From Zed cycle, NetApp drivers NFS, iSCSI and FCP have the option to request ONTAP operations through REST API. By default, the drivers keep working as before using ZAPI communication. If desired, the REST communication can be selected. Consistency group snapshots and the operations in Native REST operations have REST implementations. Operations that do not yet have a REST implementation still fall back to ZAPI.
The NVMe/TCP ONTAP driver has been delivered with Antelope cycle. This driver only runs with REST communication mode and it does not require enabling this mode as other driver does.
Important
The REST mode still relies on ZAPI for some calls, so the ONTAP
administrative user account must have access for running ONTAPI
application even when using the drivers with REST communication mode.
Important
The drivers can only be configured with REST communication with ONTAP storage 9.11.1 or newer.
Caution
Enabling ONTAP REST client changes the behavior of QoS specs. Earlier, QoS values could be represented in BPS (bytes per second), but now REST client only supports integer values represented in MBPS (Megabytes per second). It means that though the operators specify the QoS value in BPS, it will be converted to MBPS and rounded up. It only affects new volumes.
To enable REST client for the NetApp ONTAP drivers (iSCSI, FCP or NFS), the following option should be added to the appropriate NetApp stanza in the Cinder configuration file (cinder.conf).
[myONTAPBackend]
netapp_use_legacy_client = False
Note
Operations running with REST client may take some time to be finished. The
option netapp_async_rest_timeout configures the time to wait for the
completion. Default is 60 seconds.
When netapp_use_legacy_client is False, REST implementations exist
for the operations below. Presence of an implementation is not validation
that every path has been exercised on REST:
Canceling an in-progress file copy during error cleanup. The REST client stops the copy job, and the driver then removes the partially copied destination file.
Assigning a QoS policy to an existing LUN, including when an existing LUN is brought under Cinder management. One REST field is used for both adaptive and non-adaptive policies.
Looking up, renaming, and cleaning up stale snapshots during snapshot housekeeping.
Creating crash-consistent snapshots across a group of volumes.
Reporting per-file space usage, used when deciding which cached images can be removed.
Reporting clone-split progress and deduplication space savings for a volume.
A crash-consistent group snapshot is created by making a short-lived ONTAP consistency group, taking the group snapshot, and then deleting that consistency group. The snapshot on each volume remains available for cloning and is removed after the clones finish. The REST client does not fall back to ZAPI for the consistency group snapshot start and commit steps.
Warning
Volume groups with snapshots using FlexGroup on the NFS driver may not work due to ONTAP’s restriction on adding FlexGroup to consistency groups. The volume group snapshot implementation depends on CG snapshots. FlexGroup cannot be added to a consistency group.
Reporting per-file space usage and deduplication space savings uses the
private CLI endpoints /private/cli/volume/file/show-disk-usage and
/private/cli/volume/efficiency. Public REST equivalents are not available
yet.
Beginning with the Hibiscus release, the NetApp ONTAP Cinder driver defaults
to HTTPS for ONTAP management communication. The netapp_transport_type
option now defaults to https, and certificate verification is enabled by
default through netapp_ssl_cert_verify (default True). These settings
apply to both REST and legacy ZAPI client paths.
|
|
|
Expected behavior |
|---|---|---|---|
|
not set or |
not set |
Backend initializes only if ONTAP presents a certificate trusted by the system CA bundle. Fails with self-signed ONTAP certificates. |
|
|
not set |
Backend initializes. TLS encryption is used but certificate identity is not verified. Not recommended for production. |
|
not set or |
set to ONTAP CA/cert PEM |
Backend initializes. Recommended for self-signed or private-CA ONTAP certificates. |
|
any |
any |
Backend initializes over HTTP. No TLS validation applies. A startup warning is logged. |
If HTTPS with certificate verification fails, the cinder-volume service
cannot start the backend. Operators see DriverNotInitialized and volume
provisioning does not complete.
Production deployment with a self-signed or private-CA ONTAP certificate:
[myONTAPBackend]
netapp_transport_type = https
netapp_ssl_cert_verify = true
netapp_ssl_cert_path = /etc/cinder/ontap_ca.pem
Fallback for lab or trusted networks only:
[myONTAPBackend]
netapp_transport_type = https
netapp_ssl_cert_verify = false
Preserve pre-Hibiscus HTTP behavior:
[myONTAPBackend]
netapp_transport_type = http
netapp_server_port = 80
Important
Upgrading from Gazpacho to Hibiscus
Backends that relied on the implicit http default will now attempt
HTTPS on port 443. If ONTAP is only reachable over HTTP (port 80),
explicitly set netapp_transport_type = http.
Backends with netapp_server_port = 80 but no
netapp_transport_type may fail or behave unexpectedly after upgrade.
Set netapp_transport_type = http or migrate ONTAP management to HTTPS
on port 443.
Deployments using ONTAP self-signed certificates must set
netapp_ssl_cert_path to a trusted PEM, or explicitly set
netapp_ssl_cert_verify = false (not recommended for production).
When ONTAP management certificates expire, backends will fail until trust
material is renewed or netapp_ssl_cert_verify = false is explicitly
set.
Explicit http or ssl_cert_verify = false configurations continue
to work but log startup warnings.
Caution
Setting netapp_ssl_cert_verify = false keeps TLS encryption enabled but
disables certificate identity verification. This is not recommended for
production deployments.
Note
The driver logs startup warnings when netapp_transport_type = http or
netapp_ssl_cert_verify = false is explicitly configured.
This document is licensed under Apache 2.0 license.