NDS for Azure - Installation and Management

Overview

Nasuni Data Service (NDS) provides access to data stored on Nasuni volumes via an Azure Blob Storage–compatible interface.

This guide explains how to:

• Deploy UniFS as a Service (UaaS) in Microsoft Azure (NDS is a component of the UaaS platform).

• Enable and configure NDS for one or more volumes.

• Retrieve connection information.

• Update an existing deployment.

Audience and Scope

This document is intended for administrators who manage Nasuni environments and Azure resources.

You should be comfortable with the following:

• Nasuni Management Console (NMC).

• Azure Resource Manager concepts.

• PowerShell 7+.

Prerequisites

Ensure you have the following prerequisites before beginning.

Nasuni

• UaaS serial number and authentication code.

  • Serial numbers and authentication codes are available in the Nasuni Portal.

    Note: NDS is available at no additional cost. Contact your Account Manager to request licensing for NDS.

• NMC version 25.1 or higher.

• Nasuni Edge Appliance (NEA) version 10.0.1 or higher.

• The target volumes must be shared (Remote Access enabled) via the NMC.

• Azure or AWS object storage for the target volumes.

  Important: Connecting to object storage in a different cloud provider or region than your NDS deployment generates cloud egress costs, billed to you by AWS or Azure. To avoid these charges, whenever possible, deploy NDS in the same provider and region as the object storage.

Software

• PowerShell 7.0 or higher.

• Azure PowerShell module (Az) version 14.0.0 or higher.

Azure subscription and permissions

• An active Azure subscription.

• Owner access at the scope of the resource group used for deployment.

  • Alternatively, create a custom Azure role with granular permissions. Reference the example JSON below with the minimum requirements when creating a custom role.

