:

--protocols NFS,SMB

--protocols NFS,NFS4,ENDPOINT

--protocols NFS,S3

--protocols SMB

--protocols DATABASE

--alias ALIAS

For NFSv3 exports, specifies an alternative shorter name for the path that can be used alternatively when mounting. Optional and relevant only if the view is exposed to NFS. An alias must begin with a forward slash ("/") and must consist of only ASCII characters.

An NFS export alias must be unique within the tenant.

--share SHARE

Specifies the SMB share name. Required if the view is exposed to SMB. The name cannot include the following characters: /\:|<>*?"

An SMB share name must be unique within the tenant.

--policy-id ID

Specifies which view policy to apply. If unspecified, the default policy (ID 1) is used.

--create-dir

Creates a directory at the specified path. Include this option of the directory does not already exist.

--enable-live-monitoring

Enables live monitoring on the view. Live monitoring can be enabled for up to ten views at one time.

Analytics data for views is polled every 5 minutes by default and every 10 seconds with live monitoring.

--disable-live-monitoring

Disables live monitoring on the view. See also --enable-live-monitoring.

--s3-versioning

Enables object versioning on the bucket if S3 is specified in --protocols.

--locking

Enables  object locking on the view bucket, if S3 is specified in --protocols, or file locking in NFSv3/SMB, if they are selected in --protocols. This setting can't be disabled after the view is created.

--s3-locks-retention-mode NONE|GOVERNANCE|COMPLIANCE

Sets a default retention mode for objects in the bucket.

Possible values:

  • NONE (default).  Object versions that are placed in the bucket have no automatic protection but can be configured with a retention period or legal hold.

  • GOVERNANCE. Object versions that are placed in the bucket are automatically protected with a retention lock with retention mode set to governance.  

  • COMPLIANCE. Object versions that are placed in the bucket are automatically protected with a retention lock with retention mode set to compliance.

--bucket BUCKETNAME

Specifies the name of an S3 bucket. Required if S3 is specified in --protocols.

A bucket name must be unique across all tenants of  the cluster.  For more guidelines on bucket naming, see Overview of the VAST Cluster S3 Implementation.Overview of the VAST Cluster S3 Implementation

--bucket-owner BUCKET_OWNER

Specifies a user to be the bucket owner. Required if S3 is specified in --protocols.

--bucket-creators BUCKET_CREATORS

Relevant if ENDPOINT is specified in --protocols. Specifies users such that any request to create an S3 bucket that is sent by S3 API by a specified user will use this S3 Endpoint view.

Specify BUCKET_CREATORS as a comma separated list of user names.

Note

Users should not be specified as bucket creators in more than one S3 Endpoint view.

--allow-anonymous-access

If the view has S3 Bucket or S3 Endpoint enabled, include this option to allow anonymous S3 access to the view's S3 bucket.

If allowed, anonymous requests are granted provided that the object ACL grants access to the All Users group (in S3 Native security flavor) or the permission mode bits on the requested file and directory path grant access permission to "others" (in NFS security flavor). For views with SMB security flavor, anonymous requests are not granted access.

--block-anonymous-access

Blocks anonymous S3 access to the view's S3 bucket, if applicable. This is the default setting.

--qos-policy-id QOS_POLICY_ID

Associates a QoS policy with the view. Specify the QoS policy by its ID. To list QoS policy definitions, use qospolicy list.

--delete-qos-policy

If a QoS policy is associated with the view, this option removes the QoS policy from the view.  

--enable-acls

When this option is specified, access to bucket objects is controlled based on ACLs rather than on the bucket owner's permissions.

This option disables S3 Object Ownership for the bucket.

--disable-acls

When this option is specified, the bucket owner has full control over any object in the bucket. Access to objects is controlled based on policies configured for the bucket. ACLs are not used.

Specifying this option is equivalent to setting the S3 object ownership rule of Bucket Owner Enforced.

--enable-share-acl

Enables share-level ACL on the view.

This setting enables share-level ACL on the view, which means that SMB requests to access the view will fail unless permission is granted to the requesting user by an ACE.

--disable-share-acl

Disables a share-level ACL on a view.

Share-level ACL is disabled by default.

--clear-share-acl

Removes all ACEs from a share-level ACL if enabled on the view, without disabling share-level ACL.

