Non-volatile memory express over fabric (NVMe-oF) zone subsets for packet-by-packet enforcement
A current technique to enforce a Zoning configuration is referred to as “Hard Zoning”. Hard Zoning is a technique in which network switches in a fabric inspect packets to ascertain if a packet should be forwarded or discarded, according to the communication between nodes allowed by the Zoning configuration. For the network switches to be able to perform this packet-by-packet filtering, Zoning information needs to be supplied to the network switches. However, current approaches involve sending duplicate data to switches. These approaches are very inefficient and cumbersome. Accordingly, embodiments comprise a Centralized Discovery Controller (CDC) that collects network information, generates, for a switch, its appropriate zoning information, and sends the switch-specific zoning information to that switch.
1. A computer-implemented method comprising:
responsive to an active zone being created or modified in an active zone datastore via a centralized controller of a Non-Volatile Memory Express over Fabric (NVMe-oF) network system comprising a set of one or more information handling systems operating as a switch or router in the NVMe-oF network system and a plurality of NVMe entities comprising one or more storage subsystems and one or more host systems, performing steps comprising:
creating an IP-based representation of the active zone, in which each zone member of the active zone is represented as a zone member type comprising an IP address of the zone member and its role, and wherein a zone member is an NVMe entity of the NVMe-oF network system; and
for each information handling system from the set of information handling system operating as a switch or router in the NVMe-oF network system that is connected to an NVMe entity, performing steps comprising:
retrieving an NVMe IP address list from the information handling system, which comprises a list of IP addresses of NVMe-oF entities directly connected to the information handling system;
responsive to the IP-based representation of the active zone comprising a zone member having an IP address that appears in the information handling system's NVMe IP address list, generating an active zone subset for the information handling system that comprises a portion of the IP-based representation of the active zone that is relevant to the information handling system; and
transmitting the active zone subset to the information handling system.
2. The computer-implemented method of claim 1 wherein:
the IP-based representation of the active zone being created or modified in the active zone datastore on the centralized controller of an NVMe-oF network system is done via a management interface to the centralized controller.
3. The computer-implemented method of claim 1 wherein the zone members in the active zone datastore are identified by a name identifier and wherein the step of creating the IP-based representation of the active zone comprises:
using a name server datastore that correlates name identifiers to IP addresses to convert the zone members to their corresponding IP addresses.
4. The computer-implemented method of claim 1 wherein the information handling system comprises an initial default state that denies all NVMe-oF traffic on its ports.
5. The computer-implemented method of claim 1 wherein:
the IP-based representation comprises a plurality of active zones and the active zone subset for an information handling system comprises a list of active zones comprising at least one zone member having an IP address belonging to that information handling system's NVMe IP address list.
6. The computer-implemented method of claim 1 further comprising:
causing at least the information handling systems that are affected by the active zone being created or modified to lock their current active zone subsets before applying changes; and
responsive to each information handling system that is affected by the active zone having received its active zone subset, prompting the information handling systems to implement their changed active zone subsets and then unlock their updated active zone subsets.
7. The computer-implemented method of claim 6 wherein an information handling system implements its active zone subset by performing steps comprising:
generating a system access control list, which comprises a list of all pairs of host and subsystem allowed to communicate with each other, in which each pair comprises a host IP address, a subsystem IP address, or both IP addresses belonging to the information handling system's NVMe IP address list; and
for each port of the information handling system that is connected to either one of the hosts or one of the storage subsystems in the system access control list, programming a related port access control list for the port from the system access control list.
8. The computer-implemented method of claim 1 wherein only the information handling system or systems that are affected by the active zone being created or modified are updated.
