Immutability with on-prem S3 storage

[mdiver]

As far as I get it, minio should support the S3 object lock feature:
https://docs.min.io/docs/minio-client-c ... guide#lock

Could that be leveraged by the immutability function within 9.5 U4?

Regards,
Mike

[wishr]

Hi Mdiver,

v9.5U4 doesn't support immutability at all, it's a v10 feature.

In general, v10 supports immutability feature on any S3-compatible devices which implements S3 Object Lock API.

However, Minio did not release this API until most recently, so we have not been using it in our QC labs for v10 to validate their API implementation. I have spoken to our QC leadership about it, and they will schedule this testing for post v10.

Thanks

[edirschedl]

@wishr: Do you have a list of tested object storage devices with the V10 immutability feature?

[Gostev]

We've been testing with Cloudian, since there were not too many alternatives at the time.

[edirschedl]

Do you plan to integrate the immutability feature as criteria for VEEAM Ready, after releasing V10?

[DGrinev]

I have heard it will be a part of the Veeam Ready program.

Thanks!

[Gostev]

But optional part, of course.

[edirschedl]

Does someone has a list of object storage products where S3 object lock is already possible? I've the feeling that there is not much choice in this area currently.

I know only from AWS (of course), Cloudian and Minio currently after reading this thread.

[sfirmes]

We are currently working with our technical alliance partners who support the S3 object lock feature as they continue to test their offerings with our V10 immutability feature. We are also working on including optional immutability tests in our Veeam Ready Object program for v10 for any alliance partner who supports S3 object locking.

[Gostev]

I know only from AWS (of course), Cloudian and Minio currently after reading this thread.

You can also add Zadara to that list.

[mengl]

Did a quick test today with minio.

Failed to enable backup immutability: the selected object storage does not support S3 Object Lock feature

Does this have to be enabled in minio?


Minio DEVELOPMENT.GOGET most current of today
VBR v10 RTM 10.0.0.442

[sfirmes]

Yes they do support the S3 object locking. This isnt their WORM setting. That got me on my 1st tests.

I am testing minio running on Centos 8 with our v10 RTM code using the S3 API CLI.

I used the following commands to create the locked/immutable bucket:

Code: Select all

[root@Minio-Centos minio]# mc mb myminio/testlock --with-lock
Bucket created successfully `myminio/testlock`.

[root@Minio-Centos minio]# mc lock myminio/testlock compliance 30d
COMPLIANCE mode is enabled for 30d

This is how I was able to confirm it.

[root@Minio-Centos minio]# aws --no-verify-ssl --endpoint-url https://minio:9000 s3api get-object-lock-configuration --bucket testlock
{
    "ObjectLockConfiguration": {
        "ObjectLockEnabled": "Enabled",
        "Rule": {
            "DefaultRetention": {
                "Mode": "COMPLIANCE",
                "Days": 30
            }
        }
    }
}

During the next few weeks, I will be running minio through other testing via the v10 gui and will update this thread with any tips or issues that may help you.

[mengl]

Thanks. Thats it!
With the lock option configured I was able to add it with immutability enabled.

[sfirmes]

Thanks. Thats it!
With the lock option configured I was able to add it with immutability enabled

Were you able to verify if the immutability was working? In my testing I got errors during the SOBR offload process due to versioning not being on the Minio bucket.

We require versioning to be enabled on the bucket when object locking is enabled. Minio doesn't support versioning and based on their feature request page they don't intend to https://github.com/minio/minio/pull/649 ... -497511953

You can verify if you have versioning enabled by the using AWS S3 API cmd "get-bucket-versioning" https://docs.aws.amazon.com/cli/latest/ ... oning.html

The syntax to use the AWS S3 API with the Minio cli is here:
# aws --no-verify-ssl --endpoint-url https://<>ip address or server name>:9000 s3api get-bucket-versioning --bucket <bucket name>

I will continue to work with Minio and will update this thread if I learn anything regarding getting Minio to work with our immutability feature.

[y4m4]

MinIO doesn't support versioning yet but it is being actively worked on https://github.com/minio/minio/tree/xl-v2

The relevant issue to track https://github.com/minio/minio/issues/2 ... -577406100

[Gostev]

Thanks, Fnu. I see you're from MinIO, so I marked your forum account as TAP. Please, keep the community posted on the progress.

[sfirmes]

When the versioning is supported by Minio, I will do some testing and post the results in this thread.

[poulpreben]

You can also add Zadara to that list.

You can add Ceph version >= 14.2.6 to that list.

[dalbertson]

Ceph would need to be tested with Veeam Ready. @poulpreben

@sfirmes Lets discuss this today

[sfirmes]

Thanks @poulpreben and @dalbertson. When any Ceph testing is done, I will post the results.

[Gostev]

Just wanted to update that both Cloudian and Zadara have passed Veeam Ready for Object Storage, including optional immutability support verification. Thanks!

[UniMatrix]

Started following this topic as the idea is taking shape to add an expansion cabinet to our Synology RS3617RPxs (Backup Copy target in another building) and run Minio on Docker on it to present an immutable datastore to VeeAm.

[sfirmes]

Currently Minio isn’t compatible with our immutability feature due to them not supporting versioning. I expect them to have versioning support soon and when they do they will be tested. I’ll update this thread when they successfully pass the tests.

[Andreas Neufert]

We always share latest infos here: object-storage-f52/unoffizial-compatibi ... 56956.html

[Mattias]

Hi !

Does immutable object lock work/supported on NetApp S3 GRID on prem ? Anyone know ?

[sfirmes]

@Mattias The NetApp S3 GRID doesn't have this feature yet. When it does we will update the list noted above.

[HendersonD]

In the What's New for Veeam 10 is this

"The new immutable backups feature protects your recent backup copies from modification and deletions by leveraging advanced object storage functionality called S3 Object Lock. You can create immutable backup copies on Amazon S3, as well as any S3-compatible service provider or on-premises object storage solution which implements S3 Object Lock AP"

We are looking to take advantage is this feature. Are there any "on-premises object storage solution which implements S3 Object Lock AP"? We use Nimble Storage, does it have this feature? Do I need to contract with Amazon to get a target that uses this feature?

[wishr]

Hi HendersonD,

I'm merging your question with an existing tread. Please, take a quick look and let us know if you have any additional questions.

Thanks

[sfirmes]

@HendersonD There is a link in a previous post by Andreas in this thread with a link to the unofficial compatibility list.

[dalbertson]

@HendersonD as stated above we will list the vendors who passed Veeam ready testing on the veeam ready page.

https://www.veeam.com/ready.html

object-storage-f52/unoffizial-compatibi ... 56956.html

Right now netapp isn’t on there. A few others are close. You could leverage S3