16 File Storage ‐ basic - KleberVales/OCI-Architect-Associate GitHub Wiki

1. File Storage

2. File Storage Concepts

3. NFS Export Options

4. File System Paths

.
.
.
.
.

1. File Storage

1.1 Introduction

1.2 What Is OCI File Storage?

OCI File Storage is a fully managed, elastic, shared file system compatible with NFS v3.0. It is designed to store files that need to be accessed simultaneously by multiple instances.

Key features:

  • Supports Network File System version 3.0 (NFS v3.0).
  • Data is replicated for durability within each availability domain.
  • Scales automatically to accommodate growth up to 8 exabytes.
  • Provisioning is fully managed and automatic.
  • Scales from a single byte to exabytes without upfront provisioning.
  • Well-suited for applications that require a shared file system.
  • Provides a durable, scalable, secure, enterprise-grade network file system.
  • Supports the Network Lock Manager (NLM) protocol for file locking.

1.3 Connectivity

You can connect to OCI File Storage from:

  • Bare metal instances
  • Virtual machine instances
  • Container instances
  • Resources inside your Virtual Cloud Network (VCN)

You can also access the file system from outside the VCN using:

  • VCN peering
  • OCI FastConnect
  • IPsec VPN connection

1.4 Use Cases

OCI File Storage supports many workloads:

  • Lift and shift of enterprise applications
    Migrate existing Oracle applications that need NFS storage, such as Oracle E-Business Suite.

  • Structured and unstructured data growth
    Provides access to an unlimited pool of file systems to manage growing data.

  • Analytic workloads
    Use shared file systems to store persistent data.

  • Scale-out applications

  • Test and development workloads

  • Stateful persistent storage for containers
    Easily scale as your container-based environment grows.

  • High-performance shared storage
    Large compute clusters of thousands of instances can use file storage for high-performance shared storage.

1.5 Data Protection and Security

OCI File Storage includes several protection features:

  • Snapshots for data protection of your file system.
  • Encryption at rest by default for all stored data and snapshot data using AES-256.
  • By default, file systems use Oracle-managed encryption keys.
  • Customers can optionally use customer-managed keys through OCI Vault.
  • In-transit encryption can be configured using TLS to secure data between instances and mounted file systems.

2. File Storage Concepts

OCI File Storage uses three main constructs: the file system, the Mount Target, and exports. The file system stores files. The Mount Target is the highly available NFS endpoint in a subnet that clients connect to. Exports control client access, and each Mount Target maintains an export set containing one or more exports. Export paths uniquely identify file systems within a Mount Target, and export options define client access levels. To mount a file system, you open ports, launch and SSH into an instance, install the NFS client, create a mount point, check Mount Targets in the OCI Console, and run the mount command.

Key Terms

Term Definition
File System The storage where files exist.
Mount Target An NFS endpoint that lives in a subnet and is highly available. It provides the IP address or DNS name used in the mount command.
Export The NFS control layer that controls how NFS clients access file systems when they connect to a Mount Target.
Export Set A collection of one or more exports maintained by a Mount Target.
Export Path A path specified when an export is created. It uniquely identifies the file system within the Mount Target.
Export Options Parameters within an export that specify the level of access granted to NFS clients. Up to 100 options are allowed per export.

Core Concepts

1. File System

The file system is the actual storage location where files exist. It is exported or made available through Mount Targets.

2. Mount Target

A Mount Target is an NFS endpoint that:

  • Lives in a subnet.
  • Is highly available.
  • Provides the IP address or DNS name used in the mount command.
  • Allows NFS clients to connect to a file system.

File systems are exported through Mount Targets. You can reuse the same Mount Target for multiple file systems by specifying an export in the Mount Target for each file system.

3. Export and Export Set

Exports control how NFS clients access file systems when they connect to a Mount Target.

  • Each Mount Target maintains an export set.
  • An export set contains one or many exports.
  • A file system must have at least one export in one Mount Target for instances to mount it.
  • You can create as many exports in a Mount Target for different file systems as you wish.
  • Each file system associated with the Mount Target has at least one export in the export set.

4. Export Path

The export path is specified when an export is created. It:

  • Uniquely identifies the file system within the Mount Target.
  • Lets you associate many file systems to a single Mount Target.

5. Export Options

Export options are a set of parameters within the export. They specify the level of access granted to NFS clients when they connect to a Mount Target. You can have up to 100 options per export.

3. NFS Export Options

NFS Export Options provide granular access control for OCI File Storage. They let you specify access levels for IP addresses or CIDR blocks through exports in a Mount Target. The four parameters are source, ports, access, and squash. You can allow read-only or read-write access, restrict clients so they cannot see each other’s file systems, and remap user and group IDs using squash settings. OCI applies the first matching export option and ignores the rest, so order matters. To deny access completely, the client’s source IP or CIDR must not appear in any export associated with the file system.

Key Terms

Term Definition
NFS Export Options Parameters within an export that specify the level of access granted to NFS clients when they connect to a Mount Target.
Source The IP address or CIDR block of the connecting NFS client.
CIDR Block A range of IP addresses, such as 10.0.0.0/24.
Mount Target The NFS endpoint used by clients to connect to a file system.
Export The NFS control layer that controls how clients access a file system.
Privileged Ports Ports that only the root user can open.
Squash A setting that remaps user IDs (UIDs) and group IDs (GIDs) to anonymous UID/GID.
Read-Only Client can read but not modify files.
Read-Write Client can read and modify files.

