NFS
ORION-115336: If one creates an NFSv4.1-only view and mounts it, and then creates its parent view with NFSv3 only, IO operations on the NFSv4.1-only view succeed but mounts are not allowed.
NFSv4.2
ORION-158953: NFSv4.2 security labels are not available in VAST Catalog.
NFSv3
In rare cases with large numbers of files and directories, the existence of a view with Global Synchronization enabled under a protected path can block the removal of the protected path.
SMB
ORION-169707: When the Hyper-V management tool tries to list VAST Hyper-V SMB shares on an SMB server, the
The RPC server is not availableerror can occur if the SMB server is specified using its FQDN. To avoid this error, specify the IP address of the SMB server instead of the FQDN.ORION-160323: After updating permissions for an SMB share in Windows Explorer, a duplicate SMB share can be displayed. The duplicate SMB share disappears upon a refresh (F5).
ORION-130460: VAST Cluster does not show any previous versions for a file or directory that has the same name as a file or directory that has been deleted and resides in the same directory as the deleted file or directory.
ORION-134730: An attempt to restore a file can fail if after the restore has started, a quota is set on the path where the file resides.
ORION-137905: If an application saves changes to a file by recreating the file, or when the client otherwise deletes a file or a directory and creates a new one with the same name, no previous versions can be displayed for the file or directory. To restore such a file or directory, you need to restore one of its parent directories.
S3
An object to be uploaded via a S3 presigned POST request must have only ASCII characters in its name.
A POST policy (used for S3 presigned POST requests) can be up to 4800 bytes.
ORION-175401: If a user gets renamed, for example by editing the user name in VAST Web UI, the identity policy attached to the user would still show the old user name.
ORION-190674: Once created, an S3 bucket cannot be renamed or moved to a different path. Thus, for example, if you try to change the bucket’s path when modifying a view in VAST Web UI, the change does not take effect and the view will still be listed with the old path.
ORION-143808: S3 versioning is not supported with global snapshot clones. An attempt to put a versioned object to a bucket at the global snapshot's destination path fails with an internal error.
Attribute-Based Access Control (ABAC)
ABAC is supported on views controlled with SMB and Mixed Last Wins security flavors.
ABAC is not supported with NFSv3 and S3.
ORION-167553: ABAC tags are case-sensitive. For example, tags
ABandabare considered different values, which may cause permission deny errors for the users.ORION-166268: If a user is assigned ABAC attributes that allow read/write access to an ABAC-tagged view but the associated view policy sets All Squash for the host, the host would encounter a Permission Denied error when trying to list files and directories on the view.
ORION-163697: When an SMB user accesses a file for which the user has ABAC set to read-only, a lock is placed on the file although the user does not have read/write permissions for the file.
Note
See also rules and limitations in Attribute-Based Access Control (ABAC).
Quality of Service
ORION-165483: When a user QoS policy is set to limit both bandwidth and IOPS, the sum of write metrics on two views accessed by this user can be much lower than the policy limit.
ORION-148295: QoS should be enabled on all views to avoid performance degradation issues.
VAST Catalog
The maximum path length supported by VAST Catalog is 1024 characters.
When VAST Catalog is enabled, replication is limited to two peers (group replication is not supported with VAST Catalog).
VAST Catalog must be disabled before a protected path can be deleted.
Global Access
Having Global Access and replication on the same path is not supported.
Lease expiration time can only be set when creating a global access protected path. You cannot change lease expiration time when you modify a global access path.
ORION-164710: When making capacity estimations for a directory, remote files and subdirectories are not taken into account. This means that in some cases, e.g. if local and remote capacity figures differ significantly and the remote capacity amounts to a significant portion of the overall capacity, the reported capacity and data reduction estimations can be skewed and would not reflect the real data reduction.
For example, if a parent directory contains one subdirectory with
file1andfile2, each of 2GB in logical capacity and 1GB in physical capacity, and another subdirectory with remote filesfile3andfile4, each of 100GB logical capacity and 100GB physical capacity, VAST Cluster would show the parent directory's data reduction ratio of 2:1, while the real ratio would be closer to 1:1.
