Displaying Views
Displaying Views via VAST Web UI
To see the existing views configured on the cluster, select Element Store and then Views from the left navigation menu.
The following information can be displayed for each view:
Tip
To display or hide fields, click
to the right of a column title, and then click
to open a dropdown where you can select or unselect fields.
ID | The view ID, used to specify the view when running commands from the VAST CLI or performing REST API operations. |
Path | The full path from the top level of the storage system on the cluster to the location exposed by the view. |
Tenant | The tenant associated with the view. |
Alias | An alias for the mount path of an NFS export. |
SMB Share Name | For SMB shares, the share name. |
Bucket | Name of the S3 bucket used to access the view via S3, if there is one. |
S3 Bucket Owner | User name of the S3 bucket owner. |
S3 Bucket Creators | |
Policy Name | The view policy. Click the policy name to switch to the View Policies tab and view the configuration of the view policies. |
Protocols | The protocol(s) the view is exposed to. Possible values:
|
Bulk Permission Update State | Shows the status of the bulk permission update task run for this view. |
Bulk Permission Update Progress | Shows the progress of the bulk permission update task running on this view. |
S3 Versioning | Applicable if S3 Bucket is enabled. Indicates if S3 object versioning is enabled on the view. |
WORM | Indicates if WORM is enabled on the view. |
S3 Retention Mode | Applicable if S3 Bucket and S3 object locking are enabled on the view. Possible values:
|
Files Retention Mode | Shows the retention mode for files saved in the view, if file locking has been enabled for the view. Possible values:
|
Used Capacity | The amount of capacity used by the view. |
Logical Capacity | The amount of data logically written to the view directory prior to data reduction. |
Live Monitor | Indicates if live monitoring is enabled (yes) or not (no). Live monitoring can be enabled for up to ten views at one time. Analytics data for views is polled every 5 minutes by default and every 10 seconds with live monitoring. |
Creation Time | The date and time when the view was created. |
QoS Policy | If the view is associated with a QoS policy, the name of the QoS policy is displayed here. |
SMB Encryption | Shows the status of encryption of in-flight data on SMB access. |
ABE Protocols | If Access-Based Enumeration (ABE) is enabled for the view, shows SMB. No value means ABE is disabled for the view. |
ABAC | Lists ABAC tags set for the view. |
Global Synchronization | Indicates if Global Synchronization is enabled or not. Global Synchronization is an enhancement to asynchronous replication. It enables the synchronization of file handles between multiple views in a replication relationship. If this setting is enabled, then, in the event of failover to one of the destination peers in a replication group, NFSv3 clients will be able to continue working without the need to remount the view. |
User Impersonation | If the view has user impersonation enabled, indicates the impersonator user account set for the view. |
NQN | The NVMe Qualified Name (NQN) of the NVMe subsystem exposed by the view to Block protocol clients. |
Displaying Views via VAST CLI
Run the view list or view show command.
Monitoring Views
The VAST Cluster Analytics reports feature provides several metrics for monitoring views, including Quality of Service (QoS) metrics per view.
By default, views are polled for analytics data every five minutes. You can select up to ten views at any given time for live monitoring. Views that have live monitoring enabled are polled every ten seconds. You can see which views are currently being live monitored by checking the Live Monitor status of the view.
Live monitoring is a setting you can simply toggle to enable and disable for each view.
Checking Live Monitoring Status
To check whether a view has live monitoring enabled or disabled:
In VAST Web UI, select Element Store -> Views to open the Views page and review the Live Monitor value for the view.
In VAST CLI, run the
⚠️ view listview listor⚠️ view showview showcommand and in the command output, look at the value of theLive Monitoringfield for the view.
Enabling and Disabling Live Monitoring per View
To enable or disable live monitoring for a view:
In VAST Web UI:
In the left navigation menu, select Element Store and then Views.
Open the Actions menu for a view and select Toggle Live Monitoring.
This option enables live monitoring, if it was disabled, or disables live monitoring, if it was enabled.
Click Yes to confirm the action.
The view now has live monitoring enabled if live monitoring was disabled previously, or disabled if it was enabled previously. The updated status is reflected in the Live Monitor column of the Views tab.
