I've been doing some studying of the AWS sysop exam areas. Storage gateway seemed like a very interesting and useful tool that many organizations are quickly place in their environment for file storage provisioning or storage capacity expansion. I didn't go to in depth on this, however I was able to deploy a storage gateway, a windows AD domain, an NFS share off the gateway, do a domain join of gateway to AD, and then deploy an SMB share all within about 2 hours (first time touching this tech).
My environment for the lab:
Host OS - deskop Linux Mint 19.3.
Virtualization - Vmware workstation 16 player
Storage gateway - Downloaded vmware device VM from AWS at the setup of storage gateway. NIC set to bridged
Windows domain - Vmware win 2019 eval server. NIC set to bridged
I started with the simple set up of the gateway with an NFS share. After downloading the AWS SG vm, it boots up to a logon screen, where you can use the default account: admin, password. In there, you have some limited capabilities through a menu driven interface. This mostly focuses on network settings, firewall and routing. For me, it was pretty well configured already for this step. In the console dialogs you will need to provide the IP of the storage gateway, and your host OS browser needs to be able to connect to it in order to configuration the VM. With bridged networking, this was no problem at all. You will need to add an additional storage driver on the VM to act as the caching location. This will be detected during the configuration in the console.
Back in the console, create an S3 bucket for you to use with the gateway. You can use the same bucket for multiple shares, but it looks like you can use the same prefixed folder for more than one share. Once you create an NFS share (pretty straightforward for options), you can mount it on your host OS and start putting files in there. The files will act like normal linux/unix files with owner/group and permissions set. These replicate up to the S3 bucket and are stored in the object's metadata
testuser@nathan-X299-UD4:/home/nathan/aws-sg$ ls -l
total 2
-rw-r--r-- 1 nobody nogroup 32 Oct 20 12:12 test1
-rw------- 1 nathan nathan 17 Oct 20 12:12 test2.txt
-rw-rw-r-- 1 testuser testuser 16 Oct 20 12:17 test3.txt
The files created on the NFS share were very quickly available in S3. I tried replacing one of them in S3 with new data, and it didn't seem to come down to the share level. I rechecked the settings on the share and there's a cache refresh option which seems to help with this. Its got a minimum value of 5 minutes though. So its best to make changes on the share side of the storage device if you want quick read consistency.
On to the SMB share. I created the 2019 install and did a dc promo with some basic options. Server was on bridged network with dhcp. Local guest NIC had the first dns server set to 127.0.0.1 and a dns forwarder set to external dns provider for internet resolution. For the gateway, you can join it to AD, but this requires the gateway to be able to connect to the AD domain and resolve the servers. You don't have too many mandatory parameters, just domain name, user and password. You connect to AD at the storage gate way config -> actions -> edit smb settings. For this to work, I had to edit the network settings on the gateway: Network configuration -> edit dns configuration. I turned off dhcp and specified my 2019 AD server as the primary dns server IP. This allowed the gateway to connect to the domain and joined with no problem. Only took about 1 minute or less.
Once you're joined to the domain, you can create an SMB share using AD authentication and user details. Files in the share have owners, ACL's, and the usual stuff you would expect on any windows machine. These replicate up to the S3 bucket in the object's metadata similar to the way NFS works, but the data isn't easy to read. ACL is encoded, and owner doesn't match to a SID, so I wouldn't expect you can search metadata to try to get much usable information out from the S3 side.
Overall, I would say its an impressive offering and it was quite easy to work with. Some of the errors I ran into didn't have much documentation though, but I managed to get past them. What I tried, and failed with on the SMB share: 1) creating the share to access the same prefix and bucket as my NFS share, this doesn't work; 2) creating the share with the default share name, which was a duplicate of the NFS share. After renaming that, it wasn't an issue. Other than that, I just had some domain join issues while my AD vm was using NAT nic config and the DNS setting on the storage gateway wasn't right. All pretty easily resolved.
Documentation ref: https://docs.amazonaws.cn/en_us/storagegateway/latest/userguide/storagegateway-ug.pdf
No comments:
Post a Comment