NetApp ShowMount Tool¶
This golang application queries via GET the NetApp REST API to list volumes on a NetApp filer. This is similar to the showmount command and is useful for auto-discovery when showmount is disabled. During knfsd deployment, the listed volumes can be filtered via the filter-exports golang application. See Export Configuration for further details.
The netapp-exports tool should be built locally and validated as working correctly with your NetApp storage before being used in the knfsd deployment.
cd /knfsd-file-cache/image/resources/netapp-exports
go build -o ~/netapp-exports
~/netapp-exports <options>
Options¶
-
-config path
Path to a config *.hcl file. This can be used as an alternative to specify the host, password, etc as command line options. Config files support listing multiple NetApp clusters in different locations. -
-host string
DNS or IP of the NetApp server (SVM endpoint). This is the DNS or IP name clients use when mounting the NFS shares. -
-url string
URL of the NetApp REST API (Management endpoint). This must include the API version and end with a slash, for examplehttps://netapp.example/api/v1/. -
-user string
The username used to authenticate with the NetApp REST API. -
-password string
The password used to authenticate with the NetApp REST API. This option is not secure and is only intended for testing. For more secure options, use-secret-nameor-password-file. -
-password-file path
A file containing the password to authenticate with the NetApp REST API. -
-secret-region string
The AWS region where AWS Secrets Manager is storing the NetApp password. The default credential provider chain is used to locate AWS credentials, including region, unless specifically overridden by this CLI option. -
-secret-name string
The name of an AWS Secrets Manager 'Secret' containing the NetApp REST API password. -
-secret-version string
The version of the AWS Secrets Manager 'Secret'. Defaults toAWSCURRENT. -
-ca path
Path to PEM encoded certificate file containing the root certificate for the NetApp REST API. This can also include intermediate certificates to provide the full certificate chain. -
-insecure
Allow insecure connections. This permits the use of the unencryptedhttpconnections and ignores any certificate errors. This is only intended for testing as it can expose the password over an unencrypted connection, and encrypted connections will be vulnerable to man in the middle attacks. -
-allow-common-name
Allows using the Common Name (CN) field of the certificate as a DNS name when the certificate does not include a Subject Alternate Name (SAN) field. Use of the CN field is now deprecated as CN is ambiguous and only intended to provide a human readable name. However, some self-signed NetApp certificates still rely on the CN field. If the certificate contains a SAN then the CN will be ignored.
Environment Variables¶
Alternatively, most of the options can be set using environment variables.
| Option | Environment Variable |
|---|---|
-host |
NETAPP_HOST |
-url |
NETAPP_URL |
-user |
NETAPP_USER |
-password |
NETAPP_PASSWORD |
-password-file |
NETAPP_PASSWORD_FILE |
-secret-region |
NETAPP_SECRET_REGION |
-secret-name |
NETAPP_SECRET |
-secret-version |
NETAPP_SECRET_VERSION |
-ca |
NETAPP_CA |
-allow-common-name |
NETAPP_ALLOW_COMMON_NAME |
Walk-through of configuring and testing netapp-exports¶
Here is a walk-through using 2 examples for how to extract the Certificate Authority (CA) certificate from a NetApp instance, configure the netapp-exports tool and run it locally to validate all is well before using it via the Terraform deployment tooling. This can be used to test that the tool can query a NetApp instance and produces the correct result. We interchangeably provide examples of both a CA signed certificate (Amazon FSx NetApp ONTAP) or a self-signed certificate (basic, on-premises, default). The NetApp password can be parsed to the golang netapp-exports application in 3 ways:
-secret-namecli option or env varNETAPP_SECRET, stored in AWS Secrets Manager (recommended)password-filecli option or env varNETAPP_PASSWORD_FILE(not recommended)-passwordcli option or env varNETAPP_PASSWORD(not recommended, testing only)
NOTE: For simplicity while testing in this walk-through, we will store the NetApp password in a file and later show how alternatively, it can be stored securely in AWS Secrets Manager. For production use it is advised to use AWS Secrets Manager to store the password.
It is beyond the scope of this documentation to cover all possible NetApp deployments (on-premises, other providers), so we will reference an already deployed Amazon FSx for NetApp ONTAP cluster in AWS for the CA signed certificate approach.
Export the NetApp CA certificate (signed)¶
First you need the root CA certificate for your NetApp.