    "permissions": [
                {
                    "actions": [
                        "Microsoft.Authorization/roleAssignments/read",
                        "Microsoft.Authorization/roleAssignments/write",
                        "Microsoft.Authorization/roleAssignments/delete",
                        "Microsoft.Resources/subscriptions/resourceGroups/read",
                        "Microsoft.Resources/subscriptions/resourceGroups/write",
                        "Microsoft.Resources/subscriptions/resourceGroups/delete",
                        "Microsoft.Resources/deployments/read",
                        "Microsoft.Resources/deployments/write",
                        "Microsoft.Resources/deployments/delete",
                        "Microsoft.Resources/deployments/operationstatuses/read",
                        "Microsoft.Resources/deploymentScripts/read",
                        "Microsoft.Resources/deploymentScripts/write",
                        "Microsoft.Resources/deploymentScripts/delete",
                        "Microsoft.Resources/deploymentStacks/read",
                        "Microsoft.Resources/deploymentStacks/write",
                        "Microsoft.Resources/deploymentStacks/delete",
                        "Microsoft.Storage/storageAccounts/read",
                        "Microsoft.Storage/storageAccounts/write",
                        "Microsoft.Storage/storageAccounts/delete",
                        "Microsoft.Storage/storageAccounts/blobServices/read",
                        "Microsoft.Storage/storageAccounts/blobServices/write",
                        "Microsoft.Storage/storageAccounts/blobServices/containers/read",
                        "Microsoft.Storage/storageAccounts/blobServices/containers/write",
                        "Microsoft.Storage/storageAccounts/blobServices/containers/delete",
                        "Microsoft.Storage/storageAccounts/listKeys/action",
                        "Microsoft.Storage/storageAccounts/managementPolicies/read",
                        "Microsoft.Storage/storageAccounts/managementPolicies/write",
                        "Microsoft.Storage/storageAccounts/managementPolicies/delete",
                        "Microsoft.ServiceBus/namespaces/authorizationRules/read",
                        "Microsoft.ServiceBus/namespaces/authorizationRules/write",
                        "Microsoft.ServiceBus/namespaces/authorizationRules/delete",
                        "Microsoft.ServiceBus/namespaces/queues/read",
                        "Microsoft.ServiceBus/namespaces/queues/write",
                        "Microsoft.ServiceBus/namespaces/queues/delete",
                        "Microsoft.ServiceBus/namespaces/AuthorizationRules/listKeys/action",
                        "Microsoft.DocumentDB/databaseAccounts/read",
                        "Microsoft.DocumentDB/databaseAccounts/write",
                        "Microsoft.DocumentDB/databaseAccounts/delete",
                        "Microsoft.DocumentDB/databaseAccounts/listKeys/action",
                        "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/write",
                        "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/delete",
                        "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/operationResults/read",
                        "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/write",
                        "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/delete",
                        "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/operationResults/read",
                        "Microsoft.ManagedIdentity/userAssignedIdentities/read",
                        "Microsoft.ManagedIdentity/userAssignedIdentities/write",
                        "Microsoft.ManagedIdentity/userAssignedIdentities/delete",
                        "Microsoft.ManagedIdentity/userAssignedIdentities/assign/action",
                        "Microsoft.ServiceBus/namespaces/read",
                        "Microsoft.ServiceBus/namespaces/write",
                        "Microsoft.ServiceBus/namespaces/delete",
                        "Microsoft.ContainerInstance/register/action",
                        "Microsoft.ContainerInstance/containerGroups/read",
                        "Microsoft.ContainerInstance/containerGroups/write",
                        "Microsoft.ContainerInstance/containerGroups/delete",
                        "Microsoft.OperationalInsights/workspaces/*",
                        "Microsoft.App/managedEnvironments/read",
                        "Microsoft.App/managedEnvironments/write",
                        "Microsoft.App/managedEnvironments/delete",
                        "Microsoft.App/jobs/read",
                        "Microsoft.App/jobs/write",
                        "Microsoft.App/jobs/delete",
                        "Microsoft.App/containerApps/read",
                        "Microsoft.App/containerApps/write",
                        "Microsoft.App/containerApps/delete",
                        "Microsoft.App/managedEnvironments/join/action",
                        "Microsoft.CustomProviders/*/read",
                        "Microsoft.CustomProviders/*/write",
                        "Microsoft.CustomProviders/*/delete",
                        "Microsoft.Portal/dashboards/write",
                        "Microsoft.Portal/dashboards/delete",
                        "Microsoft.StreamAnalytics/*/action",
                        "Microsoft.StreamAnalytics/streamingjobs/*/read",
                        "Microsoft.StreamAnalytics/streamingjobs/*/write",
                        "Microsoft.StreamAnalytics/streamingjobs/*/delete",
                        "Microsoft.EventHub/namespaces/read",
                        "Microsoft.EventHub/namespaces/write",
                        "Microsoft.EventHub/namespaces/delete",
                        "Microsoft.EventHub/namespaces/authorizationRules/read",
                        "Microsoft.EventHub/namespaces/authorizationRules/write",
                        "Microsoft.EventHub/namespaces/authorizationRules/delete",
                        "Microsoft.EventHub/namespaces/authorizationRules/listKeys/action",
                        "Microsoft.EventHub/namespaces/eventhubs/consumergroups/read",
                        "Microsoft.EventHub/namespaces/eventhubs/consumergroups/write",
                        "Microsoft.EventHub/namespaces/eventhubs/consumergroups/delete",
                        "Microsoft.EventHub/namespaces/eventhubs/read",
                        "Microsoft.EventHub/namespaces/eventhubs/write",
                        "Microsoft.EventHub/namespaces/eventhubs/delete",
                        "Microsoft.Insights/autoscalesettings/read",
                        "Microsoft.Insights/autoscalesettings/write",
                        "Microsoft.Insights/autoscalesettings/delete",
                        "Microsoft.Portal/dashboards/read",
                        "Microsoft.DocumentDB/databaseAccounts/listConnectionStrings/action"
                    ],
                    "notActions": [],
                    "dataActions": [],
                    "notDataActions": []
                }
            ]

• Connectivity between resources. For more information, see NDS for Azure - Supported Parameters and Limits.