In VAST CLI, run the
view modifycommand with the--enable-live-monitoringor--disable-live-monitoringoption specified.
Checking View Metrics in Analytics Reports
You can generate custom or predefined analytics reports with per-view metrics.
The following predefined reports are available for views, with the ability to focus on a specific view:
Views Bandwidth
Views IOPS
Views latency
QOS average wait time
With customized analytics reports, you can select specific performance and QoS properties to show for a specific view.
Creating Views
Creating a View in VAST Web UI
In the VAST Web UI, select Element Store from the left navigation menu and then select Views.
Click Create View to add a new view.
The Add View dialog appears.
In the General tab, complete the following fields:
Tenant
Select a tenant from the dropdown.
Note
This field is displayed only if the cluster has more than one tenant.
If the tenant does not have any TLS certificates associated with it, click Set Certificate below to add tenant certificates to the VMS.
Path
Enter the full path from the top level of the storage system on the cluster to the location that you want to expose.
The directory may exist already, such as if it was created by a client inside a mounted parent directory. It could also be a path to a new directory which you'll create now. (See Create new directory for the view.)
If you are going to use the path to create an S3 bucket, ensure that none of the subdirectories under the path has a replication protected path defined on it.
Note
If the path is an encrypted path, the path must be created as an encrypted path before you create the view.
Create directory
If the directory does not already exist in the file system, toggle this option on to create the directory.
Note
When creating a view on an encrypted path, do not check this box. The path is created when you create the encrypted path, before you create the view.
Inherit ACL from parent
If selected, the newly created directory will inherit the ACL of the parent directory.
If not selected, and also in case the parent directory does not have an inherited ACL, the newly created directory will be assigned an ACL granting POSIX 777 permissions.
Policy name
Specify a view policy that has the configuration you want to use for the view.
Select an existing view policy from the dropdown, or click Add new Policy to create a new one and follow the procedure described in Creating View Policies.
QoS policy
Specify a QoS policy to be associated with the view.
Select an existing QoS policy from the dropdown, or click Add New Policy to create a new one and follow the procedure described in Creating a QoS Policy).
Protocols
Select one or more protocols you want the view to be accessible from. The options are:
NFSv3 exposes the view as an NFS export to clients using NFS version 3.
NFSv4 exposes the view as an NFS export to clients using NFS version 4.1 or 4.2.
SMB exposes the view as an SMB share to SMB clients.
Note
Enabling the SMB protocol for a view requires that the tenant is associated with an Active Directory provider for which SMB is allowed.
Block exposes the view as a block storage subsystem. You cannot enable any other protocols together with the block access protocol.
S3 Bucket exposes the view as an S3 bucket.
S3 Endpoint creates a template for creating buckets via S3 APIs. Whenever a bucket is created using this endpoint, a new view is created under the specified path. See Managing S3 Request-Initiated Bucket Creation for more information about S3 Endpoint buckets.
You can enable NFSv3 and/or NFSv4 together with S3 Endpoint. In this case, the view path is exported for NFS access while multiple S3 buckets may also be created under the view path.
This option is supported on the default tenant only.
Database exposes tabular data to database query engines. This value is used for each view that VAST Cluster creates when a user chooses to create a database on the cluster. For more information, see Configuring the VAST Cluster for Database Access.
Kafka exposes VAST Database tables that are used as topics to publish and consume events. For more information, see Publishing Events to VAST Event Broker.
When you select Kafka, the Database and S3 Bucket protocols are also automatically enabled.
Warning
If you deselect (disable) a protocol that was previously enabled for the view, the view settings related to this protocol are not preserved.
S3 bucket name
If you selected S3 Bucket in the Protocols dropdown, enter a name for the bucket in the S3 Bucket Name field. This setting is required for S3 buckets.
A bucket name must be unique across all tenants of the cluster. For more guidelines on bucket naming, see Overview of VAST Cluster S3 Implementation.
NFS alias
If you selected NFSv3 in the Protocols dropdown to enable NFSv3 access, you can use the NFS alias field to optionally specify a shorter alias for the mount path of the NFSv3 export.
An alias must begin with a forward slash ("/") and must consist of only ASCII characters.
An NFS export alias must be unique within the tenant.