VAST on Cloud
ORION-145141: Creating a tenant with EKM encryption is not supported on VoC clusters.
ORION-113036: After you reregister the same VoC cluster in Uplink, information about the previously registered instance of this cluster is no longer available in Uplink.
VAST DataSpace
VAST DataSpace requires that each cluster participating in the inter-connection is running VAST Cluster 5.0 or later.
ORION-146276: The ability to select multiple rows and perform bulk actions on them is disabled in VAST Dataspace grids in VAST Web UI.
ORION-135966: The inter-connecting clusters must have connectivity to each other through the clusters' management networks.
ORION-132073: When you remove a VoC cluster from a Multi-Cluster Manager cloud service instance (using the removal button on the cluster's card (
)), the VoC cluster is terminated. There is no option to remove a VoC cluster from Multi-Cluster Manager without also terminating it. (In the VAST Dataspace page in the VAST Web UI, the button removes the VoC cluster from VAST Dataspace and does not terminate it.)ORION-137875: In case of Multi-Cluster Manager failure, VoCs provisioned by the instance cannot be connected to a Multi-Cluster Manager instance.
Authentication & Authorization
ORION-143944: When using Kerberos/NTLM Authentication to authorize SMB users from non-trusting domains, the DOMAIN\username format cannot be used to specify users of remote domains. The username@domain format must be used instead.
ORION-134299: When the tenant is set to use Kerberos/NTLM authentication to authorize SMB users from non-trusting domains, both NFS and SMB must use the native SMB authentication (Kerberos), and not Unix-style UID/GIDs.
ORION-141763: Before enabling or disabling NTLM authentication, you need to leave the cluster's joined Active Directory domain. After NTLM authentication is enabled or disabled, rejoin the domain.
ORION-138793: After you disable use of Kerberos/NTLM Authentication to authorize users from non-trusting domains (e.g. turn off the Use native SMB authentication option in VAST Web UI tenant settings), users that previously had access, would still have access although the feature is now disabled.
The following limitations apply to Multi-Forest Authentication:
VAST Cluster does not allow adding two different Active Directory configuration records with the same domain name but different settings for multi-forest authentication and/or auto-discovery.
Names of users' domains are not displayed in data flow analytics.
If a trusted domain becomes unavailable and then recovers, SMB clients can use it to connect to the VAST cluster only after a period of time, but not immediately upon domain recovery.
Clients cannot establish SMB sessions immediately after a trusted domain recovers from a domain failure.
If a group exists on an Active Directory domain in a trusted forest and the group scope is defined as DomainLocal, VAST Cluster does not retrieve such a group when querying Active Directory, so members of such a group are denied access despite any share-level ACLs that can rule otherwise.
If TLS is enabled, the SSL certificate has to be a CA-signed certificate that is valid for all of the domain controllers in all trusted forests. If the certificate is not valid for a domain controller, this domain controller is not recognized.
ORION-156168: In a multi-forest environment, after migrating a group account from the forest of the cluster’s joined domain to another forest, information about historical group membership is not kept, so users in the migrated group might not be able to access resources to which they used to have access prior to the migration.
VAST Web UI
The following options are reserved for future use:
The Password Renewal tab in Active Directory settings (User Management -> Active Directory -> choose to create or edit an Active Directory configuration)
All options in the Optional HTTP Headers and Custom Severity panes in webhook settings (Settings -> Notifications -> Webhook Setup)
VAST CLI
The following commands and options are reserved for future use:
The
protectedpath replicate-nowcommandOptions on the
qospolicy createandqospolicy modifycommands:--use-total-limits--static-total-limits--capacity-total-limits
Options on the
activedirectory createandactivedirectory modifycommands:--enable-scheduled-ma-pwd-change--disable-scheduled-ma-pwd-change--ma-pwd-change-frequency--ma-pwd-update_time
Platform & Control
The DBox HA feature cannot be enabled on new installations of VAST Cluster 5.1.
ORION-169078: VMS does not provide an indication of the link state of the external management port on a CERES Dtray.