Overview AIStor supports keeping multiple “versions” of an object in a single bucket. When enabled, versioning allows AIStor to keep multiple iterations of the same object. Write operations which would normally overwrite an existing object instead result in the creation of a new version of the object. AIStor versioning protects from unintended overwrites and deletions while providing support for “undoing” a write operation. Bucket versioning is a prerequisite for configuring object locking and retention rules.

For identities managed by an external OpenID Connect (OIDC) compatible provider, AIStor can use either of two methods to assign policies to the authenticated user. AIStor by default denies access to all actions or resources not explicitly allowed by a user’s assigned or inherited policies. Authorization options with OIDC OIDC integration in AIStor supports either of the following authorization methods:

Install on Red Hat Enterprise Linux Deploy AIStor onto RHEL 10+

AIStor supports publishing bucket notification events to NSQ service endpoint. Prerequisites The AIStor mc Command Line Tool This procedure uses the mc command line tool for certain actions. See the mc Quickstart for installation instructions. Add an NSQ endpoint to an AIStor Server The following procedure adds a new NSQ service endpoint for supporting bucket notifications in an AIStor Server.

MinIO Documentation Welcome to the MinIO Documentation. Select your product from the list below to open its documenta...

ToDO: Add documentation on AIStor Key Manager Helm Chart.

Overview Output the contents of a secret. Syntax kes secret show \ <name> \ [--color <string>] \ [--insecure, -k] \ [--json] \ [--plain, -p] Parameters name Required

This procedure provides guidance for enabling Server-Side Encryption (SSE) using AIStor Key Manager as the Key Management Service (KMS). Enabling SSE on an AIStor deployment automatically encrypts the backend data for that deployment using the default encryption key selected during the setup process. AIStor requires access to the Key Manager to decrypt the backend and start normally. You can neither disable nor reset encryption of the backend.

This section provides documentation on Day 2 operations of AIStor Key Manager deployments.

replace.sh Use the below script to replace a drive. See replacing a drive for more information on how to use this script. #!/usr/bin/env bash # # This file is part of AIStor Volume Manager # Copyright (c) 2023 AIStor, Inc. # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU Affero General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU Affero General Public License for more details. # # You should have received a copy of the GNU Affero General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # # This script replaces source drive to destination drive in the specified node # set -e # usage: get_drive_id <node> <drive-name> function get_drive_id() { kubectl get directpvdrives \ --selector="directpv.min.io/node==${1},directpv.min.io/drive-name==${2}" \ -o go-template='{{range .items}}{{.metadata.name}}{{end}}' } # usage: get_volumes <drive-id> function get_volumes() { kubectl get directpvvolumes \ --selector="directpv.min.io/drive=${1}" \ -o go-template='{{range .items}}{{.metadata.name}}{{ " " | print }}{{end}}' } # usage: get_pod_name <volume> function get_pod_name() { # shellcheck disable=SC2016 kubectl get directpvvolumes "${1}" \ -o go-template='{{range $k,$v := .metadata.labels}}{{if eq $k "directpv.min.io/pod.name"}}{{$v}}{{end}}{{end}}' } # usage: get_pod_namespace <volume> function get_pod_namespace() { # shellcheck disable=SC2016 kubectl get directpvvolumes "${1}" \ -o go-template='{{range $k,$v := .metadata.labels}}{{if eq $k "directpv.min.io/pod.namespace"}}{{$v}}{{end}}{{end}}' } function init() { if [[ $# -eq 4 ]]; then echo "usage: replace.sh <NODE> <SRC-DRIVE> <DEST-DRIVE>" echo echo "This script replaces source drive to destination drive in the specified node" exit 255 fi if ! which kubectl >/dev/null 2>&1; then echo "kubectl not found; please install" exit 255 fi if ! kubectl directpv --version >/dev/null 2>&1; then echo "kubectl directpv not found; please install" exit 255 fi } function main() { node="$1" src_drive="${2#/dev/}" dest_drive="${3#/dev/}" # Get source drive ID src_drive_id=$(get_drive_id "${node}" "${src_drive}") if [ -z "${src_drive_id}" ]; then echo "source drive ${src_drive} on node ${node} not found" exit 1 fi # Get destination drive ID dest_drive_id=$(get_drive_id "${node}" "${dest_drive}") if [ -z "${dest_drive_id}" ]; then echo "destination drive ${dest_drive} on node ${node} not found" exit 1 fi # Cordon source and destination drives if ! kubectl directpv cordon "${src_drive_id}" "${dest_drive_id}"; then echo "unable to cordon drives" exit 1 fi # Cordon kubernetes node if ! kubectl cordon "${node}"; then echo "unable to cordon node ${node}" exit 1 fi mapfile -t volumes < <(get_volumes "${src_drive_id}") IFS=' ' read -r -a volumes_arr <<< "${volumes[@]}" for volume in "${volumes_arr[@]}"; do pod_name=$(get_pod_name "${volume}") pod_namespace=$(get_pod_namespace "${volume}") if ! kubectl delete pod "${pod_name}" --namespace "${pod_namespace}"; then echo "unable to delete pod ${pod_name} using volume ${volume}" exit 1 fi done if [ "${#volumes_arr[@]}" -gt 0 ]; then # Wait for associated Volume Manager volumes to be unbound while kubectl directpv list volumes --no-headers "${volumes_arr[@]}" | grep -q Bounded; do echo "...waiting for volumes to be unbound" sleep 10 done else echo "no volumes found in source drive ${src_drive} on node ${node}" fi # Run move command kubectl directpv move "${src_drive_id}" "${dest_drive_id}" # Uncordon destination drive kubectl directpv uncordon "${dest_drive_id}" # Uncordon kubernetes node kubectl uncordon "${node}" } init "$@" main "$@" push-images.sh Use this script to push all required images to a private registry.