Set the NETAPP environment variable to the DNS name or IP that can be used to contact the NetApp cluster mgmt endpoint. In this example, we use 172.31.11.176 or management.fs-01bdc7d55f4d23173.fsx.eu-west-2.amazonaws.com.
ubuntu@knfsd-dev-ec2:~$ export NETAPP=management.fs-01bdc7d55f4d23173.fsx.eu-west-2.amazonaws.com
ubuntu@knfsd-dev-ec2:~$ openssl s_client -connect ${NETAPP}:443 </dev/null | openssl x509 > netapp.pem
depth=2 C = US, O = Amazon, OU = Amazon FSx, ST = Washington, CN = Amazon FSx Root CA 1 for eu-west-2, L = Seattle
verify error:num=19:self-signed certificate in certificate chain
verify return:1
depth=2 C = US, O = Amazon, OU = Amazon FSx, ST = Washington, CN = Amazon FSx Root CA 1 for eu-west-2, L = Seattle
verify return:1
depth=1 C = US, O = Amazon, OU = Amazon FSx, ST = Washington, CN = FSx CA for ONTAP-1 in eu-west-2, L = Seattle
verify return:1
depth=0 C = US, ST = Washington, L = Seattle, O = Amazon FSx, CN = management.fs-01bdc7d55f4d23173.fsx.eu-west-2.amazonaws.com
verify return:1
DONE
Verify that the certificate was downloaded:
ubuntu@knfsd-dev-ec2:~$ openssl x509 -in netapp.pem -noout -issuer -subject
issuer=C = US, O = Amazon, OU = Amazon FSx, ST = Washington, CN = FSx CA for ONTAP-1 in eu-west-2, L = Seattle
subject=C = US, ST = Washington, L = Seattle, O = Amazon FSx, CN = management.fs-01bdc7d55f4d23173.fsx.eu-west-2.amazonaws.com
Export the NetApp CA certificate (self-signed)¶
In this alternative example, the certificate is a self-signed certificate. The certificate only contains a common name based on the NetApp mgmt host name (netapptest) instead of the fully qualified domain name.
root@netapp-client:~$ export NETAPP=netapptest
root@netapp-client:~$ openssl s_client -connect ${NETAPP}:443 </dev/null | openssl x509 > netapp.pem
Can't use SSL_get_servername
depth=0 CN = netapptest, C = US
verify error:num=18:self signed certificate
verify return:1
depth=0 CN = netapptest, C = US
verify return:1
DONE
Verify that the certificate was downloaded:
root@netapp-client:~$ openssl x509 -in netapp.pem -noout -issuer -subject
issuer=CN = netapptest, C = US
subject=CN = netapptest, C = US
Check NetApp's SSL certificate names (signed / self-signed)¶
If the certificate contains subject alternative names (SANs) X509v3 Subject Alternative Name, then you can use any of DNS: or IP: entries to access the NetApp REST API. NetApp recommends you always target the cluster management address/IP as this will load balance API requests across all nodes and avoid nodes that are offline or experiencing connectivity issues. If you have multiple cluster management LIFs configured, they are all equivalent regarding access to the REST API.
Signed¶
ubuntu@knfsd-dev-ec2:~$ openssl s_client -connect ${NETAPP}:443 </dev/null 2>/dev/null | openssl x509 -noout -subject -nameopt sname -ext subjectAltName
subject=/C=US/ST=Washington/L=Seattle/O=Amazon FSx/CN=management.fs-01bdc7d55f4d23173.fsx.eu-west-2.amazonaws.com
X509v3 Subject Alternative Name:
DNS:management.fs-01bdc7d55f4d23173.fsx.eu-west-2.amazonaws.com, DNS:node1.fs-01bdc7d55f4d23173.ontap.fsx.eu-west-2.amazonaws.com, DNS:node2.fs-01bdc7d55f4d23173.ontap.fsx.eu-west-2.amazonaws.com
Self-signed¶
root@netapp-client:~$ openssl s_client -connect ${NETAPP}:443 </dev/null 2>/dev/null | openssl x509 -noout -subject -nameopt sname -ext subjectAltName
subject=/CN=netapptest/C=US
If the output only contains a common name (/CN=netapptest) you will need to use this as the DNS name or IP address and include the -allow-common-name CLI option when you invoke the netapp-exports tool.
root@netapp-client:~$ nslookup netapptest
Server: 169.254.169.254
Address: 169.254.169.254#53
Non-authoritative answer:
Name: netapptest.location.company.internal
Address: 10.164.0.116
Run NetApp ShowMount tool¶
Create a NetApp user with permission to access the NetApp REST API. FSx for NetApp by default provides a fsxadmin user/role which can be used for initial testing, but this has unrestricted access to the ONTAP system. Please consult NetApp or FSx for NetApp documentation for more information on creating a user with read-only, minimum access permissions.
