Chapter 6. Performing operations with the Shared File Systems service (manila) You can create and manage shares from the available share types in the Shared File Systems service (manila). Note To execute openstack client commands on the cloud, you must specify the name of the cloud detailed in your clouds.yaml file. You can specify the name of the cloud by using one of the following methods: Use the --os-cloud option with each command: Use this option if you access more than one cloud. Create an environment variable for the cloud name in your bashrc file: Prerequisites The administrator has created a project for you, and they have provided you with a clouds.yaml file for you to access the cloud. You have installed the python-openstackclient package. 6.1. Listing share types You must specify a share type when you create a share, and you can only create shares that match the available share types. The configured share types define the type of service that the Shared File Systems service scheduler uses to make scheduling decisions and that drivers use to control share creation. Procedure List the available share types: The command output lists the name and ID of the available share types. 6.2. Creating NFS, CephFS, or CIFS shares You can create CephFS-NFS, native CephFS, or CIFS shares to read and write data. When you create a share, you must specify the share protocol and the size of the share in gigabytes. You can also include the share-type , share-network and name command options: In the command example, replace the following values: Value Description Required or optional <share_type> Applies settings associated with the specified share type Optional. If you do not specify a share type, the default share type is used. <share_network> The name of the share network Required if the share type has driver_handles_share_servers set to true . Unsupported if the share type has driver_handles_share_servers set to false . Unsupported for CephFS-NFS and native CephFS. These protocols do not support share types that have driver_handles_share_servers set to true . <share_name> The name of the share Optional. Shares are not required to have a name, and the name does not need to be unique. <share_protocol> The share protocol you want to use For CephFS-NFS, replace <share_protocol> with nfs . For native CephFS, replace <share_protocol> with cephfs . For other storage back ends that support NFS or CIFS protocols, for example, NetApp or Dell EMC storage back ends, replace <share_protocol> with nfs or cifs . <GB> The size of the share in gigabytes Required. 6.2.1. Creating NFS or CIFS shares with DHSS=true When the share type extra specification, driver_handles_share_servers is set to true , you can add your own security services to a share network to create and export NFS or CIFS shares. The native CephFS protocol does not support share networks. To add a security service, you must create a share network first. If you are creating CIFS shares, you must also create a security service resource to represent your Active Directory server. You then associate the security service to the share network. If you are creating NFS shares, you do not require a security service unless you want to use Kerberos or LDAP authorization on your shares. Procedure Create a share network: Replace <network_name> with the share network name that you want to use for your NFS or CIFS shares. Replace the neutron-net-id and neutron-subnet-id with the correct values for your share network. Create a security service resource to represent your Active Directory server: Replace the values in angle brackets <> with the correct details for your security service resource. Associate the security service resource to the share network: Create an NFS or CIFS share: 10 GB NFS example: 20 GB CIFS example: Replace the values in angle brackets <> with the correct details for your NFS or CIFS share. 6.2.2. Creating NFS, CephFS, or CIFS shares with DHSS=false When the share type extra specification, driver_handles_share_servers , is set to`false`, you cannot use custom security services because security services have been configured directly on the storage system. Because CIFS shares require an Active Directory server along with the storage system to manage access control, your administrator must pre-create an Active Directory server and associate it with the storage system to use CIFS shares. When DHSS=false, you can create shares without using the share-network command option because the shared storage network is pre-configured. Procedure Create an NFS, native CephFS, or CIFS share when DHSS=false. These examples specify a name , but they do not specify the share-type or share-network . They use the default share type and the configured shared storage network: Create a 10 GB NFS share named share-01 . Create a 15 GB native CephFS share named share-02 : Create a 20 GB CIFS share named share-03 : 6.3. Listing shares and exporting information To verify that you have successfully created NFS, CephFS, or CIFS shares in the Shared File Systems service (manila), you can list the shares and view their export locations and parameters. Procedure List the shares: View the export locations of the share: Replace <share> with either the share name or the share ID. View the parameters for the share: Replace <share_id> with the share ID. Note You use the export location to mount the share, as described in Section 6.8.2, "Mounting NFS, native CephFS, or CIFS shares" . 