SMB share name
If you selected SMB in the Protocols dropdown, enter a name for the SMB share in the SMB share name field. This setting is required for SMB.
The SMB share name cannot include the following characters: /\:|<>*?"
An SMB share name must be unique within the tenant.
Always Collect Metrics
Select to ensure that metrics are collected from this view even when the view has low IO activity. If this option is not set, the view may be excluded from VAST cluster analytics due to its low activity.
If the Policy name field was set to a view policy that enforces the S3 Native security flavor, choose one of the S3 object ownership modes in the ACLs pane:
ACLs enabled (default). The user which uploads the object, becomes the object owner. Access is authorized based on ACLs and identity or bucket policies.
ACLs disabled. The bucket owner has full control over any object in the bucket. Access to objects is authorized based on identity and bucket policies. ACLs are not used, neither for S3 nor for other access protocols.
Complete fields in the tabs presenting the protocol-specific settings and additional features available for the access protocol you selected in the Protocols field.
Selected Protocol
Tabs
NFSv3
NFS -> Global Synchronization
NFSv4
NFS -> Access Delegation Policy
SMB
SMB -> Share-Level ACL
SMB -> Encryption
Block
S3 Bucket
S3 -> General
S3 -> CORS
S3 -> Bucket Logging
S3 -> Event Notifications
S3 Endpoint
S3 -> Bucket Creators
Database
S3 -> General
S3 -> CORS
S3 -> Bucket Logging
S3 -> Event Notifications
Kafka
S3 -> General
S3 -> CORS
S3 -> Bucket Logging
S3 -> Event Notifications
When finished, click Create.
The view is now created and can be accessed via all the protocols you enabled. You can see it displayed in the Views page.
S3
The S3 tab provide view settings used for S3 Bucket, S3 Endpoint, Database and/or Kafka protocols, organized in the following subtabs:
General
The S3 -> General tab lets you configure general S3 settings.
Under General:
User or IAM Role
Specifies whether the bucket owner is a user or a IAM role.
Bucket Owner
Specify a user or role to be the bucket owner. This setting is required for S3 buckets.
You can select an existing user/role or create a new one.
Under S3 Access Control:
Anonymous access
Allows anonymous S3 access to the bucket.
If enabled, anonymous requests are allowed, provided that the object ACL grants access to the All Users group (for S3 Native security flavor) or the permission mode bits on the requested file and directory path grant access permission to others (for NFS security flavor).
For views with SMB security flavor, anonymous requests are not allowed.
Versioning
Use the S3 -> Versioning tab to enable or disable S3 Object Versioning . This tab is displayed when the view policy assigned to the view enforces use of the S3 Native security flavor.
S3 Versioning | Enables S3 Object Versioning on the bucket. Versioning cannot be disabled after the view is created.
|
CORS
The S3 -> CORS tab lets you create a CORS configuration for a view that has S3 Bucket, Database or Kafka protocol enabled.
To enable CORS on the bucket exposed by the view, toggle the Enable CORS option on.
A visual editor appears that let you build CORS rules for the bucket.
Tip
Alternatively, you can import a JSON file with CORS rules using the Import Rule option at the bottom.
In the Define CORS rule pane, complete the fields:
Allowed Origins (required)
Enter a comma-separated list of full URLs of origins that are allowed to fetch resources from the bucket.
You can enter an asterisk (*) to allow all origins.
Allowed Methods (required)
Select one or more methods that allowed origins can use to fetch resources from the bucket: GET, HEAD, PUT, POST, DELETE.
Allowed Headers
Enter a comma-separated list of headers that are allowed in the client request.
You can enter an asterisk (*) to allow all headers.
Expose Headers
Enter a comma-separated list of headers that the client will be able to access.
Max Age
A period of time (in seconds) during which response to the preflight CORS request can be cached by the client.
Click Add Rule to CORS.
The rule is added to the view's CORS configuration on the right, where you can make further edits as necessary.
When editing the CORS configuration manually, the editor provides validations to ensure that only valid values are included. Illegal or unsupported entries and syntax are marked as such as you type with an explanatory message displayed.
If needed, repeat steps 2-3 to add more CORS for the view.
Object Locks
The S3 -> Object Lock tab is displayed when the S3 protocol is enabled for the bucket and the associated view policy stipulates use of the S3 Native security flavor.
