Target driven zoning for ethernet in non-volatile memory express over-fabrics (NVMe-oF) environments
Presented herein are systems and methods for facilitating access control among elements of a non-volatile memory express (NVMe™) entity in an NVMe™-over-Fabric (NVMe-oF) environment. In one or more embodiments, NVMe™ entities, whether NVMe™ hosts or NVMe™ subsystems, can obtain information about elements of NVMe™ entities that have registered with a centralized storage fabric service component via a discovery controller of the centralize service. In one or more embodiments, based upon information received from requesting NVMe™ entities, the centralized storage fabric service creates and maintains a data store of zones, in which a zone comprises a listing of elements of NVMe™ entities that are members of that zone and have access rights relative to other members of that zone.
1. A non-transitory computer-readable medium or media comprising one or more sets of instructions which, when executed by at least one processor, causes steps to be performed comprising:
transmitting to a centralized storage fabric service a request for a list of one or more elements of one or more NVMe entities that have registered with the centralized storage fabric service;
receiving the list of one or more elements of one or more NVMe entities that have registered with the centralized storage fabric service;
selecting a set of one or more elements from the received list of one or more elements of one or more NVMe entities that have registered with the centralized storage fabric service to be allowed access to at least one common storage element; and
transmitting to the centralized storage fabric service the set of selected one or more elements that are to be allowed access to the at least one common storage element for the centralized storage fabric service to set access control.
2. The non-transitory computer-readable medium or media of claim 1 wherein the step of selecting a set of one or more elements from the received list of one or more elements of one or more NVMe entities that have registered with the centralized storage fabric service to be allowed access to at least one common storage element comprises:
comparing the received list of one or more elements of one or more NVMe entities that have registered with the centralized storage fabric service with a configuration list of one or more elements of one or more NVMe entities that are authorized to the access the at least one common storage element; and
responsive to an element from the received list of one or more elements matching an element a configuration list, adding the matching element to the set of one or more elements.
3. The non-transitory computer-readable medium or media of claim 2 further comprises:
responsive to receiving a change in the configuration list, which forms an updated configuration list:
transmitting, to the centralized storage fabric service, a subsequent request for a list of one or more elements of one or more NVMe entities that have registered with the centralized storage fabric service;
receiving the list of one or more elements of one or more NVMe entities that have registered with the centralized storage fabric service;
selecting an updated set of one or more elements using the updated configuration list and the received list of one or more elements of one or more NVMe entities that have registered with the centralized storage fabric service; and
transmitting to the centralized storage fabric service information indicating the updated set of selected one or more elements that are to be allowed access to the at least one common storage element.
4. The non-transitory computer-readable medium or media of claim 3 wherein the information indicating the updated set of selected one or more elements that are to be allowed access to the at least one common storage element comprises:
change information indicating what has changed from a set immediately prior to the updated set; or
the updated set which acts as a complete replacement for a set immediately prior to the updated set.
5. The non-transitory computer-readable medium or media of claim 1 wherein a plurality of sets of one or more elements from the received list are selected and transmitted to the centralized storage fabric service and wherein each set corresponds to a distinct zone.
6. The non-transitory computer-readable medium or media of claim 1 wherein the centralized storage fabric service sets access control by performing the steps comprising:
forming a zone by adding each element in the set of selected one or more elements as members of the zone to facilitate access control among members of the zone.
7. The non-transitory computer-readable medium or media of claim 6 wherein the step of forming a zone by adding each element in the set of selected one or more elements as members of the zone to facilitate access control among members of the zone comprises:
adding one or more identifiers for each element in the set of selected one or more elements that are to be allowed access to the at least one common storage element to a zoning data store to establish the zone.
8. An information handling system for providing storage fabric services, the system comprising:
one or more processors; and
a non-transitory computer-readable medium or media comprising one or more sets of instructions which, when executed by at least one of the one or more processors, causes steps to be performed comprising:
receiving, at a centralized storage fabric service, a request for a list of one or more elements of one or more NVMe entities that have registered with the centralized storage fabric service, the request originating from a requesting NVMe entity;
obtaining from a data store maintained by the centralized storage fabric service the list of one or more elements of one or more NVMe entities that have registered with the centralized storage fabric service;
sending the list of one or more elements of one or more NVMe entities to the requesting NVMe entity;
receiving, from the requesting NVMe entity, a set of one or more elements to be allowed access to at least one common storage element, the set of one or more element being selected from the list of one or more elements of one or more NVMe entities that have registered with the centralized storage fabric service; and
forming a zone by adding each element in the set of one or more elements as members of the zone to facilitate access control among members of the zone.