Downloading and verifying the NDS Setup Script

To download and verify the NDS setup script, follow these steps:

1. Download the latest NDS Setup Script here: NDS-AZ-Setup.ps1

2. In PowerShell, verify by printing the help text:

./NDS-AZ-Setup.ps1 -Help

Important: The script creates and maintains each deployment’s state in a file named {StackName}-state.json. Keep the script and the JSON file(s) together for future updates. The JSON file(s) must be located in the same directory as the script so it can reference them correctly.

Without the JSON file, future updates to the deployment are not possible. In that case, any updates require you to redeploy from scratch.

1.  New Deployment

Complete the following steps for a new deployment of UaaS/NDS in Azure.

1a. Collect inputs

Begin by collecting the following inputs:

1b. Start the deployment

Run the script in PowerShell:

./NDS-AZ-Setup.ps1 -Action New-Deployment -ResourceGroupName <RG> -SerialNumber <SN> -AuthCode <AC> -Location <LOC>

If you need help with syntax, run the following script in PowerShell:

./NDS-AZ-Setup.ps1 -Help

Note: It takes approximately ten minutes for the initial deployment to complete. The script displays the deployment status in Azure for you to follow.

After the deployment is complete, you see the following message in PowerShell:

1c. Configure NDS in Nasuni Portal

With NDS deployed in Azure, the next step is to configure it in the Nasuni Portal.

1. Log in to the Nasuni Portal: https://portal.nasuni.com/.

2. Navigate to Cloud Services → UniFS as a Service, and click on your newly deployed stack to open it.

3. In the left pane under Services, click Nasuni Data Service (NDS).

4. Click Enable NDS on the right.
   
   

5. After enabling NDS, you can see your Endpoint URL. Use this URL when connecting to NDS.
   
   

6. Attach at least one volume, following the instructions in 3a. Attach a Volume below.

7. (Optional) You can add rules to define path inclusions and exclusions for the volume. These rules determine which data is presented via NDS. The rules do not modify the volume (NDS is read-only). Exclude rules always take precedence over include rules. All paths are recursive and cover paths below the one that is specified in the rule. Follow the instructions in 3c. Configure Rules for Path Inclusions/Exclusions below if desired.

8. After a new deployment of NDS for Azure, Access Keys must be generated. They can be subsequently regenerated as needed. Follow the instructions in 3e. Generate/Regenerate Access Keys below.

9. (Optional) In addition to the two Access Keys, you can generate Shared Access Signature (SAS) Tokens as an authentication method. SAS Tokens benefit from an expiration date, providing greater control and security.
   For more information, see 3f. Generate Shared Access Signature (SAS) Tokens.

2. Update deployment

Use the NDS Setup script to update your existing UaaS/NDS deployment, preserving your configuration. Release notes are available here: UniFS™ as a Service (UaaS) Release Notes.

To check the version of your deployment, follow these steps:

1. Log in to the Nasuni Portal: https://portal.nasuni.com/.

2. Navigate to Cloud Services → UniFS as a Service.

3. Locate your deployment and version or build number.

2a. Collect inputs

Collect the following inputs:

2b. Start the update

Run the script in PowerShell:

./NDS-AZ-Setup.ps1 -Action Update-Deployment -ResourceGroupName <RG>

If you need help with syntax, run the following script in PowerShell:

./NDS-AZ-Setup.ps1 -Help

Note: It takes approximately ten minutes for the update to complete. The script displays the deployment status in Azure for you to follow.

When the deployment is complete, you see the following message in PowerShell:

3. Managing an existing NDS deployment

Complete the following steps to modify the volumes enabled for NDS, update their included and excluded path configurations, and generate Access Keys or SAS Tokens.

Access NDS Management

To complete all subsequent operations, first access NDS management in the Nasuni Portal:

1. Log in to Nasuni Portal: https://portal.nasuni.com/.

2. Navigate to Cloud Services → UniFS as a Service.

3. Locate your deployment and click to open it.

4. In the left pane under Services, click Nasuni Data Service (NDS).

Note: Allow up to 15 minutes for the operations below to take effect after being configured.

3a. Attaching a volume

To attach a volume, follow these steps:

1. Click Attach new volume, then select a volume to present through NDS. Only volumes meeting the prerequisites noted above under Prerequisites - Nasuni can be selected.
   