This tab lets you configure S3 Object Locking for the view. To enable S3 object locking:
Toggle the Enable Object lock option on.
Select object retention mode in the Retention mode field:
Governance mode: Users cannot overwrite or delete an object version or alter its lock settings unless they have special permissions. With governance mode, you protect objects against being deleted by most users, but you can still grant some users permission to alter the retention settings or delete the object if necessary. You can also use governance mode to test retention-period settings before creating a compliance-mode retention period.
To override or remove governance-mode retention settings, a user must have the
s3:BypassGovernanceRetentionpermission and must explicitly includex-amz-bypass-governance-retention:trueas a request header with any request that requires overriding governance mode.Compliance mode: A protected object version can't be overwritten or deleted by any user. When an object is locked in compliance mode, its retention mode can't be changed, and its retention period can't be shortened. Compliance mode helps ensure that an object version can't be overwritten or deleted for the duration of the retention period.
None means no retention mode is set.
Set the default retention period in the Default retention period field.
The retention period is a fixed period of time during which an object remains locked. During this period, your object is WORM-protected. This means that when an object is deleted or replaced, the version that was deleted or replaced is protected from being removed from the bucket, although it does cease to be the latest version and can only be accessed by its version ID
Indestructible Object Mode
The S3 -> Indestructible Object Mode tab is displayed only when indestructible object mode is enabled on the cluster.
Enable indestructible object mode | Slide to the right to enable the feature on the view. Restrictions apply. See Indestructible Object Mode for full feature details. |
Default Retention Period | To set the retention period to anything other than the default 8 days, enter the number of days in the field. You can set any number of days from 1 to 400.
|
Bucket Creators
The S3 -> Bucket Creators is tab lets you specify bucket creator users or groups for a view with the S3 Endpoint protocol enabled.
Users | List bucket users by user name. Any request to create an S3 bucket that is sent by S3 API by a user listed here will use the S3 Endpoint view that you are configuring. Users should not be specified as bucket creators in more than one S3 Endpoint view. Naming a user as a bucket creator in two S3 Endpoint views will fail the creation of the view with an error. |
Groups | List user groups by group name. Any request to create an S3 bucket that is sent by S3 API by a user who belongs to a group listed here will use the S3 Endpoint view that you are configuring.
|
Anonymous access | Allows anonymous S3 access to the bucket. If enabled, anonymous requests are allowed, provided that the object ACL grants access to the All Users group (for S3 Native security flavor) or the permission mode bits on the requested file and directory path grant access permission to others (for NFS security flavor). For views with SMB security flavor, anonymous requests are not allowed. |
Bucket Logging
The S3 -> Bucket Logging tab is used to configure S3 bucket logging for the view. Complete the fields in this tab If you selected the S3 Bucket protocol.
Enable bucket logging | Toggle on to enable S3 bucket logging or the bucket. By default, logging is disabled. |
Destination bucket | Select a bucket to store the logs. |
Prefix | Optionally, specify a prefix that will be prepended to each key of a log object uploaded to the destination bucket. This prefix can be used to categorize log objects; for example, if you use the same destination bucket for multiple source buckets. The prefix can be up to 128 characters and must follow S3 object naming rules. |
Key format | Select the format for the log object keys:
In the formats:
|
Timestamp | If you specified the Key format that enables date-based partitioning of log objects, select the type of timestamp to be used when generating log object keys:
|
Event Notifications
The S3 -> Event Notifications tab is used to configure S3 event notifications for the view. Complete the fields in this tab If you selected the S3 Bucket protocol and the view has been attached a view policy with S3 Native security flavor.
To define an event notification for the bucket:
Click Create New Notification.
Enter a unique name for the new event notification in the Event Name field.
Under Trigger, specify one or more S3 events for which you want to send notifications, or use the wildcard '*' to select all events, under each of the event categories: Object Creation , Object Tagging or Object Removal.
Note
See Event Publishing for an explanation of S3 events.
Under Filter, optionally specify Prefix and/or Suffix to include only those events that have an S3 object key prefix or suffix that matches the corresponding filter string.
Under Notifications:
In the Broker field, specify the event broker to which to send event notifications. This can be a VAST Event Broker view, or a third-party event broker.
