Discussions related to using object storage as a backup target.
Post Reply
robjohnston
Veeam Software
Posts: 165
Liked: 16 times
Joined: Jun 13, 2016 11:51 pm
Full Name: Rob Johnston
Contact:

Immutability support for Azure Blob

Post by robjohnston »

Hi guys,

I am really desperate for any up to date information on Azure Blob immutability support.
I know that we don't support Blob as they are yet to support Immutability at an "Object Level" however I haven't asked for a few months around this so hopefully there is some more news. Basically my patch (ANZ Federal) has an extremely large MS Footprint requirement, and many up to approx 80% have absolutely no AWS workloads and are standardising on MS for Azure, Azure Storage Accounts, O365, Dynamics 365, SQL MI etc, as a part of their MS Licensing VSA, which is really great for us, (Except for Dynamics and SQL MI) that is.

The big problem is that every single one of them has to move to Immutable/WORM/Offline based Backups for 3 Months as a part of the Federal Government ASD Essential 8. So the only option here for them is:
- Tape (However Everyone here is really trying to get away from tape)
- Cloud/Object (However Must be ASD IRAP Assessed and certified to protected on Prem in Australia with Data Sovereignty certification) AWS S3 (Object Lock) is the only supported Cloud they can use that supports our Immutability integration.
-On Prem (Currently Cloudian is the only On Prem option this far that supports Object Lock API's but its not currently in use in Govt in ANZ which will make it hard)

So It will be a huge thing for us locally to push for MS to get Immutability support with Veeam and Azure Blob for both VBR & O365. @Mike Resseler Do you know if there is at least something on the long term roadmap, even if its 12 months away? I have a meeting in the day or so with a customer (300 Sockets) who is all in with Azure, and needs immutable backups as a mandatory requirement across all backups, who does not want to buy any more on Prem storage, and I want to give them some ok news, rather than sorry can't help, when other vendors are banging on the door with supported offerings.

Thanks folks,
Rob
HannesK
Product Manager
Posts: 14844
Liked: 3086 times
Joined: Sep 01, 2014 11:46 am
Full Name: Hannes Kasparick
Location: Austria
Contact:

Re: Immutibility support for Azure Blob

Post by HannesK »

Hi Rob,
my answer will probably not make you happy... I assume that you read the weekly forum digest from today with some explanation.
Currently Cloudian is the only On Prem option this far that supports Object Lock API's
Please check out the list... Cloudian is not the only on-prem storage with object lock support

Can you play it the other way round: will Microsoft offer WORM functionality based on objects?

From your options above: would a VTL in Azure meet the requirements?
something on the long term roadmap, even if its 12 months away
even if it was planned for "long distant future", plans can change. That's why we do not communicate that far away future anymore. https://team.veeam.com/apps/news/Pages/ ... admap.aspx

Best regards,
Hannes
Andreas Neufert
VP, Product Management
Posts: 7081
Liked: 1511 times
Joined: May 04, 2011 8:36 am
Full Name: Andreas Neufert
Location: Germany
Contact:

Re: Immutibility support for Azure Blob

Post by Andreas Neufert »

Please reach out to the Azure Team directly and let them know your situation.
We can not comment on the Microsoft roadmap and timing. Microsoft has as well an idea how they can help you in your situation.

For the more official solutions. A VTL with WORM support that works with BLOB storage based object lock would I think fit the need until Microsoft added the functionallity.
Gostev
Chief Product Officer
Posts: 31814
Liked: 7302 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: Immutibility support for Azure Blob

Post by Gostev »

robjohnston wrote: Mar 16, 2020 5:28 amDo you know if there is at least something on the long term roadmap, even if its 12 months away?
When we met with Azure Storage leadership in Prague half a year ago, it sounded like this feature was a priority for them. At least they clearly understood that without this feature, the moment v10 is out, they will start losing their customers to Amazon.
robjohnston
Veeam Software
Posts: 165
Liked: 16 times
Joined: Jun 13, 2016 11:51 pm
Full Name: Rob Johnston
Contact:

Re: Immutibility support for Azure Blob

Post by robjohnston »

Andreas Neufert wrote: Mar 16, 2020 9:50 am Please reach out to the Azure Team directly and let them know your situation.
We can not comment on the Microsoft roadmap and timing. Microsoft has as well an idea how they can help you in your situation.

For the more official solutions. A VTL with WORM support that works with BLOB storage based object lock would I think fit the need until Microsoft added the functionallity.
Andreas, do you or anyone have any suggustions on supported solutions that is Enterprise Ready? Customer we need to Advise on is around 400 Sockets and has a lot of Data.

