NetApp Unified Driver for ONTAP with iSCSI

updated: 2026-10-28 05:41

NetApp Unified Driver for ONTAP with iSCSI¶

The NetApp unified driver for ONTAP with iSCSI is a driver interface from OpenStack Cinder to NetApp ONTAP storage controllers. It enables provisioning and management of storage-area network (SAN) block storage entities, specifically NetApp LUNs that use the iSCSI protocol.

To set up the NetApp ONTAP iSCSI driver for Cinder, add the following stanza to the Cinder configuration file (cinder.conf):

[myIscsiBackend]
volume_backend_name=myIscsiBackend
volume_driver=cinder.volume.drivers.netapp.common.NetAppDriver
netapp_server_hostname=hostname
netapp_server_port=443
netapp_transport_type=https
netapp_ssl_cert_path=/etc/cinder/ontap_ca.pem
netapp_storage_protocol=iscsi
netapp_storage_family=ontap_cluster
netapp_login=admin_username
netapp_password=admin_password
netapp_vserver=svm_name
max_over_subscription_ratio=1.0
reserved_percentage=5
use_multipath_for_image_xfer=True

Ensure the value of the enabled_backends option in the [DEFAULT] stanza includes the name of the backend stanza you chose.
The value of netapp_storage_protocol MUST be set to iscsi.

deployment that uses the iSCSI storage protocol.