In the Topic field, enter a topic to which to publish the events.
Click Add Notification.
The newly created notification definition will be listed in the Event Notifications tab.
NFS
Global Synchronization
In the NFS -> Global Synchronization tab, optionally enable Enable global synchronization. This setting synchronizes file handles between the view and views on replication peers in a replication group that each point to the replicated path. It enables NFSv3 client users to retain the same mount point to the view in the event of a failover of the view path to a replication peer. Enabling global synchronization may cause overhead and should only be done when the use case is relevant.
When you enable this setting, the Global Synchronization tab shows the synchronization status of views on remote replication peers. If replication is not configured on the view path or on any path under the view, the tab displays No synced views. If replication is configured on the view path or on any path(s) under the view, the following details are displayed per replication peer:
Path. A path under the view that is replicated to a remote path.
Cluster name. The cluster on which the remote path resides.
Peer name. The name of the replication peer.
Sync status. Synced means there is a view on the remote path, it is enabled for global synchronization and it is synced with the view. Error means that there is no view on the remote path yet, or there is view on the remote path, but it does not have global synchronization enabled. In order to complete the global synchronization configuration, you will need to create a new view and enable global synchronization when you create it.
For more information about global synchronization, see Preparing for Seamless Replication Failover (NFSv3).
Access Delegation Policy
Use the NFS -> Access Delegation Policy tab to create a view-level configuration for granting NFSv4 file delegations. This tab is available for views with the NFSv4 protocol enabled.
View-level configuration is applied when the tenant has NFSv4 file delegations enabled. It allows for overriding tenant-level delegation settings for a particular view.
Select options as needed:
Use Tenant level delegations
This option is set by default. It applies tenant-level delegation configuration to the view.
Set View level delegations
Select this option to be able to override tenant-level delegation configuration for this particular view.
Enable read delegations
Enables granting of NFSv4 read delegations for the view.
Enable write delegations
Enables granting of NFSv4 write delegations for the view.
Verify the result of your setup in the Policy Preview (End result) pane.
Kafka
For views that have the Kafka protocol enabled, the Kafka tab offers settings required when using the view as a VAST Event Broker.
Select a virtual IP pool in the VIP Pool field. This virtual IP pool will be used to access event topics.
Caution
When modifying a view, if you need to replace the virtual IP pool assigned to a view with a different pool, ensure that both old and new pools are not being modified during the change. Switching a view from one pool to another while either old or new pool is being modified, may result in unexpected behavior.
If you are going to use mTLS authentication for the VAST Event Broker, the virtual IP pool can be shared with VAST Event Broker views on other tenants, since determination of the correct tenant for each client request will be done based on the information in the CA certificate. If mTLS authentication is not used, the pool must belong to the same VAST tenant as the Kafka-enabled view
If the view is associated with a view policy that includes virtual IP pools, the pool specified as the Kafka pool must be one of the view policy pools.
Under Authentication Methods, configure authentication and authorization for Kafka connections:
To let the clients authenticate VAST Event Broker on encrypted connections, ensure that Encrypted connection (port 9093) is selected (which is the default) and then select Require SASL PLAIN authentication.
Note that this option requires a Kafka TLS certificate to be provided for the VAST cluster or tenant.
SASL/PLAIN authentication cannot be selected together with mTLS authentication.
Select Request mTLS to enable mTLS authentication on the connections to this VAST Event Broker view (where the server authenticates the client).
Note that this option requires a Kafka mTLS certificate to be provided in tenant or cluster settings.
mTLS authentication cannot be used together with SASL/PLAIN authentication.
To authenticate clients on non-encrypted connections, select Unencrypted connections (TLS) (port 9092) and then select Require SASL PLAIN authentication.
To enable authorization, toggle the Enable authorization option on.
Block
Use the Block tab to configure block access-related settings for a view that has the Block access protocol enabled.