Create a file named netapp-password containing the password for your NetApp user.
Set the environment variables for the tool:
# CA signed, FSx example
export NETAPP_HOST=svm-027acf10d2f3e10cf.fs-01bdc7d55f4d23173.fsx.eu-west-2.amazonaws.com
export NETAPP_URL=https://management.fs-01bdc7d55f4d23173.fsx.eu-west-2.amazonaws.com/api/v1/
export NETAPP_USER=fsxadmin
export NETAPP_PASSWORD_FILE=netapp-password
export NETAPP_CA=netapp.pem
# Self-signed
export NETAPP_HOST=netapptest
export NETAPP_URL=https://netapptest/api/v1/
export NETAPP_USER=admin
export NETAPP_PASSWORD_FILE=netapp-password
export NETAPP_CA=netapp.pem
Build netapp-exports binary and check the required files are present:
ubuntu@knfsd-dev-ec2:~$ cd /knfsd-file-cache/image/resources/netapp-exports
ubuntu@knfsd-dev-ec2:/knfsd-file-cache/image/resources/netapp-exports$ go build -o ~/netapp-exports
ubuntu@knfsd-dev-ec2:~$ ls
netapp-password netapp.pem netapp-exports
Run the tool:
ubuntu@knfsd-dev-ec2:~$ ./netapp-exports
svm-027acf10d2f3e10cf.fs-01bdc7d55f4d23173.fsx.eu-west-2.amazonaws.com /
svm-027acf10d2f3e10cf.fs-01bdc7d55f4d23173.fsx.eu-west-2.amazonaws.com /vol1
svm-027acf10d2f3e10cf.fs-01bdc7d55f4d23173.fsx.eu-west-2.amazonaws.com /vol2
svm-027acf10d2f3e10cf.fs-01bdc7d55f4d23173.fsx.eu-west-2.amazonaws.com /vol2/vol3
svm-027acf10d2f3e10cf.fs-01bdc7d55f4d23173.fsx.eu-west-2.amazonaws.com /vol4
Common Name¶
In this example because NetApp is using a self-signed certificate that only contains a common name (CN), the command needs to include -allow-common-name.
Run showmount¶
showmount is an alternative way to list the NFS exports, but it is not always supported/could be disabled.
/sbin/showmount -e ${NETAPP_HOST}
Export list for netapptest:
/ 10.164.0.0/20
/archive 10.164.0.0/20
/home 10.164.0.0/20
/hotfiles 10.164.0.0/20
/pipeline 10.164.0.0/20
If showmount is not supported by the NFS server you will see the error:
You might also see this error:
This is caused by the NFS server not supporting NFSv3. Ensure vers3=yes is set in /etc/nfs.conf.d/knfsd.conf and is excluded from the DISABLED_NFS_VERSIONS parameter.
AWS Secrets Manager¶
AWS Secrets Manager allows you to securely store your NetApp user password to your NetApp REST API and control access via IAM permissions, which can be provided to the EC2 KNFSD instance via an IAM instance-role.
- Navigate to: AWS Console -> AWS Secrets Manager in your preferred choice of AWS region and AWS account.
- Click "Store a new secret", select "Secret type" as "Other type of secret".
- Enter:
secretas the KEY. - Enter:
<your-password>as the VALUE. Click "Next". - Enter:
netapp-passwordas the "Secret name".
Remove the environment variable NETAPP_PASSWORD_FILE and replace with:
export NETAPP_USER= # name of NetApp user with read-only access to REST API, with password stored in AWS Secrets Manager
export NETAPP_SECRET=netapp-password # secret name of the AWS Secret
export NETAPP_SECRET_REGION= # required if secret stored in different AWS region to where the knfsd proxy is running
Troubleshooting¶
The NetApp certificate is not valid¶
If the NetApp certificate is not valid because:
- The DNS name of the certificate does not match the DNS name used to access the NetApp.
- The certificate has expired
You can ignore any SSL certificate errors using the -insecure option.
WARNING: Using this option is vulnerable to man in the middle attacks and should not be used in production.