   

   The volume appears in the Volumes list. The Container Name is used when connecting to NDS and accessing this volume.
   

2. Follow NDS Volume Registration to complete the volume registration. This step must be completed for every volume attached to NDS.

   Note: This is a one-time step for each volume, unless you change or rotate your credentials for the object storage in AWS/Azure. In that case, you lose access to the volume via NDS until you complete this step again.

3b. Detaching a volume

To remove the volume from NDS, click Detach.

Note: This has no effect on the volume itself, and does not delete data.

3c. Configuring rules for path inclusions and exclusions

You can add rules to define path inclusions or exclusions for the volume. These rules determine the data presented via NDS and do not modify the volume (NDS is read-only).

• Exclude rules always take precedence over include rules.

• All paths are recursive and include all subpaths beneath the path specified in the rule.

• Paths are defined relative to the volume’s root, using forward slashes (see example below).

• The concept of shares and Edge Appliances is not a factor here. Paths are always defined from the volume's root, not in relation to an Edge Appliance or any share.

To configure rules for path inclusions and exclusions, follow these steps:

1. Click Add Rule, and choose Exclude or Include. Enter the desired path relative to the volume's root, following the format shown in the example. Consider excluding /.nasuni which is a system directory.
   
   Example: /topfolder/secondfolder
   
   

2. Click Done.

3. Click Save Changes.

3d. Modifying a rule for path inclusions and exclusions

To modify a rule for path inclusions and exclusions, follow these steps:

1. For the volume and rule you want to modify, click the ellipses (three dots) … next to the existing rule.

2. To modify the rule, click Edit Path and make any necessary changes.

3. To delete the rule, click Delete Rule.

4. Click Done.

5. Click Save Changes.

3e. Generating or regenerating Access Keys

The Access Keys provide unrestricted read access to the Nasuni volumes (containers) via NDS.

1. Click Access Keys, and then Regenerate Key 1 and Regenerate Key 2.
   
   

2. The Access Keys can be used with an account name of nds and the Endpoint URL (from the Setup screen) to authenticate to NDS. The keys are interchangeable.
   For a simplified authentication process, use a Connection String. The Connection Strings are interchangeable.
   

3f. Generating Shared Access Signature (SAS) Tokens

In addition to the two Access Keys, you can optionally generate Shared Access Signature (SAS) Tokens as a method of authentication. SAS Tokens benefit from an expiration date, providing greater control and security. The SAS Token provides unrestricted read access to the Nasuni volumes (containers) via NDS.

SAS Tokens are signed by one of the two Access Keys. Regenerating Access Keys invalidates any SAS Tokens signed by them. Consider implementing SAS Tokens as the sole authentication method for your deployment.

1. Click Shared Access Signature (SAS), and then on the date selector for Token Expiry. Select the validity date range for the SAS token. Note that the permissions are fixed and cannot be modified.
   
   

2. Click Generate SAS Token and Connection String.
   
   

3. Copy the SAS Token. You can use this SAS Token for authentication against NDS.

   Important: SAS tokens cannot be viewed after the initial generation. Store the token information in a secure location.

Legacy NDS Management - Versions 1.2.X and lower

{
  "id": "UAAS-STACK-CONFIG",
  "nds": {
    "blob_keys": [
      "dQefmwQfGame66pUH8q33cjkIelgH0WhyMHa2LEliERyeaibQ+Msgw1lP4Djjr3TUqWHl0W9w==",
      "o89XFVlkpT8ggB4W7GGA/qwFUsNnKtOZCVL8J70WKituOmdGfUCGzqiwd2xanwwCVZ1t+PFbvFw=="
    ],
    "blob_endpoint_volumes": [
      "9f58311a-3b21-4ae6-8bb6-600_0"
    ],
    "blob_storage_endpoint_enabled": true,
    "included_paths": {
      "9f58311a-3b21-4ae6-8bb6-600_0": "/"
    }
    "excluded_paths": {
      "9f58311a-3b21-4ae6-8bb6-600_0": "/.nasuni"
    }
  },
  "type": "CONFIG"
}