Installing UniFS as a Service for Microsoft Azure

UniFS™ as a Service (UaaS) is a Nasuni platform that can perform operations directly on the UniFS file system, hosted in a public cloud. UaaS provides a set of scalable, portable cloud services, deployed within a customer’s cloud tenancy, which interact with UniFS volumes.

Any Nasuni volume backed by Amazon S3 or Microsoft Azure Blob Storage is available to be registered with UaaS.

This document describes how to install UaaS on the Microsoft Azure platform.

Note: Processing can run in a different cloud from the backing data store.

Installation Prerequisites

Several tasks must be performed before deploying UaaS.

Enabling UaaS in Your License

UaaS must be enabled within your Nasuni license. To enable UaaS, contact Nasuni Account Management, Nasuni Support, or your Nasuni authorized reseller.

Acquiring a UaaS Serial Number

You must have a UaaS serial number for both deploying and running UaaS. You can acquire a UaaS serial number from the Portal Dashboard (portal.nasuni.com).

Note: If you require additional serial numbers, contact your Nasuni account team.

To acquire a UaaS serial number, follow these steps:

Log in to the Portal (portal.nasuni.com).
In the “Need a serial number?” section, click UaaS to view a list of available UaaS serial numbers.
From the table, copy a Serial Number that is “unused”. You use this serial number when deploying the UaaS stack.
Record this Serial Number until you use it.

Account ID Registration (for AWS only)

If you are installing UaaS on AWS, the AWS account into which you deploy UaaS requires permission to download the required software. To enable your AWS account to deploy UaaS, contact Nasuni Support.

Continue with Installation

When you have completed the prerequisites, you can continue with the installation process.

Azure Installation Procedure

Follow this procedure to provision the UaaS Resource Group into your Microsoft Azure account.

How UaaS on Azure works

A configured pool of Azure Container Apps is used to process several different ServiceBus queues that are separated by priority and size. The API layer is separated into its own container app in the same container environment. Volume metadata is inventoried and streamed into Cosmos DB using EventHub and Stream Analytics.

Role Prerequisites

As an Azure operator, you can either use the built-in Azure Owner role at the Subscription level or you can use our custom deployment role, which can be attached to a user or to an Enterprise Application Service Principal.

Creating an Enterprise Application

If you want to attach the role to a standard user or already have an enterprise application, you can skip this step.

Otherwise, to create a Service Principal and create credentials, follow the instructions at https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal. You must assign a user as the configuration manager of this Service Principal. However, you should not assign any roles beyond the defaults.

Deploying a UaaS Role

We provide an ARM template in order to deploy the role, with the following options:

deployRoleName: The name of the role you are deploying.
assignPrincipalId (Optional): Principal ID (object ID of your principal) to which the created role is being assigned.
assignPrincipalType (Optional): The type of principal to which you are assigning. Defaults to ServicePrincipal.
Allowed values are Device, ForeignGroup, Group, ServicePrincipal, and User.

When finished, click “Deploy Role to Azure”.

Deploying UaaS Resource Group (RG)

To create a Resource Group in your Azure subscription for use with the UaaS deployment, click “Deploy to Azure”.

Adding a Resource Group administrator

Nasuni does not supply a least-privileges role for the Resource Group. Instead, Nasuni recommends using a built-in role at the ResourceGroup level and assigning that role to your designated Nasuni administrator.

For more information about built-in Azure roles, see Azure built-in roles. To provide appropriate privileges for Resource Group management, Nasuni recommends using the Contributor role.

Deploying the Resource Group

Deployment options

You can deploy the Resource Group using the Azure portal. Several options are available:

Subscription: Subscription where your Resource Group is to be deployed.
- Resource Group: Name of the Resource Group for UaaS deployment.
Resource Details - Region: Region in which the Resource Group is to be deployed.

Deploying the Resource Group via Azure command line

You can also create the Resource Group with the CLI, using a command like:

az group create \

--subscription <subscriptionGuid> \

--location <location> \

--name <uaasStackName>

where

<location> is the location (region) of the deployment

<uaasStackName> is the name of the Resource Group for UaaS deployment

Assigning Roles (Optional)

Note: This step is only required if you want a user who does not have Subscription-level ownership permissions to manage and deploy your stack.

After you have created the Resource Groups, you can assign the Owner role to users within Azure at the Resource Group level. Follow these steps:

Navigate to your newly created Resource Group.
Click Access control (IAM).
Follow these instructions: Assign Azure roles using the Azure portal.
Make sure to assign the built-in, privileged Owner role associated with the Resource Group.