6.4. Creating a snapshot of data on a shared file system A snapshot is a read-only, point-in-time copy of data on a share. You can use a snapshot to recover data lost through accidental data deletion or file system corruption. Snapshots are more space efficient than backups, and they do not impact the performance of the Shared File Systems service (manila). Prerequisites The snapshot_support parameter must equal true on the parent share. You can run the following command to verify: Procedure Create a snapshot of a share: Replace <share> with the name or ID of the share for which you want to create a snapshot. Optional: Replace <snapshot_name> with the name of the snapshot. Confirm that you created the snapshot: Replace <share> with the ID of the share from which you created the snapshot. 6.4.1. Creating a share from a snapshot You can create a share from a snapshot. If the parent share that the snapshot was created from has a share type of driver_handles_share_servers set to true , the new share is created on the same share network as the parent, and you cannot change this share network for the new share. Prerequisites The create_share_from_snapshot_support share attribute is set to true . The status attribute of the snapshot is set to available . Procedure Retrieve the ID of the share snapshot that contains the data that you require for your new share: A share created from a snapshot can be larger, but not smaller, than the snapshot. Retrieve the size of the snapshot: Replace <snapshot_id> with the ID of the snapshot you want to use to create a share. Create a share from a snapshot: Replace <share_protocol> with the protocol, such as NFS. Replace <size> with the size of the share to be created, in GiB. Replace <name> with the name of the new share. List the shares to confirm that the share was created successfully: View the properties of the new share: Verification After you create a snapshot, confirm that the snapshot is available. List the snapshots to confirm that they are available: 6.4.2. Deleting a snapshot When you create snapshots of a share, you cannot delete the share until you delete all of the snapshots created from that share. Procedure Identify the snapshot you want to delete and retrieve its ID: Delete the snapshot: Replace <snapshot> with the name or ID of the snapshot you want to delete. Note Repeat this step for each snapshot you want to delete. After you delete the snapshot, run the following command to confirm that you deleted the snapshot: 6.5. Connecting to a shared network to access shares When the driver_handles_share_servers parameter (DHSS) equals false , shares are exported to the shared provider network that your administrator has made available. You must connect your client, such as a Compute instance, to the shared provider network to access your shares. In the following example procedure, the shared provider network is called StorageNFS. StorageNFS is configured when the Shared File Systems service (manila) is deployed with a CephFS-NFS back end. Follow similar steps to connect to the available network in your Red Hat OpenStack Services on OpenShift (RHOSO) deployment. Note The steps in the following example procedure use IPv4 addressing, but the steps are identical for IPv6. Procedure Create a security group for the StorageNFS port that allows packets to egress the port but does not allow ingress packets from unestablished connections: Create a port on the StorageNFS network with security enforced by the no-ingress security group. Note In the following example, the StorageNFS subnet on the StorageNFS network assigns IP address 198.51.100.160 to nfs-port0 . Add nfs-port0 to a Compute instance. In addition to its private and floating addresses, the Compute instance is assigned a port with the IP address 198.51.100.160 on the StorageNFS network. You can use this IP address to mount NFS shares when access is granted to that address for the shares. Note You might need to adjust the networking configuration on the Compute instance, and then restart the services for the Compute instance to activate an interface with this address. 6.6. Configuring an IPv6 interface between the network and an instance When the shared network to which shares are exported uses IPv6 addressing, you might experience an issue with DHCPv6 on the secondary interface. If this issue occurs, configure an IPv6 interface manually on the instance. Prerequisites Connection to a shared network to access shares Procedure Log in to the instance. Configure the IPv6 interface address: Activate the interface: Ping the IPv6 address in the export location of the share to test interface connectivity: Alternatively, verify that you can reach the NFS server through Telnet: 6.7. Granting share access for end-user clients Before you mount a share on a client, such as a Compute instance, you grant end-user clients access to the share so that users can read data from and write data to the share. The type of access depends on the protocol of the share: For CIFS shares, use the CIFS user or group name. For NFS shares, use the IP address of the Compute instance where you plan to mount the share. For native CephFS shares, use Ceph client usernames for cephx authentication. You can grant access to the share by using a command similar to the following command: Replace <share> with the share name or ID of the share you created. Replace <access_type> with the type of access you want to grant to the share, for example, user for CIFS, ip for NFS, or cephfx for native CephFS. Optional: Replace <access_level> with ro for read-only access. The default value is rw for read-write access. Replace client_identifier with the IP address of the instance for NFS, user or group name for CIFS, or Ceph client username for native CephFS. For CIFS and native CephFS, you can use the same client_identifier across multiple clients. 