Name | Enter a name for the subsystem. The name is incorporated into the generated subsystem NQN. |
Subsystem NQN | This field is read-only. The value is generated after the name is defined. It is the NVMe Qualified Name (NQN), a unique identifier, incorporating the subsystem name, used to identify the view as a remote NVMe storage target for block clients. You can use this field to retrieve the subsystem NQN for connection from the client. |
Define as the default view (subsystem) | Enable this option if you want to set the view to be the default subsystem view. The default subsystem view is used as a default if a block volume is created by VMS REST API without a view being specified. |
SMB
Share-Level ACLs
Use the SMB -> Share-Level ACLs tab to configure SMB share-level ACL for the view. This tab is available only if the view has the SMB protocol enabled.
Toggle Enable Share-level ACL on to enable share-level ACL on the view.
When enabled, SMB requests to access the view will fail unless permission is granted to the requesting user by an ACE configured in this dialog.
When disabled, the default share-level ACL applies to the view.
Tip
The default share-level ACL grants Full Control permissions to the Everyone group by default. You can alter this setting on the General tab of the Tenant dialog (choose Element Store -> Tenants -> choose to edit a tenant).
Add share-level ACEs:
Under Search, query a user or group that you want to define an ACE for:
Select a specific Active Directory domain or all domains from the Domain dropdown.
Select the Grantee type (user or group) that you want to search for.
In the Name field, specify the name of the grantee:
For a grantee from the cluster's joined domain, enter the name without the domain name suffix.
For a grantee from domains in other trusted forests, enter the name followed by the domain name suffix: <grantee name>@<domain name>.
Click + Add ACE. The grantee's type and name displayed in the ACL grid.
In the Permission column of the ACL grid, select the permission type that you want to grant to the grantee.
Repeat the steps above until you have created all the ACEs that you want to configure.
Encryption
The SMB -> Encryption tab is shown after selecting the SMB protocol for the view and only when the tenant has SMB encryption enabled. It lets you set up the view with SMB encryption protection that is equal to or stronger than that of the tenant.
Under Protection Activation Policy, select one of the available protection levels:
Available (low) - Encryption is used only for SMB clients which have requested it explicitly. For clients that do not support encryption, access is allowed but no encryption is used.
Desired (medium) - The cluster uses encryption for any SMB client that supports encryption. For clients that do not support encryption, access is allowed but no encryption is used.
Required (high) - SMB clients that do not support encryption are denied access.
WORM
The WORM tab lets you establish a Write Once Read Many (WORM) configuration for a view that has NFSv3, NFSv4 and/or SMB protocol enabled.
Toggle Enable write once read many (WORM) on.
Note
This step is irreversible. Once WORM is enabled in a view, it cannot subsequently be disabled.
Select the File Retention Mode (for NFS and SMB) or S3 Retention Mode (for S3) for the view:
Governance. In this mode, locked files cannot be deleted or changed. The Retention settings can be shortened or extended by users with sufficient permissions
Compliance. In this mode, locked files cannot be deleted or changed. Retention settings can be extended, but not shortened, by users with sufficient permissions.
None. (S3 only). The retention mode is not set for the view; it is set individually for each object.
Configure the retention settings for the view as follows:
Default retention period. This is the period of time a file or object will be locked, if locking is done automatically (Auto-commit is set). It must be in the range Minimum retention period and Maximum retention period. Set it as minutes (m), hours (h), days (d), or years (y). Example: 4m.
Minimum retention period. The minimum retention period for a file or object, once it is locked, in minutes (m), hours (h), days (d), or years (y). This applies both to files locked automatically and to files locked manually.
Maximum retention period. The maximum retention period for a file or object, once it is locked, in minutes (m), hours (h), days (d), or years (y). This applies both to files locked automatically and to files locked manually.
Auto-commit period (NFS and SMB only). If set to a non-zero value, files will automatically be locked after the Default Retention Period elapses since from the time the file is saved. If this is set, you do not have to manually set the file to Read-Only to lock them (see Write Once Read Many (WORM) Views). Set it as minutes (m), hours (h), days (d), or years (y). Example: 4m.
Access-Based Enumeration
The Access-Based Enumeration tab lets you configure Access-Based Enumeration (ABE) for a view that has the SMB protocol enabled.
To enable ABE for the view, select SMB in the Protocols dropdown in the ABE tab.
Optionally, set the maximum directory level (depth) at which ABE is enabled in the Max depth field. If left empty, ABE depth is unlimited.