Why Use NFS Export Options?

NFS Export Options let you create more granular access control. You can:

  • Specify access levels for IP addresses or CIDR blocks.
  • Control which clients can connect through exports in a Mount Target.
  • Restrict access so that one client’s file system is inaccessible and invisible to another client.
  • Allow or deny access to specific file systems for specific clients.

Export Option Parameters

NFS Export Options include four main parameters:

1. Source

The source is the IP address or CIDR block of the connecting NFS client.

Example:

  • 10.0.0.0/24
  • 10.0.0.8

2. Ports

Ports can be:

  • Privileged — only the root user can open privileged ports.
  • Any — any port can be used.

3. Access

Access can be:

  • Read-only
  • Read-write

4. Squash

Squash determines whether source clients have their user ID (UID) and group ID (GID) remapped to an anonymous UID and GID.

Squash Setting Behavior
All All users and groups are remapped.
Root Only the root user UID and GID combination is remapped.
None No users are remapped.

Example Scenario: Controlling Access Between Two Clients and Two File Systems

Setup

  • File System A
  • File System B
  • Client X — deployed in subnet 10.0.0.0/24
  • Client Y — deployed in subnet 10.0.1.0/24

Requirements

  1. Client X should have read-write access to File System A.
  2. Client X should be denied access to File System B.
  3. Client Y should have read access to File System B.
  4. Client Y should be denied access to File System A.

Solution Using Export Options

For File System A:

  • Source: 10.0.0.0/24
  • Access: Read-write
  • Do not include Client Y’s CIDR in any export for File System A.

For File System B:

  • Source: Client Y’s IP address
  • Access: Read-only
  • Do not include Client X’s CIDR in any export for File System B.

Important Rule for Denying Access

To completely deny a client access to a file system, make sure the client’s source IP address or CIDR block is not included in any export for any Mount Target associated with that file system.

First-Match Evaluation Logic

When an NFS request is made by a client, the File Storage service applies the first set of options that matches the client source IP address. Once the first set is applied, the rest are ignored.

Example

Entry Source Access
1 10.0.0.0/16 Read-only
2 10.0.0.8 Read-write

If a client connects from IP address 10.0.0.8:

  • The request source IP is contained in the CIDR block specified in Entry 1.
  • The service applies the first match.
  • Entry 2 is ignored.
  • Result: The client gets read-only access, not read-write.

4. File System Paths

OCI File Storage uses three kinds of paths:

  • Export paths uniquely identify a file system within a Mount Target. Up to 100 file systems can be associated with a single Mount Target. Export paths cannot be edited after creation.
  • Mount point paths are local directories on a client instance where the remote file system is mounted, such as /mnt/mountpointA.
  • File system paths are paths to directories inside the file system. They contain the file system’s contents and provide access to snapshots under .snapshot/<snapshot_name>.

Understanding these three path types helps you mount, access, and manage OCI File Storage correctly.

Key Terms

Term Definition
Export Path A path that uniquely identifies the file system within the Mount Target.
Mount Point Path A path within a client instance to a locally accessible directory where the remote file system is mounted.
File System Path A path to directories within the file system that contain the contents of the file system.
Mount Target The NFS endpoint used by clients to connect to a file system.
Export The NFS control layer that controls how clients access a file system.
Snapshot A point-in-time copy of a file system, accessible under the file system’s root directory.

Three Kinds of Paths

OCI File Storage uses three kinds of paths:

  1. Export paths
  2. Mount point paths
  3. File system paths

Each path serves a different purpose and exists in a different location.

1. Export Paths

An export path uniquely identifies the file system within the Mount Target.

Key points:

  • You can associate up to 100 file systems behind a single Mount Target.
  • The export path is unrelated to any path within the file system or the client instance.
  • An instance uses the export path to mount or logically attach to the file system.
  • Export paths cannot be edited after the export is created.
  • In the slide example, the export path uniquely identifies a file system within the Mount Target.

Note: The transcript mentions a “CIFS export” in the slide example. In the context of OCI File Storage, this refers to the export path that identifies the file system within the Mount Target.

2. Mount Point Paths

A mount point path is a path within a client instance to a locally accessible directory to which the remote file system is mounted.

Key points:

  • It exists on the client instance, not in the file system.
  • It is the local directory where the external file system is attached.
  • In a mount command, the mount point path appears as the local directory.

Example from the transcript:

/mnt/mountpointA

In this example, /mnt/mountpointA is the path to the directory on the client instance where the external file system is mounted.

3. File System Paths

A file system path is a path to directories within the file system. These directories contain the contents of the file system.

Key points:

  • After the file system is mounted, you can create any directory structure within it.
  • File system paths are used to access files and directories inside the file system.
  • Snapshots of the file system can be accessed using the file system path under the file system’s root directory at:
.snapshot/<snapshot_name>

Example:

  • If you create a snapshot named April 22, you can access it under the file system path at:
.snapshot/April 22

This is known as a file system path.

Comparison of Path Types

Path Type Where It Exists Purpose
Export Path In the Mount Target Uniquely identifies the file system within the Mount Target and is used to mount it.
Mount Point Path On the client instance Local directory where the remote file system is mounted.
File System Path Inside the file system Path to directories and contents within the file system, including snapshots.