6.7.1. Granting access to an NFS share You can provide access to NFS shares by using the IP address of the client Compute instance where you plan to mount the share. Note You can use the following procedure with IPv4 or IPv6 addresses. Procedure Retrieve the IP address of the client Compute instance where you plan to mount the share. Make sure that you select the IP address that corresponds to the network that can reach the shares. In this example, it is the IP address of the StorageNFS network: Replace <share> with the name or ID of the share you are granting access to. Note Access to the share has its own ID, id . Verification Verify that the access configuration was successful: 6.7.2. Granting access to a native CephFS share You can provide access to native CephFS shares by using Ceph client usernames for cephx authentication. The Shared File Systems service (manila) prevents the use of pre-existing Ceph users so you must create unique Ceph client usernames. To mount a share, you need a Ceph client username and an access key. You can retrieve access keys by using the Shared File Systems service API. By default, access keys are visible to all users in a project namespace. You can provide the same user with access to different shares in the project namespace. Users can then access the shares by using the CephFS kernel client on the client machine. Important Use the native CephFS driver with trusted clients only. Procedure Grant users access to a native CephFS share: Replace <share> with either the share name or share ID. Replace <user> with the Ceph client username. Collect the access key for the user: 6.7.3. Granting access to a CIFS share You can grant access to CIFS shares by using the usernames in the Active Directory service. The Shared File Systems service (manila) does not create new users on the Active Directory server. It only validates usernames through the security service, and access rules with invalid usernames result in an error status. If the value of the driver_handles_share_servers (DHSS) parameter is set to true , then you can configure the Active Directory service by adding a security service. If the DHSS parameter is set to false , then your administrator has already configured the Active Directory service and associated it with the storage network. To mount a share, you must specify the user's Active Directory username and password. You cannot obtain this password through the Shared File Systems service. Procedure Grant users access to a CIFS share: Replace <share> with either the share name or the share ID. Replace <user> with the username of the Active Directory user. 6.7.4. Revoking access to a share The owner of a share can revoke access to the share. Complete the following steps to revoke access that was previously granted to a share. Procedure View the access list for the share to retrieve the access ID: Replace <share_01> with either the share name or share ID. Revoke access to the share: Replace <875c6251-c17e-4c45-8516-fe0928004fff> with the access ID of the share. View the access list for the share again to verify the share has been deleted: Note If you have a client with read-write access to the share, you must revoke their access to the share, and then add a read-only rule if you want the client to have read-only access. 6.8. Mounting shares on Compute instances When you grant share access to clients, then the clients can mount and use the shares. Any type of client can access shares as long as there is network connectivity to the client. The steps used to mount an NFS share on a virtual Compute instance are similar to the steps to mount an NFS share on a bare-metal Compute instance. For more information about how to mount shares on OpenShift containers, see Product Documentation for Red Hat OpenShift Container Platform . Note Client packages for the different protocols must be installed on the Compute instance that mounts the shares. For example, for the Shared File Systems service with CephFS through NFS, the NFS client packages must support NFS 4.1. 6.8.1. Listing share export locations Retrieve the export locations of shares so that you can mount a share. Procedure Retrieve the export locations of a share: Replace <share_01> with either the share name or share ID. When multiple export locations exist, choose one for which the value of the preferred metadata field equals True . If no preferred locations exist, you can use any export location. 