Option	Type	Default Value	Description
`netapp_server_hostname`	Required		The hostname or IP address for the storage system or proxy server. The value of this option should be the IP address of either the cluster management LIF or the SVM management LIF.
`netapp_server_port`	Optional		The TCP port to use for communication with the storage system or proxy server. If not specified, ONTAP drivers will use 80 for HTTP and 443 for HTTPS.
`netapp_login`	Required		Administrative user account name used to access the storage system or proxy server.
`netapp_password`	Required		Password for the administrative user account specified in the `netapp_login` option.
`netapp_storage_protocol`	Required		The storage protocol to be used. Valid options are `nfs`, `iscsi`, `nvme` or `fc`.
`netapp_transport_type`	Required	`http`	Transport protocol for communicating with the storage system or proxy server. Valid options include `http` and `https`.
`netapp_size_multiplier`	Optional	1.2	When creating volumes, the quantity to be multiplied to the requested OpenStack volume size to ensure enough space is available on the SVM (aka Vserver). This value is currently only used when ISCSI has been selected as the storage protocol to be used. Deprecated - use reserved_percentage instead.
`netapp_vserver`	Required		This option specifies the storage virtual machine (previously called a Vserver) name on the storage cluster on which provisioning of block storage volumes should occur.
`netapp_storage_family`	Optional	`ontap_cluster`	The storage family type used on the storage system; valid values are `ontap_cluster`, for ONTAP systems.
`netapp_lun_ostype`	Optional	`linux`	This option defines the type of operating system that will access a LUN exported from ONTAP; it is assigned to the LUN at the time it is created.
`trace_flags`	Optional		This option is a comma-separated list of options (valid values include `method` and `api`) that controls which trace info is written to the Cinder logs when the debug level is set to `True`.
`netapp_api_trace_pattern`	Optional	`(.+)`	A regular expression to limit the API tracing. This option is honored only if enabling `api` tracing with the `trace_flags` option. By default, all APIs will be traced.
`netapp_lun_space_reservation`	Optional	`enabled`	This option specifies whether space will be reserved when creating Cinder volumes on NetApp backends using the iSCSI or FC storage protocols. If this option is set to `enabled`, LUNs created during volume creation or volume cloning workflows will always be thick provisioned. If this option is set to `disabled`, LUNs created during volume creation or volume cloning workflows will always be thin provisioned. Note that this option does not affect the implementation of Cinder snapshots, where the LUN clone that represents the snapshot will always be thin provisioned. Valid options are `enabled` and `disabled`.
`netapp_host_type`	Optional	`linux`	This option defines the type of operating system for all initiators that can access a LUN. This information is used when mapping LUNs to individual hosts or groups of hosts. For a list of valid OS types, refer to the ONTAP documentation
`reserved_percentage`	Optional	`0`	This option represents the amount of total capacity of a storage pool that will be reserved and cannot be utilized for provisioning Cinder volumes.
`max_over_subscription_ratio`	Optional	`20.0`	This option is defined as a float, and specifies the amount of over-provisioning to allow when thin provisioning is being used in the storage pool. A value of 1.0 will mean that the provisioned capacity will not be able to exceed the total capacity, while larger values will result in increased levels of allowed over-provisioning.
`netapp_pool_name_search_pattern`	Optional	`(.+)`	This option is only utilized when the Cinder driver is configured to use iSCSI, NVMe or Fibre Channel. It is used to restrict provisioning to the specified FlexVol volumes. Specify the value of this option as a regular expression which will be applied to the names of FlexVol volumes from the storage backend which represent pools in Cinder. `^` (beginning of string) and `$` (end of string) are implicitly wrapped around the regular expression specified before filtering. If `netapp_consistent_replication` is enabled the wildcard must have `.*` or `.+` suffix to detect FlexVol volumes after the site failover.
`use_multipath_for_image_xfer`	Optional		If multipath has been enabled on your OpenStack hosts, then setting this option to `true` will permit Cinder to use multiple paths for increased bandwidth. Use of this option is also contingent upon a modification to the Nova configuration file `nova.conf`. The option `iscsi_use_multipath = True` must be added beneath the [libvirt] stanza contained within `nova.conf`. The inclusion of these options will not affect your OpenStack deployment in the event that multipath is not properly configured on your OpenStack hosts. Consult Recommended host settings for Linux Unified Host Utilities and Linux Unified Host Utilities Guide to configure multipath on your OpenStack hosts
`filter_function`	Optional	(see description)	This option may be used to override the default filter function, which prevents Cinder from placing new volumes on storage controllers that may become overutilized. The default value is “capabilities.utilization < 70”.
`goodness_function`	Optional	(see description)	This option may be used to override the default goodness function, which allows Cinder to place new volumes on lesser-utilized storage controllers. The default value is “100 - capabilities.utilization”.
`use_chap_auth`	Optional		This option is defined as a boolean, and specifies if unidirectional CHAP is enabled. Provides authenticated communication between iSCSI initiators and targets. For ONTAP the TCP port 22 (SSH) on the cluster management LIF must be open and available to set CHAP authentication credentials on the storage system.
`netapp_migrate_volume_timeout`	Optional	`3600`	This option sets time in seconds to wait for a volume Storage Assisted Migration to complete. It’s minimum value is 30 seconds.
`netapp_use_legacy_client`	Optional	`True`	Select which ONTAP client to use for retrieving and modifying data on the storage. The legacy client relies on ZAPI calls. If set to `False`, the new REST client is used, which runs REST calls if supported, otherwise falls back to the equivalent ZAPI call.
`netapp_async_rest_timeout`	Optional	`60`	The maximum time in seconds to wait for completing a REST asynchronous operation.
`netapp_ssl_cert_path`	Optional	(see description)	The path to a CA_BUNDLE file or directory with certificates of trusted CA. If set to a directory, it must have been processed using the `c_rehash` utility supplied with OpenSSL. If not informed, it will use the Mozilla’s carefully curated collection of Root Certificates for validating the trustworthiness of SSL certificates. Only applies when enabling the REST client.
`netapp_ssl_cert_verify`	Optional	`True`	If set to `False`, the SSL certificate of the storage system will not be verified.
`replication_device`	Optional		Identifies a replication target backend. Set to `backend_id:<destination_stanza_name>`. Specify once per replication target. Required to enable any replication policy.
`netapp_replication_aggregate_map`	Optional		Maps source aggregates to destination aggregates for each replication target. Format: `backend_id:<dest_stanza>,src_aggr_1:dst_aggr_1,src_aggr_2:dst_aggr_2,...`. Specify once per replication device. Required when `replication_device` is set.
`netapp_replication_policy`	Optional	`MirrorAllSnapshots`	The ONTAP SnapMirror pre-canned policy to use when creating replication relationships. Valid values: `MirrorAllSnapshots` (async), `Asynchronous` (async), `AutomatedFailOver` (SnapMirror Active Sync asymmetric, REST only, ONTAP 9.15.1+), `AutomatedFailOverDuplex` (SnapMirror Active Sync symmetric/stretched, REST only, ONTAP 9.15.1+). Custom ONTAP policies are not supported. See SnapMirror Replication Policies for Cinder for full details.
`netapp_consistent_replication`	Optional	`False`	When set to `True`, all FlexVolume pools in the backend stanza are protected together under a single shared ONTAP Consistency Group, ensuring crash-consistent failover across all volumes. When `False` (default), each FlexVol is protected with its own SnapMirror relationship. Required (must be `True`) when `netapp_replication_policy` is set to `AutomatedFailOverDuplex`.
`netapp_proximal_nodes`	Optional		A comma-separated list of iSCSI IQNs or FC WWPNs of compute host initiators that are physically local (proximal) to the SVM configured in this backend stanza. Used only when `netapp_replication_policy` is set to `AutomatedFailOverDuplex`. The driver uses this list to set ONTAP igroup host proximity, enabling optimal I/O path selection in a stretched cluster deployment. Set independently in both source and destination stanzas to reflect each site’s local initiators. In the event of site failure the non optimal I/O paths of the failed-over site are selected automatically by the host ensuring near-zero RTO. Example: `netapp_proximal_nodes = iqn.1994-05.com.redhat:host1,iqn.1994-05.com.redhat:host2`.
`netapp_snapmirror_quiesce_timeout`	Optional	`3600`	The maximum time in seconds to wait for existing SnapMirror transfers to complete before aborting during a failover operation. Minimum value: 0.
`netapp_replication_volume_online_timeout`	Optional	`360`	Sets the time in seconds to wait for a replication volume creation to complete and come online. Minimum value: 60 seconds.

Table 4.21. Configuration Options for ONTAP with iSCSI

Caution

If you specify an account in the netapp_login option that only has SVM administration privileges (rather than cluster administration privileges), some advanced features of the NetApp unified driver will not work. You may also see warnings in the Cinder logs. See the section called “Account Permission Considerations” for more details on the required access level permissions for an SVM admin account.

Important

The option netapp_use_legacy_client can only be set to False (storage communication through REST API) when using ONTAP storage 9.11.1 or newer.

updated: 2026-10-28 05:41

This document is licensed under Apache 2.0 license.