Set Up VAST Tenants and VIP Pools

ℹ️ Info

Outcome: DataEngine and optional CSI tenants, VIP pools, policies, service accounts, and a DataEngine user are ready.

Before you begin: Complete the lab-values worksheet and sign in to the VAST Management System (VMS) as a cluster administrator.

Previous: Collect VAST DataEngine Lab Values  |  Next: Install an RKE2 Cluster

Sign in to the VAST Management System (VMS) and create the resources required by the lab.

ℹ️ Info

Installing the VAST CSI Driver is an optional, but recommended step in the process. If you choose not to install the VAST CSI Driver, steps that are titled with “*CSI*” can be skipped.

Prerequisites

Prerequisites for Data Engine

• A new Tenant for DataEngine

• A VIP Pool for the DataEngine Tenant

• S3 Native View Policy for DataEngine Tenant

• A DataEngine Bucket Owner User and Group

• Group granted DataEngine Access on the tenant

Prerequisites for VAST CSI Driver (Optional)

• Trash Folder enabled for Cluster

• A new Tenant for CSI with Trash Folder enabled

• A VIP Pool for the CSI Tenant

• A View Policy for CSI

• VMS Roles for CSI Tenant admin and CSI Service Account

• VMS Managers for CSI Tenant admin and CSI Service Account

Prerequisites for Docker Repository

• A View for the Docker Repo

If Using AD/LDAP to authenticate users

• Enable AD/LDAP Authentication for VMS

Enable AD/LDAP Authentication for VMS (optional)

1. Navigate to User Management → Active Directory (or LDAP)

2. Right-click AD/LDAP provider → Choose “Edit”

3. Under “Advanced”

   1. Enable “VMS Authentication Provider”

      

4. Select “Update”

DataEngine Resources

For VAST Cluster 5.3.3+, configure a dedicated tenant for dynamic volume provisioning. This restricts the driver's service account privileges to dynamic provisioning tasks and provides necessary control plane isolation.

Similarly, isolate DataEngine in its own dedicated tenant to maintain a strong security posture and enforce strict separation of concerns.

Create a local identity provider

1. Navigate to User Management → VAST Providers → Add New Provider

2. Select “VAST Provider”

   1. Create a new identity provider (for example de-lab-provider)

   2. Verify “Cluster Admin” and “Tenant Admin” are both selected (this allows the cluster admin to edit logical elements within the Tenant)

3. Select “Create”

Create the DataEngine Tenant

1. Navigate to Element Store → Tenants → Create Tenant

   1. Fill in the tenant name (for example de-lab-tenant)

2. Under “Providers and Users Access”

   1. Select your Identity Provider (for example de-lab-provider local provider or AD/LDAP)

3. Select “Create”

Create the DataEngine tenant VIP pool

1. Navigate to “Network Access → Virtual IP Pools → Create Virtual IP Pool”

2. Choose the tenant (for example de-lab-tenant)

3. Name the VIP Pool (for example de-lab-vippool)

4. Choose Role “Protocols”

5. Enter your Subnet CIDR (for example 16) also enter VLAN and Gateway if needed

   

6. In “IP Range List” enter your “Start IP and End IP” (for example 172.200.205.13 and 172.200.205.18)

   

7. ONLY IF USING DNS: in “DNS Configurations → Virtual IP Pool name” enter a name (for example de-lab-vippool)

   1. This will populate below as a FQDN (for example “DNS Service FQDN: de-lab-vippool.cluster.lab.vastdata.com”

      

8. Select “Create”

Create view policies

Create the DataEngine S3 Native view policy

1. Navigate to “Element Store → View Polices ->Create Policy”

2. Choose the tenant (for example de-lab-tenant)

3. Name the Policy (for example de-lab-s3-policy)

4. Choose Security Flavor “S3 Native”

   

5. Under “NFS → Common Settings → Group membership source”

6. Choose “NFS RPC and Providers”

   

7. Select “Create”

Create a DataEngine NFS view policy

1. Navigate to “Element Store → View Polices ->Create Policy”

   1. Choose the tenant (for example de-lab-tenant)

   2. Name the Policy (for example de-lab-nfs-policy)

   3. Choose Security Flavor “NFS”

      

2. Under “Host-Based Access → No Squash”

   1. Select “+ Add New Rule”

   2. Enter “*” in the dialog

   3. Select “ +Add Rule”

3. Under “Host-Based Access → Root Squash”

   1. Hover over “*”

   2. Select “X” - this should remove the “*” from this line.

      

4. Under “NFS → Common Settings → Group membership source”

   1. Choose “NFS RPC”

   2. Select “Create”

      

Create a view for the container registry

It is recommended that you leverage an NFS share for the container registry’s storage.

1. Navigate to “Element Store → Views ->Create View”

   1. Choose the tenant (for example de-lab-tenant)

   2. Enter a Path (for example /de-lab-docker/images

   3. Check “Create Directory”

   4. Select the View Policy (for example de-lab-nfs-policy)

   5. Select Protocols “NFSv3” and “NFSv4”

      

   6. Select “Create”

ℹ️ Info

It is not necessary to create a view for the CSI Driver the driver will create views dynamically for each PVC.