Thanks mate,

Rob
HannesK
Product Manager
Posts: 14844
Liked: 3086 times
Joined: Sep 01, 2014 11:46 am
Full Name: Hannes Kasparick
Location: Austria
Contact:

Re: Immutibility support for Azure Blob

Post by HannesK » 1 person likes this post

if I google for "azure vtl" then I find Veeam + Starwind (it seems Azure does not have a "native" VTL like AWS). I would talk to Starwind as a first step and task them for help with sizing etc.
robjohnston
Veeam Software
Posts: 165
Liked: 16 times
Joined: Jun 13, 2016 11:51 pm
Full Name: Rob Johnston
Contact:

Re: Immutibility support for Azure Blob

Post by robjohnston »

Thanks Hannes. But I was hoping for something a little more tested and referenceable if possible :) I found the same thing with Starwind in a google search.
HannesK
Product Manager
Posts: 14844
Liked: 3086 times
Joined: Sep 01, 2014 11:46 am
Full Name: Hannes Kasparick
Location: Austria
Contact:

Re: Immutibility support for Azure Blob

Post by HannesK » 1 person likes this post

I don't believe that anyone is using VTLs at large scale with Veeam in the cloud, because our object storage implementation makes just so much more sense. It's probably even harder to find a reference for a "stupid idea" :-)

But it's not about us. It's about Starwind handling a lot of data. For us it's "just a tape library".

As I said earlier: I would play it via Microsoft. The customer should talk to them about their future plans about object locks instead of bucket locks.
Gostev
Chief Product Officer
Posts: 31814
Liked: 7302 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: Immutibility support for Azure Blob

Post by Gostev » 2 people like this post

Exactly. Customers should push Microsoft to deliver this feature, threatening to switch to Amazon otherwise!
robjohnston
Veeam Software
Posts: 165
Liked: 16 times
Joined: Jun 13, 2016 11:51 pm
Full Name: Rob Johnston
Contact:

Re: Immutibility support for Azure Blob

Post by robjohnston »

Thanks guys,

The problem is that other Backup vendors support Azure immutable storage, and for them it's a lot simpler and easier to change a backup solution to meet their compliance check box that it needs to comply with, than it is to create a new Government procurement contract with AWS, setup Direct connect, retrain all of their staff on AWS. Most simply have no procurement contract whatsoever with AWS.

It's simply not going to happen in Federal here (Aka Customers will jump to AWS) and unfortunately MS Know it. They are too intrenched into a Microsoft VSA. Is there no way we can make this work? we did it for NDMP. lol
HannesK
Product Manager
Posts: 14844
Liked: 3086 times
Joined: Sep 01, 2014 11:46 am
Full Name: Hannes Kasparick
Location: Austria
Contact:

Re: Immutibility support for Azure Blob

Post by HannesK » 1 person likes this post

Is there no way we can make this work?
what kind of answer do you expect? we mentioned the workarounds and also gave the answer we will support it if Microsoft supports object lock.

If federal does not care about costs, well, that's a special situation. most customers change their mind by asking them "do you want to pay 10M or 3M?" for example.

remember the time when we could not backup physical machines and there was no workaround?
Gostev
Chief Product Officer
Posts: 31814
Liked: 7302 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: Immutibility support for Azure Blob

Post by Gostev »

robjohnston wrote: Apr 01, 2020 2:21 amto meet their compliance check box that it needs to comply with
As it was already suggested above, VTL to Azure blob storage container with immutability enabled checks the box, and is as effective as those vendors who support Azure immutability natively.
robjohnston
Veeam Software
Posts: 165
Liked: 16 times
Joined: Jun 13, 2016 11:51 pm
Full Name: Rob Johnston
Contact:

Re: Immutibility support for Azure Blob

Post by robjohnston »

Thanks Anton, does anyone have an example or an idea of one that may be ok? Please be mindful They have a huge amount of StoreOnce 5500's onsite with Catalyst stores as their Primary and Secondary Veeam Repo's. (Wasn't my design but is what I am working with)

In all of the reading I have done, as I have never deployed one, most VTL's including Starwind seem to require ISCSI storage available on Premise to use as a Target before it pushes out to Blob, customer doesn't want to purchase any more storage on prem and the StoreOnce's won't be a good candidate to land a VTL Disk on to it.

Rob
HannesK
Product Manager
Posts: 14844
Liked: 3086 times
Joined: Sep 01, 2014 11:46 am
Full Name: Hannes Kasparick
Location: Austria
Contact:

Re: Immutibility support for Azure Blob

Post by HannesK »

most VTL's including Starwind seem to require ISCSI storage available on Premise to use as a Target before it pushes out to Blob,
I have seen a couple of iSCSI VTLs in our labs and I have never heard of that requirement. Do you have a documentation or something on that? I only know the way that the VTL is connected via iSCSI instead of Fibre Channel / SAS
jmmarton
Veeam Software
Posts: 2097
Liked: 310 times
Joined: Nov 17, 2015 2:38 am
Full Name: Joe Marton
Location: Chicago, IL
Contact:

Re: Immutibility support for Azure Blob

Post by jmmarton »

I believe Starwind's solution requires local storage to be used as a cache before sending data to "tapes" (aka object storage), but I don't think there's an iSCSI requirement. You just need some space on C: or D: or wherever you are running it since it's a Windows-based solution. At least that's what I recall from my little bit of exposure to it.