9. A centralized controller system comprising:
one or more ports for communicatively connecting with one or more information handling systems operating in a Non-Volatile Memory Express over Fabric (NVMe-oF) network system comprising a plurality of NVMe entities comprising one or more subsystems and one or more hosts;
an active zone datastore for storing information for one or more active zone groups;
one or more processors; and
a non-transitory computer-readable medium or media comprising one or more sets of instructions which, when executed by at least one of the one or more processors, causes steps to be performed comprising:
responsive to an active zone group being created or modified in the active zone datastore, performing steps comprising:
creating an IP-based representation of the active zone group, in which each zone member of the active zone group is represented as a zone member type comprising an IP address of the zone member and its role, and wherein a zone member is an NVMe entity of the NVMe-oF network system; and
for each information handling system from the set of information handling system operating as a switch or router in the NVMe-oF network system that is connected to an NVMe entity, performing steps comprising:
retrieving an NVMe IP address list from the information handling system, which comprises a list of IP addresses of NVMe-oF entities directly connected to the information handling system;
responsive to the IP-based representation of the active zone group comprising a zone member having an IP address that appears in the information handling system's NVMe IP address list, generating an active zone subset for the information handling system that comprises a portion of the IP-based representation of the active zone group that is relevant to the information handling system; and
transmitting the active zone subset to the information handling system.
10. The centralized controller system of claim 9 wherein the IP-based representation of the active zone being created or modified in the active zone datastore on the centralized controller of an NVMe-oF network system is done via a management interface to the centralized controller.
11. The centralized controller system of claim 9 wherein the zone members in the active zone datastore are identified by a name identifier and wherein the step of creating the IP-based representation of the active zone group comprises:
using a name server datastore that correlates name identifiers to IP addresses to convert the zone members to their corresponding IP addresses.
12. The centralized controller system of claim 9 wherein the information handling system comprises an initial default state that denies all NVMe-oF traffic on its ports.
13. The centralized controller system of claim 9 wherein:
the IP-based representation of the active zone group comprises a plurality of active zone groups and the active zones subset for an information handling system comprises a list of active zone groups including each zone that comprises at least one zone member having an IP address belonging to that information handling system's NVMe IP address list.
14. The centralized controller system of claim 9 further comprising:
causing at least the information handling systems that are affected by the active zone being created or modified to lock their current active zone subsets before applying changes; and
responsive to each information handling system that is affected by the active zone having received its active zone subset, prompting the information handling systems to implement their changed active subsets and then unlock their updated active zone subsets.
15. The centralized controller system of claim 9 wherein only the information handling system or systems that are affected by the active zone group that was created or modified are updated.
16. A non-transitory computer-readable medium or media comprising one or more sequences of instructions which, when executed by at least one processor, causes steps to be performed comprising:
responsive to an active zone being created or modified in an active zone datastore via a centralized controller of a Non-Volatile Memory Express over Fabric (NVMe-oF) network system comprising a set of one or more information handling systems operating as a switch or router in the NVMe-oF network system and a plurality of NVMe entities comprising one or more storage subsystems and one or more host systems, performing steps comprising:
creating an IP-based representation of the active zone, in which each zone member of the active zone is represented as a zone member type comprising an IP address of the zone member and its role, and wherein a zone member is an NVMe entity of the NVMe-oF network system; and
for each information handling system from the set of information handling system operating as a switch or router in the NVMe-oF network system that is connected to an NVMe entity, performing steps comprising:
retrieving an NVMe IP address list from the information handling system, which comprises a list of IP addresses of NVMe-oF entities directly connected to the information handling system;
responsive to the IP-based representation of the active zone comprising a zone member having an IP address that appears in the information handling system's NVMe IP address list, generating an active zone subset for the information handling system that comprises a portion of the IP-based representation of the active zone that is relevant to the information handling system; and
transmitting the active zone subset to the information handling system.
17. The non-transitory computer-readable medium or media of claim 16 wherein:
the IP-based representation of the active zone being created or modified in the active zone datastore on the centralized controller of an NVMe-oF network system is done via a management interface to the centralized controller.
18. The non-transitory computer-readable medium or media of claim 16 wherein the zone members in the active zone datastore are identified by a name identifier and wherein the step of creating the IP-based representation of the active zone comprises:
using a name server datastore that correlates name identifiers to IP addresses to convert the zone members to their corresponding IP addresses.
19. The non-transitory computer-readable medium or media of claim 16 wherein:
the IP-based representation comprises a plurality of active zones and the active zone subset for an information handling system comprises a list of active zones comprising at least one zone member having an IP address belonging to that information handling system's NVMe IP address list.
20. The non-transitory computer-readable medium or media of claim 16 wherein only the information handling system or systems that are affected by the active zone being created or modified are updated.