Attribute-Based Access Control
Use the Attribute-Based Access Control tab to configure Attribute-Based Access Control (ABAC) for a view that has NFSv4, SMB or S3 Bucket protocol enabled.
Enter a comma-separated list of ABAC attributes in the Attribute field.
Up to 20 ABAC tags can be defined per view. ABAC tags are case-sensitive and can include alphanumeric characters, a hyphen (-), a colon (:), a plus sign (+), and an underline (_).
For example:
red,green,yellow
User Impersonation
The User Impersonation tab lets you configure user impersonation for a view that has NFSv3, NFSv4 or SMB protocol enabled.
Toggle the Enable user impersonation option on.
In the Select User field that becomes available after you enabled user impersonation, select the impersonator (the user account to be used instead of the original user).
Creating a View via VAST CLI
Use the ⚠️ view create command to create the view.view create
Note
Share-level ACLs can be added via CLI only using the view modify command after creating the view.
Modifying Views
Modifying Views via VAST Web UI
From the left navigation menu, select Element Store and then Views.
Right-click the view you want to edit and select Edit.
Review and change the view settings as appropriate. For detailed information about each setting, see Creating Views.
Note the following;
If the view has ABAC tags assigned to it, you cannot select protocols that are not supported with ABAC (e.g. NFSv3 and S3).
If the view was already configured with an SMB share, you cannot modify the SMB share name.
If indestructible object mode was enabled on the view, you can only disable it or change its retention period without first unlocking the cluster's indestructibility mechanism.
For Kafka-enabled views, if you need to replace the virtual IP pool assigned to a view with a different pool, ensure that both old and new pools are not being modified during the change. Switching a view from one pool to another while either old or new pool is being modified, may result in unexpected behavior.
Click Update to save your changes.
Modifying Views via VAST CLI
To modify a view via the VAST CLI, use the view modify command.
Running a Bulk Permission Update
You can run a bulk update to change permissions and ownership for files and directories residing under a path on an Element Store view.
The update is done based on a template directory and/or file, from which permissions and ownership attributes (owner ID, owning group, ACL) are copied to the directories and files under the target path that you specify, overwriting the preexisted permissions and ownership attributes. If there is no template file specified, permissions for the files under the target path are updated by inheriting from the template directory.
This is useful in case you need to recursively fix permissions for a very large number of files and directories. All the processing for the bulk permission update task is done on the VAST cluster and distributed among the cluster's CNodes, eliminating the latencies that typically occur when running a similar task from a client.
Bulk permission update can be run on views with NFSv4, NFSv3, SMB and S3 storage access protocols, including VAST Database views.
Requirements and Restrictions
Only one bulk permission update task per tenant can run at a time.
If a client attempts to set permissions on directories or files being updated via a bulk permission update, the result is unpredictable.
A bulk permission update can run only when the target view (the view exposing the files and directories for which you want to update permissions) is on the same tenant as the template view.
It is strongly recommended that the target view and the template view have view policies with the same security flavor. Running a bulk permission update on a view where the security flavor does not match that of the template view may result in inaccessible or incompatible permissions set.
Permissions to be updated are determined based on the security flavor of the target view. For information, see Updated Permissions per Security Flavor and Protocol.
Read-only snapshots and VAST special directories (
.vastin S3 buckets,.trash,.snap,.remote) are excluded from bulk permission update.Bulk permission update cannot run on ABAC-tagged views.
Updated Permissions per Security Flavor and Protocol
Permissions that can be updated as a result of a bulk permission update depend on the security flavor set (via a view policy) for the template and target views:
Security Flavor | Updated Permissions |
|---|---|
NFS | Mode bits or POSIX permissions (if the view policy allows a POSIX ACL) |
SMB | Only NTFS permissions |
S3 Native | Only S3 permissions |
Mixed Last Wins | Mode bits, POSIX, NTFS or NFSv4 permissions |
The following ACE types can be updated for each access protocol:
Protocol | ACE Types | Permissions per ACE | Inheritance Flags per ACE |
|---|---|---|---|
NFSv3 |
| Read, Write, Execute Special bits: SUID, SGID, sticky bit | |
NFSv4 |
| Special bits: SUID, SGID, sticky bit | |
SMB |
| | |
S3 |
| |
Choosing a Template Directory or File
Choose a template directory and, optionally, a template file with permissions that you want to assign to the target directories and/or files during a bulk permission update.
