4 minute read

StorageGRID 12.1

NetApp StorageGRID 12.1 was announced last month, but the packages were made available for download just two days ago.

Yesterday I upgraded my StorageGRID cluster and used some of the new features. I won't comment on all of them and if you just want to see what's new, click here to see an unopinionated fact sheet with "What's New in 12.1".

The choice of server-side time filters in bucket snapshots has been expanded. Bucket snapshots is great feature, but it seems most people have no idea what to do with it although the StorageGRID documentation explains several highly pertinent use cases. Personally, I have plenty of ideas (some are described here, some elsewhere, and I have some new demos I haven't shared yet), but it looks like it may take another 6-12 months for me to find someone who gets it.

12.0 allowed only before filtering, and bizarrely, you could chose a future date. They made that even worse (or better, if you disagree) in 12.1 and added support for after, between and exclude. All allow future dates.

Snapshot options for a bucket

SSO with OIDC is finally supported. Entra ID, Keycloak, Octa, and PingFederate are part of the first wave. This is interesting from several perspectives; one is that StorageGRID users who use federated authentication now have these additional, modern options, but there's a less obvious one, too: with the appearance of initiatives such as OpenSharing - which can authenticate the same OIDC users - one can take advantage of the same backend for authentication and authorization across StorageGRID and various sharing schemas.

Non-functional S3 REST API headers isn't a feature, but a noop. It doesn't happen often that not doing anything is considered a "feature" but in this case we have an exception and If-Match and If-None-Match are accepted but non-functional. For now this merely prevents issues with certain clients. May they become functional in next release!

Kafka endpoints and mTLS authentication allows better security for outgoing Kafka notifications. I couldn't believe they left Webhooks out. If you need mTLS for Webhook notifications, "contact your NetApp representative".

Moar buckets! Up to 20,000 buckets can be created for each S3 tenant account. You probably won't run out of buckets even if you generously avail yourself of the bucket snapshot feature.

Improved Link Cost configuration. As the term suggests, these are link cost and latency hints for certain StorageGRID services. As recently as 12.0, the UI to set them was very dated. Now it's been modernized. It doesn't change how it works, but those who have multiple sites and use the Web UI to configure link costs among them will appreciate the new UI.

There are other very nice features, but I don't want to duplicate the entire What's New from TFM.

sg-cosi 0.5.4

COSI is garbage, but that's not a reason to not update a COSI driver if you have one and storage has added COSI-related features.

sg-cosi was created for StorageGRID 12.0 and the key workflow is the one that relies on bucket snapshot functionality. As we've just seen above, v12.1 supports to 20K buckets per tenant, which makes the use of COSI with bucket snapshots even more attractive: low risk to Tenant and Grid administrators, high convenience to teams that rapidly iterate with base buckets (i.e. "source" buckets from which snapshots get created).

Snapshot buckets is what gets created in the default "greenfield" sg-cosi workflow. They are also read-only, so that they barely create any trouble.

Since StorageGRID 12.1 expanded snapshot options, sg-cosi followed and exclude, range, and after have been added to the original before time filter option.

I think allowing future datetime(s) in these filters doesn't make any sense, so in sg-cosi now() was, and still is, the datetime closest to the future that can be set.

As we all know, there are people who think using future dates is very useful and safe (I doubt that, but from the feature we know they exist). To make such "power users" happy, sg-cosi v0.5.4 lets the user remove this sanity check with DISABLE_FUTURE_DATETIME set to false.

Here's an example of a snapshot bucket created with sg-cosi using between filter that covers period between 2026-06-23 07:59:00 GMT and 2026-07-23 07:59:00 GMT. You may want to create such a snapshot if you need to inspect objects and their versions created during specific time period.

sg-cosi read-only snapshot with between filter

As I mentioned in previous sg-cosi and bucket snapshots posts, you can do that with client-side filtering, but this frees you from having to use such filters in the first place and is both more efficient and user-friendly.

When you think of it, SIEM and auditing is actually one of the few valuable use cases for COSI, especially for sg-cosi with these read-only snapshot-derived buckets: both these snapshot buckets and their tenants are temporary, which offloads work from Tenant Administrator or at least does not add to it.

In course of testing sg-cosi 0.5.4 I realized that there's as limit to how far in the future a snapshot bucket date can be (5 years) and I double-checked in TFM.

Future timestamp is now+5Y

Imagine creating a between-style bucket snapshot that filters objects created between 2029 and 2030. What does that even mean???

It's weird that future dates are allowed. And it's also weird the limit is set to now plus 5 years. This time filter that allows future dates is one of the most bizarre features I've seen in StorageGRID in this decade.

You may also enjoy