6.8.2. Mounting NFS, native CephFS, or CIFS shares When you create NFS, native CephFS, or CIFS shares and grant share access to end-user clients, you can then mount the shares on the client to enable access to data, as long as there is network connectivity. Prerequisites To mount NFS shares, the nfs-utils package must be installed on the client machine. To mount native CephFS shares, the ceph-common package must be installed on the client machine. Users access native CephFS shares by using the CephFS kernel client on the client machine. To mount CIFS shares, the cifs-utils package must be installed on the client machine. Procedure Log in to the instance: Mount an NFS share. Refer to the following example for sample syntax: Replace <198.51.100.13:/volumes/_nogroup/e840b4ae-6a04-49ee-9d6e-67d4999fbc01> with the export location of the share. Retrieve the export location as described in Section 6.8.1, "Listing share export locations" . Mount a native CephFS share. Refer to the following example for sample syntax: Replace <192.0.2.125:6789,192.0.2.126:6789,192.0.2.127:6789:/volumes/_nogroup/4c55ad20-9c55-4a5e-9233-8ac64566b98c> with the export location of the share. Retrieve the export location as described in Section 6.8.1, "Listing share export locations" . Replace <user> with the cephx user who has access to the share. Replace the secret value with the access key that you collected in Section 6.7.2, "Granting access to a native CephFS share" . Mount a CIFS share. Refer to the following example for sample syntax: Replace <user> with the Active Directory user who has access to the share. Replace <password> with the user's Active Directory password. Replace <\\192.0.2.128/share_11265e8a_200c_4e0a_a40f_b7a1117001ed> with the export location of the share. Retrieve the export location as described in Section 6.8.1, "Listing share export locations" . Verification Verify that the mount command succeeded: 6.9. Deleting shares The Shared File Systems service (manila) provides no protection to prevent you from deleting your data. The service does not check whether clients are connected or workloads are running. When you delete a share, you cannot retrieve it. Warning Back up your data before you delete a share. Prerequisites If you created snapshots from a share, you must delete all of the snapshots and replicas before you can delete the share. For more information, see Deleting a snapshot . Procedure Delete a share: Replace <share> with either the share name or the share ID. 6.10. Listing resource limits of the Shared File Systems service You can list the current resource limits for the Shared File Systems service (manila) in a project to plan workloads and prepare for any operations based on resource consumption. Procedure List the resource limits and current resource consumption for the project: 6.11. Troubleshooting operation failures In the event of an error when you create or mount shares, you can run queries from the command line for more information about the error. 6.11.1. Viewing error messages for shares You can use the command line to retrieve user support messages if a share shows an error status. Procedure When you create a share, run the following command to view the status of the share: If the status of your share shows an error, run the share message list command. You can use the --resource-id option to filter to the specific share you want to find out about: Check the User Message column in the share message list command output for a summary of the error. To view more details about the error, run the message show command, followed by the message ID from the message list command output: Replace <id> with the message ID from the message list command output. 6.11.2. Debugging share mounting failures You can use these verification steps to identify the root cause of an error when you mount shares. Procedure Verify the access control list of the share to ensure that the rule that corresponds to your client is correct and has been successfully applied: Replace <share_01> with either the share name or share ID. In a successful rule, the state attribute equals active . If the share type parameter is configured to driver_handles_share_servers=false , copy the hostname or IP address from the export location and ping it to confirm connectivity to the NAS server: Example: If you are using the NFS protocol, you can verify that the NFS server is ready to respond to NFS RPC calls on the correct port: Note The IP address is written in universal address format (uaddr), which adds two extra octets (8.1) to represent the NFS service port, 2049. If these verification steps fail, there might be a network connectivity issue or an issue with the back-end storage for the Shared File Systems service (manila). Collect the log files and contact Red Hat Support.

Commands:
openstack flavor list --os-cloud <cloud_name>
`export OS_CLOUD=<cloud_name>`
openstack share type list
openstack share create [--share-type <share_type>] [--share-network <share_network>] [--name <share_name>] <share_protocol> <GB>
openstack share network create --name <network_name> --neutron-net-id <25d1e65c-d961-4f22-9476-1190f55f118f> --neutron-subnet-id <8ba20dce-0ca5-4efd-bf1c-608d6bceffe1>
openstack share security service create <active_directory> --dns-ip <192.02.12.10> --domain <domain_name.com> --user <administrator> --password <password> --name <AD_service>
openstack share network set --new-security-service <AD_service> <network_name>
openstack share create --name <nfs_share> --share-type <netapp> --share-network <nfs_network> nfs 10