If a template file is specified for a bulk permission update, VAST Cluster overwrites the permissions and ownership attributes of the target files and directories as follows:
Permissions of target files are overwritten with those of the template file.
Permissions of target directories are overwritten with those of the template directory.
If no template file is specified, VAST Cluster overwrites the permissions and ownership attributes of the top target directory (specified as the Selected path to update) with those of the template directory, and nested directories and files inherit permissions and ownership attributes from their parent.
In this case, the template directory must have a default ACL on it.
Tip
Ensure that the view that exposes the template directory or file is on the same tenant as the target view and has a view policy with the same security flavor as that of the target view.
Starting Bulk Permission Update in VAST Web UI
To start a bulk permission update:
In the left navigation menu, choose Element Store and then Views to open the Views page.
In the Views page, find the view that exposes the files and directories for which you want to update permissions and in the Actions menu for that view, choose Bulk Permission Update.
In the Path to update pane of the Bulk permission update dialog, complete the fields:
Selected path to update
Specify a path to the directory where files and directories for which to update permissions reside.
In the Template pane of the Bulk permission update dialog, complete the fields:
Copy from view
Specify a view that exposes a directory and (optionally) a file from which to copy permissions and ownership attributes.
This view should be on the same tenant as the view specified in Selected path to update.
It is strongly recommended that the target view and the template view have view policies with the same security flavor. Running a bulk permission update on a view where the security flavor does not match that of the template view may result in inaccessible or incompatible permissions set.
Directory template path
Specify a path to the directory from which to copy permissions and ownership attributes to the directories under Selected path to update. For more information about choosing a template directory, see Choosing a Template Directory or File.
File template path
Specify a path to the file from which to copy permissions and ownership attributes to the files under Selected path to update.
This setting is optional. If not specified, the attributes are copied from the directory specified in Directory template path.
For more information about choosing a template file, see Choosing a Template Directory or File.
Click Approve.
Verify the details In the confirmation popup.
If the suggested replacements are correct, click Yes to start the bulk permission update.
To make changes to the setup, click No.
The bulk permission update is started.
Starting Bulk Permission Update in VAST CLI
Run the view bulk-permission-update command.
Checking Update Progress and Status in VAST Web UI
To view progress and status of the bulk permission update per view:
In the left navigation menu, choose Element Store and then Views to open the Views page.
The Bulk Permission Update State column displays the status of the latest bulk permission update for a view.
The Bulk Permission Update Progress column shows the update percentage completion.
To view details of a particular bulk permission update task:
In the left navigation menu, choose Activities.
In the Activities page, set the date and time filter as appropriate and search for a task named
bulk_permission_update.Click a task in the list to display its details in the right pane. The details include the task steps with timing and completion status for each step.
Checking Update Progress and Status in VAST CLI
To view bulk permission update progress and status per view, run the iew list or view show command. In the command output, the Bulk-permission-update-state field shows the task status, and the Bulk-permission-update-progress field shows the task progress.
To view details of a particular bulk permission update task, run the vtask list command. Set the date and time and task name filters as appropriate. Bulk permission update tasks are named bulk_permission_update.
Stopping Bulk Permission Update in VAST Web UI
When you stop a running bulk permission update, the changes that the task has already made are not rolled back.
To stop a running bulk permission update:
In the left navigation menu, choose Element Store and then Views.
In the Views page, use the filter in the Bulk Permission Update State column to find the view for which permissions are being updated.
Open the Actions menu for that view and click Stop Bulk Permission Update.
Stopping Bulk Permission Update in VAST CLI
When you stop a running bulk permission update, the changes that the task has already made are not rolled back.
Run the view stop-bulk-permission-update command.
Deleting Views
Note
Deleting a view from the VMS does not delete directories or files from the file system. To delete the view's underlying directory, use the
/folders/delete_folder/endpoint of the VAST REST API.
To delete a view:
In VAST Web UI:
From the left navigation menu, select Element Store and then Views.
Right-click the view you want to delete, and select Remove.
Click Yes to confirm the deletion.
In VAST CLI, run the
view deletecommand.