Deploying UaaS on Azure

Authenticating with Azure

Make sure that you are logged into the Azure portal using the same account that you are using to perform the deployment.

Deploying on Azure

You can deploy UaaS on Azure either by using the Deployment Stack Template or by using the CLI.

Deploying with the Deployment Stack Template

To deploy by using the Deployment Stack Template, follow these steps:

On the main UniFS™ as a Service page, click Deploy to Azure.
On the “Custom deployment” page, click "Try it now".
On the “Deploy template as Deployment Stack” page, configure the stack exactly as in this image.

If you have any questions about our recommended settings or cost evaluations, contact your account representative.
After configuring the stack, click "Next" to configure the UaaS deployment.
The following options are available on the UaaS Deployment Stack Template:
- Subscription: Azure subscription name.
- Resource Group: Resource Group name created in the previous step.
- Region: Region where the subscription deployment information is stored.
- Idle Mode: true deploys the stack in an idle state, with the most expensive resources spun down (to save on idle costs). false deploys the stack with all resources spun up.
- Docker Image Tag: Defaults to the latest released version.
- Default Location: This defaults to the Resource Group's location and should not be changed without consulting Support.
- Secondary Location: This is the location (region) where serial number validation occurs during stack deployment. In general, this should be left unchanged.
- Log Level: Logger verbosity setting (defaults to WARNING).
Note: The following Request Unit (Rus) are upper bounds. Users are charged 10 percent of the RUs at rest. So, for 100,000 RUs, users are charged for 10,000 RUs at rest. The minimum allowed value is 1000.
- Provisioned Inv RUs: Number of RUs (Request Units) to provision for the Inventory database.
- Provisioned Inv Meta RUs: Number of RUs (Request Units) to provision for the Inventory Metadata database.
- Provisioned Stats RUs: Number of RUs (Request Units) to provision for the Stats database.
- Serial Number: The serial number retrieved from your Nasuni Account.
- Resource Group Tags: This should be a json object in the form of {"tagName": "tagValue"}.
  See Tag Resources for more information about Azure resource tagging.
After configuring your deployment, click "Next" and then "Create" to deploy the stack.
After reviewing and creating your deployment, you can access your newly created Resource Group directly from the deployment page:

Deploying with the CLI

Alternatively, you can deploy UaaS on Azure by using the CLI.

Note: A resource group must exist for this CLI command to work. For instructions on creating a resource group with the CLI, refer to Deploying the Resource Group via Azure command line on page 7.

Enter this command on the Azure CLI:

az stack group create \

--resource-group <resourceGroup> \

--subscription <subscription> \

--name <deploymentName> \

--template-uri 'https://uaasartifactsprod.blob.core.windows.net/templates/1.1.3/uaas.json?se%3D2030-04-18%26sp%3Dr%26spr%3Dhttps%26sv%3D2022-11-02%26sr%3Dc%26sig%3D03WvkVdD9QQ2LiJkfOn2fuAKbZ4Hy9P1TtIuDB%252BXmDw%253D' \

--deny-settings-mode none \

--cs # Applies deny settings to child resources \

--action-on-unmanage deleteResources \

--output table \

--parameters \

idleMode=true \

dockerImageTag="1.1.3" \

defaultLocation=eastus \

secondaryLocation=eastus \

logLevel=WARNING \

provisionedInvRus=60000 \

provisionedInvMetaRus=20000 \

provisionedStatsRus=60000 \

serialNumber=<mySerialNumber> \

resourceGroupTags="{\"tagName\": \"tagValue\"}"

For the meaning of the various parameters, refer to step 4 on page 9.

Any of the parameters that appear in the --parameters section above can be omitted (with the exception of serial number), and the default is automatically used instead. The parameters are listed explicitly solely in order to clarify the syntax.

<deploymentName> is equivalent to stack name in the template-based deployment. It is a user-chosen name for the deployment stack that is created within the resource group.

A simple installation with all of the defaults can be performed by using a command like:

az stack group create \

--resource-group <resourceGroup> \

--subscription <subscription> \

--name <deploymentName> \

--deny-settings-mode none \

--cs # Applies deny settings to child resources \

--action-on-unmanage deleteResources \

--parameters serialNumber=<mySerialNumber>

Getting the API URL

You can get the Application URL either from the Azure Console or from the CLI. The Application URL is used to create API calls using UaaS.

From the Azure Console

On your Resource Group page, search for “api” under Resources and click the result.

Alternatively, on the API Container App page, the Application URL is listed on the top right.