openstack share create --name <cifs_share> --share-type dhss_true --share-network <cifs_network> cifs 20
openstack share create --name share-01 nfs 10
openstack share create --name share-02 cephfs 15
openstack share create --name share-03 cifs 20
openstack share list
openstack share export location list <share>
openstack share export location show <share_id>
openstack share show | grep snapshot_support
openstack share snapshot create [--name <snapshot_name>] <share>
openstack share snapshot list --share <share>
openstack share snapshot list
openstack share snapshot show <snapshot_id>
openstack share create <share_protocol> <size> --snapshot-id <snapshot_id> --name <name>
openstack share list
openstack share show <name>
openstack share snapshot list
openstack share snapshot list
share snapshot delete <snapshot>
share snapshot list
openstack security group create no-ingress -f yaml created_at: '2018-09-19T08:19:58Z' description: no-ingress id: 66f67c24-cd8b-45e2-b60f-9eaedc79e3c5 name: no-ingress project_id: 1e021e8b322a40968484e1af538b8b63 revision_number: 2 rules: 'created_at=''2018-09-19T08:19:58Z'', direction=''egress'', ethertype=''IPv4'', id=''6c7f643f-3715-4df5-9fef-0850fb6eaaf2'', updated_at=''2018-09-19T08:19:58Z'' created_at=''2018-09-19T08:19:58Z'', direction=''egress'', ethertype=''IPv6'', id=''a8ca1ac2-fbe5-40e9-ab67-3e55b7a8632a'', updated_at=''2018-09-19T08:19:58Z''
openstack port create nfs-port0 --network StorageNFS --security-group no-ingress -f yaml admin_state_up: UP allowed_address_pairs: '' binding_host_id: null binding_profile: null binding_vif_details: null binding_vif_type: null binding_vnic_type: normal created_at: '2018-09-19T08:03:02Z' data_plane_status: null description: '' device_id: '' device_owner: '' dns_assignment: null dns_name: null extra_dhcp_opts: '' fixed_ips: ip_address='198.51.100.160', subnet_id='7bc188ae-aab3-425b-a894-863e4b664192' id: 7a91cbbc-8821-4d20-a24c-99c07178e5f7 ip_address: null mac_address: fa:16:3e:be:41:6f name: nfs-port0 network_id: cb2cbc5f-ea92-4c2d-beb8-d9b10e10efae option_name: null option_value: null port_security_enabled: true project_id: 1e021e8b322a40968484e1af538b8b63 qos_policy_id: null revision_number: 6 security_group_ids: 66f67c24-cd8b-45e2-b60f-9eaedc79e3c5 status: DOWN subnet_id: null tags: '' trunk_details: null updated_at: '2018-09-19T08:03:03Z'
openstack server add port instance0 nfs-port0 openstack server list -f yaml - Flavor: m1.micro ID: 0b878c11-e791-434b-ab63-274ecfc957e8 Image: manila-test Name: demo-instance0 Networks: demo-network=198.51.100.4, 10.0.0.53; StorageNFS=198.51.100.160 Status: ACTIVE
sudo ip address add fd00:fd00:fd00:7000::c/64 dev eth1
sudo ip link set dev eth1 up
ping -6 fd00:fd00:fd00:7000::21
sudo dnf install -y telnet telnet fd00:fd00:fd00:7000::21 2049
openstack share access create <share> <access_type> --access-level <access_level> <client_identifier>
openstack server list -f yaml - Flavor: m1.micro ID: 0b878c11-e791-434b-ab63-274ecfc957e8 Image: manila-test Name: demo-instance0 Networks: demo-network=198.51.100.4, 10.0.0.53; StorageNFS=198.51.100.160 Status: ACTIVE openstack share access create <share> ip 198.51.100.160
+-----------------+---------------------------------------+ | Property | Value | +-----------------+---------------------------------------+ | access_key | None | share_id | db3bedd8-bc82-4100-a65d-53ec51b5cba3 | created_at | 2018-09-17T21:57:42.000000 | updated_at | None | access_type | ip | access_to | 198.51.100.160 | access_level | rw | state | queued_to_apply | id | 875c6251-c17e-4c45-8516-fe0928004fff +-----------------+---------------------------------------+
openstack share access list <share> +--------------+-------------+--------------+--------------+--------+ | id | access_type | access_to | access_level | state | +--------------+-------------+--------------+--------------+--------+ | 875c6251-... | ip | 198.51.100.160 | rw | active | +--------------+------------+--------------+--------------+---------+
openstack share access create <share> cephx <user>
openstack share access list <share>
openstack share access create <share> user <user>
openstack share access list <share_01>
openstack share access delete <share_01> <875c6251-c17e-4c45-8516-fe0928004fff>
openstack share access list <share_01>
openstack share export location list <share_01>
openstack server ssh demo-instance0 --login user
mount -t nfs -v <198.51.100.13:/volumes/_nogroup/e840b4ae-6a04-49ee-9d6e-67d4999fbc01> /mnt
mount -t ceph <192.0.2.125:6789,192.0.2.126:6789,192.0.2.127:6789:/volumes/_nogroup/4c55ad20-9c55-4a5e-9233-8ac64566b98c> -o name=<user>,secret='<AQA8+ANW/<4ZWNRAAOtWJMFPEihBA1unFImJczA==>'
mount -t cifs -o user=<user>,pass=<password> <\\192.0.2.128/share_11265e8a_200c_4e0a_a40f_b7a1117001ed>
df -k
openstack share delete <share>
openstack share limits show --absolute
openstack share list
openstack share message list [--resource-id]
openstack share message show <id>
openstack share access list <share_01>
ping -c 1 198.51.100.13 PING 198.51.100.13 (198.51.100.13) 56(84) bytes of data. 64 bytes from 198.51.100.13: icmp_seq=1 ttl=64 time=0.048 ms--- 198.51.100.13 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 7.851/7.851/7.851/0.000 ms
rpcinfo -T tcp -a 198.51.100.13.8.1 100003 4 program 100003 version 4 ready and waiting