Create a DataEngine user and group

Create the Group

1. User Management → Local Groups → Create Local Group

2. General

   1. Name: de-lab-group

   2. GID: 854321

   3. Local Provider: de-lab-provider

3. Select “Create”

   

Create the User

1. User Management → Local Users → Create Local User

2. General

   1. Name: de-lab-user

   2. Local Provider: de-lab-provider

   3. Leading Group: de-lab-group

   4. Temporary Password: <choose-a-strong-password>

      

3. Permissions Access

   1. Select tenant…: de-lab-tenant

   2. Verify “Allow Create Bucket” and “Allow Delete Bucket” are selected

      

4. Select “Create”

Create access and secret keys

1. User Management → Query User or Group

2. Query User

   1. Tenant: de-lab-tenant

   2. User Name: de-lab-user

3. Select “Query User”

1. Access Keys

   1. Select “Add Key”

2. Copy your Secret Key and Access Key and note them in a safe place.

3. Choose “Save”

Grant Group DataEngine Access on Tenant

1. Element Store → Tenants

2. Right-click on the Tenant (for example de-lab-tenant)

   1. Choose “Edit”

      

3. User Access Management

   1. Users Group - Enter the group we created earlier (for example de-lab-group)

   2. Check both “Assign User group to Data Engine role” and “Assign Data Engine identity policy to group”

4. Choose “Update”

Add Group to View Policy

1. Element Store → View Policies

2. Right-click on the View Policy (for example de-lab-viewpolicy)

   1. Choose “Edit”

3. S3

   1. Bucket listing permissions group - Enter the group we created earlier (for example de-lab-group)

4. Choose “Update”

VAST CSI Driver Resources

Enable Trash folder on the VAST Cluster (if installing CSI Driver)

1. Navigate to Settings → Cluster → General Cluster Setup and Actions

2. Make Sure “Trash Folder Access” is enabled

3. Select “Save”

Create the CSI Tenant

1. Navigate to Element Store → Tenants → Create Tenant

   1. Fill in the tenant name (for example de-lab-csi-tenant)

   2. Select your Identity Provider (for example de-lab-provider local provider)

2. Under “Advanced Protocol Settings → NFS Settings”

   1. Enable “Trash Folder”

   2. In “Trash Folder GID” enter “0” (you MUST enter a value here)

      

3. Select “Create”

Create the CSI tenant VIP pool

1. Navigate to “Network Access → Virtual IP Pools → Create Virtual IP Pool”

2. Choose the tenant (for example de-lab-csi-tenant)

3. Name the VIP Pool (for example de-lab-csi-vippool)

4. Choose Role “Protocols”

5. Enter your Subnet CIDR (for example 16) also enter VLAN and Gateway if needed

   

6. In “IP Range List” enter your “Start IP and End IP” (for example 172.200.205.19 and 172.200.205.24)

   

7. 1. ONLY IF USING DNS: in “DNS Configurations → Virtual IP Pool name” enter a name (for example de-csi)

   2. This will populate below as a FQDN (for example “DNS Service FQDN: de-lab-csi-vippool.cluster.lab.vastdata.com”

      

8. Select “Create”

Create the CSI view policy

1. Navigate to “Element Store → View Polices ->Create Policy”

   1. Choose the tenant (for example de-lab-csi-tenant)

   2. Name the Policy (for example de-lab-csi-policy)

   3. Choose Security Flavor “NFS”

   4. Choose VIP Pool (for example de-lab-csi-vippool)

      

2. Under “Host-Based Access → No Squash”

   1. Select “+ Add New Rule”

   2. Enter “*” in the dialog

   3. Select “ +Add Rule”

3. Under “Host-Based Access → Root Squash”

   1. Hover over “*”

   2. Select “X” - this should remove the “*” from this line.

      

4. Under “NFS → Common Settings → Group membership source”

   1. Choose “NFS RPC”

   2. Select “Create”

      

Create VMS roles for CSI

1. Administrators → Administrative Roles

2. Tenant Admin

   1. Create Administrative Role

   2. Change “Cluster Admin” to “Tenant Admin”

   3. Name: de-lab-csi-tenant-admin

   4. Choose Tenant de-lab-csi-tenant

   5. Select All, then Deselect Support (optional)

   6. Select “Create”

      

3. CSI service account

   1. Create Administrative Role

   2. Change “Cluster Admin” to “Tenant Admin”

   3. Name: de-lab-csi-service-account

   4. Choose Tenant de-lab-csi-tenant

   5. Select Logical only: Full Control (create/view/edit/delete)

   6. Select “Create”

      

Create VMS manager accounts for CSI

1. Administrators → Manager → Create Manager

2. CSI Tenant Admin

   1. Name: de-lab-csi-admin

   2. Password: <choose-a-strong-password>

   3. Toggle “Password is Temporary” off

   4. User Type: Tenant Admin

   5. Select your tenant de-lab-csi-tenant

   6. Select Administrative role de-lab-csi-tenant-admin

   7. Select “Create”

      

3. CSI Service Account

   1. Name: de-lab-csi-driver

   2. Password: <choose-a-strong-password>

   3. Toggle “Password is Temporary” off

   4. User Type: Tenant Admin

   5. Select your tenant de-lab-csi-tenant

   6. Select Administrative role de-lab-csi-service-account

   7. Select “Create”

      

Verify the VAST setup

• The DataEngine tenant and optional CSI tenant exist.

• Each tenant has the expected VIP pool and view policy.

• The DataEngine group has tenant access and bucket-listing permission.

• The generated S3 access and secret keys are stored in an approved secret manager.