9. The information handling system of claim 8 wherein the non-transitory computer-readable medium or media further comprises one or more sets of instructions which, when executed by at least one of the one or more processors, causes steps to be performed comprising:
sending to the requesting NVMe entity an acknowledgement that the zone with the set of one or more elements as members has been created.
10. The information handling system of claim 9 wherein the non-transitory computer-readable medium or media further comprises one or more sets of instructions which, when executed by at least one of the one or more processors, causes steps to be performed comprising:
adding an identifier for each element in the set of one or more elements that are to be allowed access to the at least one common storage element to a zoning data store to establish the zone.
11. The information handling system of claim 8 wherein the non-transitory computer-readable medium or media further comprises one or more sets of instructions which, when executed by at least one of the one or more processors, causes steps to be performed comprising:
configuring discovery data that an NVMe host system receives to discover one or more elements of NVMe entities to which it can connect.
12. The information handling system of claim 11 wherein the non-transitory computer-readable medium or media further comprises one or more sets of instructions which, when executed by at least one of the one or more processors, causes steps to be performed comprising:
sending to an NVMe host that is included in the set of one or more elements that are allowed access to the at least one common storage element a notification;
receiving, from the NVMe host, a request for a list of one or more elements of one or more NVMe entities to which the NVMe host is allowed access; and
sending the list of one or more elements of one or more NVMe entities to which the NVMe host is allowed access.
13. The information handling system of claim 11 wherein the non-transitory computer-readable medium or media further comprises one or more sets of instructions which, when executed by at least one of the one or more processors, causes steps to be performed comprising:
obtaining from a zone data store maintained by the centralized storage fabric service the list of one or more elements of one or more NVMe entities to which the NVMe host is allowed access.
14. The information handling system of claim 8 wherein the non-transitory computer-readable medium or media further comprises one or more sets of instructions which, when executed by at least one of the one or more processors, causes steps to be performed comprising:
configuring one or more network Access Control Lists (ACLs) to prevent one or more NVMe entities from accessing a certain set of one or more elements of NVMe entities.
15. A computer-implemented method for facilitating access control comprising:
transmitting to a centralized storage fabric service a request for a list of one or more elements of one or more NVMe entities that have registered with the centralized storage fabric service;
receiving the list of one or more elements of one or more NVMe entities that have registered with the centralized storage fabric service;
selecting a set of one or more elements from the received list of one or more elements of one or more NVMe entities that have registered with the centralized storage fabric service to be allowed access to at least one common storage element; and
transmitting to the centralized storage fabric service the set of selected one or more elements that are to be allowed access to the at least one common storage element for the centralized storage fabric service to set access control.
16. The computer-implemented method of claim 15 wherein the step of selecting a set of one or more elements from the received list of one or more elements of one or more NVMe entities that have registered with the centralized storage fabric service to be allowed access to at least one common storage element comprises:
comparing the received list of one or more elements of one or more NVMe entities that have registered with the centralized storage fabric service with a configuration list of one or more elements of one or more NVMe entities that are authorized to the access the at least one common storage element; and
responsive to an element from the received list of one or more elements matching an element a configuration list, adding the matching element to the set of one or more elements.
17. The computer-implemented method of claim 15 further comprises:
responsive to receiving a change in the configuration list, which forms an updated configuration list:
transmitting, to the centralized storage fabric service, a subsequent request for a list of one or more elements of one or more NVMe entities that have registered with the centralized storage fabric service;
receiving the list of one or more elements of one or more NVMe entities that have registered with the centralized storage fabric service;
selecting an updated set of one or more elements using the updated configuration list and the received list of one or more elements of one or more NVMe entities that have registered with the centralized storage fabric service; and
transmitting to the centralized storage fabric service information indicating the updated set of selected one or more elements that are to be allowed access to the at least one common storage element.
18. The computer-implemented method of claim 17 wherein the information indicating the updated set of selected one or more elements that are to be allowed access to the at least one common storage element comprises:
change information indicating what has changed from a set immediately prior to the updated set; or
the updated set, which acts as a complete replacement for a set immediately prior to the updated set.
19. The computer-implemented method of claim 15 wherein a plurality of sets of one or more elements from the received list are selected and transmitted to the centralized storage fabric service and wherein each set corresponds to a distinct zone.
20. The computer-implemented method of claim 15 wherein the centralized storage fabric service sets access control by performing the steps comprising:
forming a zone by adding each element in the set of selected one or more elements as members of the zone to facilitate access control among members of the zone.