--share-ace-grantee users|groups

Specifies a grantee type when running the command to configure an Access Control Entry (ACE) in a share-level ACL.

See also Share-Level ACL Usage .

Possible values:

  • users. Specify this option when configuring an ACE for a user.

  • groups. Specify this option when configuring an ACE for a group.

--share-ace-permissions READ|CHANGE|FULL

Specifies the type of permission to grant to a specified grantee when running the command to configure an Access Control Entry (ACE) in a share-level ACL.

See also Share-Level ACL Usage .

Possible values:

  • FULL (default). Grants the grantee full control share-level access to the view.

  • READ. Grants the grantee read share-level access to the view.

  • CHANGE. Grants the grantee change share-level access to the view.

--share-ace-identifier IDENTIFIER

Specifies a grantee by SID, UID or GID identifier when running the command to configure an Access Control Entry (ACE) in a share-level ACL.

See also Share-Level ACL Usage .

Specify IDENTIFIER as the exact value of the user's or group's SID, UID or GID attribute value on the joined Active Directory domain.

To obtain an identifier, run a query by prefix against the Active Directory domain using one of the following commands:

--remove-share-ace-name NAME

Specifies the grantee name when running the command to remove an ACE from a share-level ACL.

See also Share-Level ACL Usage .

--remove-share-ace-fqdn FQDN

Specifies the domain when running the command to remove an ACE for a given from a share-level ACL.

See also Share-Level ACL Usage .

--abe-protocols SMB

Enables Access-Based Enumeration (ABE) for the view, if  SMB is specified in --protocols.

Note

To disable ABE, specify the option without the protocol keyword: --abe-protocols.

--abe-max-depth LEVEL

Sets the maximum directory level (depth) at which ABE is enabled.

--files-retention-mode NONE|GOVERNANCE|COMPLIANCE

Sets the retention mode for files saved in the view, if locking (--locking ) is enabled.

Possible values:

  • NONE (default).  Files that are saved to the view have no automatic protection but can be manually configured with a retention period or legal hold.

  • GOVERNANCE. Files that are saved in the view are automatically protected with a retention lock with retention mode set to governance.  In this mode, the retention period can be lengthened or shortened.

  • COMPLIANCE. Files that are saved in the view are automatically protected with a retention lock with retention mode set to compliance. In this mode, the retention period can be lengthened, but not shortened.

--default-retention-period DEFAULT_RETENTION

Sets the default retention period for files that are locked in the view to DEFAULT_RETENTION. Files that are locked automatically using auto-commit will be locked for this period of time, after which they will be unlocked.

Files that are locked manually (by setting the atime for the file to a future time) do not use the default retention period.

The value DEFAULT_RETENTION must be in the range between the min-retention-period and max-retention-period.

Set it as an integer value, including units (m - minutes, h - hours, d - days, y - years).

Example: 5d (5 days).

--max-retention-period MAX_RETENTION

Sets the maximum retention period for files that are locked in the view to MAX_RETENTION. Files cannot be locked for longer than this period, whether  they are locked manually (by setting the atime) or automatically, using  auto-commit.

It must be larger than the min-retention-period.

Set it as an integer value, including units (m - minutes, h - hours, d - days, y - years).

Example:  2m (2 months).

--min-retention-period MIN_RETENTION

Sets the minimum retention period for files that are locked in the view to MIN_RETENTION. Files cannot be locked for less than this period, whether locked manually (by setting the atime) or automatically, using  auto-commit.

It must be less than the max-retention-period.

Set it as an integer value, including units (m - minutes, h - hours, d - days, y - years).

Example: 3d (3 days).

--auto-commit AUTO_COMMIT

Sets the auto-commit time to AUTO_COMMIT for files that are locked automatically. These files are locked automatically after the AUTO_COMMIT period elapses from the time the file is saved. Files locked automatically are locked for the default-retention-period, after which they are unlocked.

If set, then --default-retention-period, --min-retention-period, and --max-retention-period must also be set.

Set it as an integer value, including units (m - minutes, h - hours, d - days, y - years).

Example: 5m (5 minutes).

Example

This example changes the view policy used by the view that exposes the /dev path of the element store.

vcli: admin> view modify --id 2 --path /dev --policy-id 2

This example removes an ACE from a share-level ACL:

vcli: admin>  view modify --id 101 --remove-share-ace-name joej --remove-share-ace-fqdn ad.arandomorg.com