From the CLI

To output the API URL, run the following command:

az stack group list --resource-group <resourceGroupName> \

| jq -r '.[0].outputs | with_entries( select(.key | contains("Url"))) | .[].value'

Updating the installation

Steps before updating

On Azure, the procedure for updates is almost the same as that for the initial installation, with the exception of deploying the Resource Group.

Updating using the Deployment Console

You can use the link on the main UniFS™ as a Service page, under the Update Existing Azure Stack section.

Use the existing stack name and location.

Updating using the Azure CLI

Follow the same deployment procedure as for the installation.

For the --template-uri parameter, you should use:

https://uaasartifactsprod.blob.core.windows.net/templates/latest/uaas.json?se%3D2030-04-18%26sp%3Dr%26spr%3Dhttps%26sv%3D2022-11-02%26sr%3Dc%26sig%3D03WvkVdD9QQ2LiJkfOn2fuAKbZ4Hy9P1TtIuDB%252BXmDw%253D

After updating your stack, make sure to follow any post-deployment procedures.

Automatic Scaling At Rest

When a UaaS Azure Stack is deployed, the default mode is in an idle state. When a job is requested, the stack performs an automatic scale-up of the resources required to run a job.

UaaS Azure Stacks automatically scale down again after 2 hours of inactivity.
"Inactivity" is defined as:

No jobs in progress or in a failed state.

When a stack is scaled down, the following resources are deleted or stopped in order to save on idle costs:

Provisioned Cosmos Database Containers (inventory is backed up via Archive mechanism).
Event Hubs.
Stream Analytics.
Scaling Rules on Container Apps workers.
Cron schedule for scale-down Container App Job.

The following resources remain active because they produce no (or negligible) idle costs:

Container Apps/Jobs (scaled to 0 at rest).
Container App Environment.
Container Log Analytics.
Provisioned Cosmos Database (we retain the database because deleting and recreating the containers is faster than deleting the entire database definition).
Serverless Cosmos Database.
Archive Storage Account.
ServiceBus Queues.
Dashboard.

Tearing down a stack

Sometimes, you might need to tear down a stack and start over. These instructions help you do that.

Note: Tearing down resources with the command line requires the Azure CLI to be installed.

Note: The command line returns immediately, but it does take up to an hour for all resources to be removed from your subscription. You must wait for ALL resources to be destroyed before redeploying in the same Resource Group.

Navigating to Azure Portal Resource Group

From your Portal homepage, click Resource Groups.

From the Resource Groups landing page, search for your Resource Group. Press Enter to load your search, then click on the Resource Group you want to modify.

Subscription Owner Tear Down

With full Owner privileges on your subscription, you can directly remove the Resource Group without first removing the associated resources.

Tearing down using the Portal

From your Resource Group page, click “Delete resource group”.
Enter your Resource Group name to confirm and click Delete at the bottom.
This process can take from a few minutes to an hour.

Tearing down using the Command Line

Deleting the Resource Group from the command line can be done with a one-line command:

az group delete --subscription <mySubscription> --name <myResourceGroup> --yes --no-wait

where

<mySubscription> is your Azure subscription ID.

<myResourceGroup> is the name of the resource group you are trying to delete.

Resource Group Owner Tear Down

As a Resource Group Owner, you have access to delete the deployment stack, which removes all associated UaaS resources within the Resource group.

Tearing down using the Portal

Click "Deployment stacks" on the Resource Group left area.
Check the checkbox near the "uaas-main" deployment stack.
Click "Delete stack".
Select "Delete all resources, detach resource groups".
Click "Next".
Enter the deployment stack name (uaas-main).
Click "Delete".

Tearing down using the Command Line

Tearing down from the command line is similar to deleting the stack:

az stack group delete \

--action-on-unmanage deleteResources \

--name <deploymentName> \

--resource-group <myResourceGroup>

--subscription <mySubscriptionId>

--yes

where

<mySubscriptionId> is your Azure subscription guid.

<myResourceGroup> is the name of the Resource Group for your deployment.

Note: If you get an error about “--action-on-unmanage”, update your Azure CLI and Azure bicep (az bicep upgrade).

Removing the stack from your Nasuni account

After tearing down the stack, you can decommission the stack and reclaim its associated serial number.

Log in to portal.nasuni.com.
Click Overview > NMC/NEA Serial Numbers.
On the Serial Numbers page, find the row with a Description that matches the name of the stack that you have removed.
Click Decommission.
Confirm that you want to decommission the stack by entering the required text and clicking “Decommission Appliance”.