Joe
Andreas Neufert
VP, Product Management
Posts: 7081
Liked: 1511 times
Joined: May 04, 2011 8:36 am
Full Name: Andreas Neufert
Location: Germany
Contact:

Re: Immutibility support for Azure Blob

Post by Andreas Neufert »

The connection to the Veeam Tape server is done by iSCSI.
jmmarton
Veeam Software
Posts: 2097
Liked: 310 times
Joined: Nov 17, 2015 2:38 am
Full Name: Joe Marton
Location: Chicago, IL
Contact:

Re: Immutibility support for Azure Blob

Post by jmmarton »

Yes, the tape connection is iSCSI. But not the local disk cache storage.

Joe
R.Deemer
Influencer
Posts: 19
Liked: 2 times
Joined: Apr 25, 2018 8:30 pm
Full Name: Ryan Deemer
Contact:

Re: Immutibility support for Azure Blob

Post by R.Deemer »

Reviving this thread. Is there any update on immutability for Azure Blob?
HannesK
Product Manager
Posts: 14844
Liked: 3086 times
Joined: Sep 01, 2014 11:46 am
Full Name: Hannes Kasparick
Location: Austria
Contact:

Re: Immutibility support for Azure Blob

Post by HannesK »

Microsoft did not release object lock yet. So no change for today.
Gostev
Chief Product Officer
Posts: 31814
Liked: 7302 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: Immutibility support for Azure Blob

Post by Gostev »

No changes.
Gostev
Chief Product Officer
Posts: 31814
Liked: 7302 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: Immutability support for Azure Blob

Post by Gostev » 1 person likes this post

And I'm hearing from @johan.h they are really struggling to deliver it, so much it leaves us no time to include support even in V12!
johan.h
Veeam Software
Posts: 723
Liked: 185 times
Joined: Jun 05, 2013 9:45 am
Full Name: Johan Huttenga
Contact:

Re: Immutability support for Azure Blob

Post by johan.h » 2 people like this post

Yes, this has slipped quite a few times now. This functionality is tied to the versioning system in Azure Storage and has taken longer than expected.

Microsoft's initial intent was to GA in line with Ignite 2021. We don't even have a preview yet. At this point we're being given vague dates around when that would be, and it appears it may be far enough in the future that it is very unlikely to fit in the schedule for v12. They have escalated this internally. Even if we get access our team will of course need to test, build and validate everything.
jvl
Enthusiast
Posts: 44
Liked: 1 time
Joined: Sep 09, 2014 1:12 pm
Full Name: jvl
Contact:

Re: Immutability support for Azure Blob

Post by jvl »

Just for your info last update I got from MS is the following (don't know if it's correct since the dates are indeed constantly moving..)
Stage Estimated ETA
Private Preview (Canary and REST support) Mid-April
Private Preview (Pilot+ and .NET support) May 11
Public Preview (France and Canada) July
GA September

Other question don't know If I'm allowed to ask it here but its also related to our roadmap and to protect the storage account BLOBs when offloading data into Azure. Are there any plans to do authentication via Azure AD Managed Service Identities?

The context of this question is the following: this is an Azure service where on-premises VMs can be managed from the Azure portal. A nice feature here is that an Azure Arc enabled server can get an identity in the Azure Active Directory (Azure AD), a "managed identity". This is currently the most secure and accepted way of authentication because there are no credentials that can leak, be rotated, etc. etc.
If the VEEAM software runs on a VM, it could request an MSI token instead of authenticating against the storage account with a SAS token or service principal. Is this on our roadmap?
mariuszr
Veeam Software
Posts: 303
Liked: 44 times
Joined: May 15, 2013 10:40 am
Full Name: Mariusz Rybusiński
Location: Poland
Contact:

Re: Immutability support for Azure Blob

Post by mariuszr »

Just for your info last update I got from MS is the following (don't know if it's correct since the dates are indeed constantly moving..)
Stage Estimated ETA
Private Preview (Canary and REST support) Mid-April
Private Preview (Pilot+ and .NET support) May 11
Public Preview (France and Canada) July
GA September
From my source preview will be in Q3, GA in Q4.
Gostev
Chief Product Officer
Posts: 31814
Liked: 7302 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: Immutability support for Azure Blob

Post by Gostev »

@jvl as always we can't comment on the roadmap. Also, please don't derail the discussion with completely unrelated queries. Just create a new topic (if you can't find an existing discussion), it costs literally nothing to keep this forum tidy and easily consumable. Thanks!
Post Reply

Who is online

Users browsing this forum: No registered users and 11 guests