NetApp - ONTAP commands for the NFS SVMs (SCB and KVM)
NetApp Solution · Config document · referenced from SVMs and NFS
noteThis is not a complete build script. The notes keep only the commands that were typed on the command line; NFS server, volumes, qtrees, LIFs and export rules were created in a way the notes do not record, and their result is in the table after the command set.
The ONTAP commands kept in the working notes for the two kinds of NFS SVM: creation of the SVM for the Balabit SCB with its one NFS server option, and the ownership and permission changes that RHV needs on the KVM SVM.
| Item | Value |
|---|---|
| Runs on | cluster shell of DC1-A-XNAS001, as admin |
| Shown here | DC1-S-VCVSM001 (SCB) and DC1-S-VCVSM002 (KVM) |
| Also applied to | DC1-S-VCVSM005, DC1-S-VCVSM006 and the site 2 SVMs, by the design; only the -43_sd qtree commands are recorded for site 2 |
| ONTAP version at the time | 9.1P8 |
The command set
# --- SVM for the Balabit SCB ------------------------------------------------- # Create the SVM in an IPspace of its own. The aggregate was later renamed to # DC1_A_ANAS002_data1, and the root volume security style was later changed # from mixed to unix. vserver create -vserver DC1-S-VCVSM001 -rootvolume DC1_S_VCVSM001_root -aggregate data_DC1_A_ANAS002 -rootvolume-security-style mixed -language C.UTF-8 -snapshot-policy default -is-repository false -foreground true -comment "VSM for Balabit" -ipspace DC1-S-VCVSM001_ipspace # Accept NFS mount requests from non-reserved source ports vserver nfs modify -vserver DC1-S-VCVSM001 -mount-rootonly disabled # Checks: effective permissions on the qtree, and evaluation of the export # rules for the SCB as client vserver security file-directory show -vserver DC1-S-VCVSM001 -path /DC1_S_VCVSM001_data/scb_system_backup check-access -vserver DC1-S-VCVSM001 -volume DC1_S_VCVSM001_data -client-ip 10.11.18.225 -authentication-method sys -protocol nfs3 -access-type read # --- SVM for KVM (RHV) ------------------------------------------------------- # RHV requirement: data volume and SVM root volume owned by uid 36 (vdsm), # gid 36 (kvm), mode 777 volume modify -vserver DC1-S-VCVSM002 -volume DC1_S_VCVSM002_data -user 36 -group 36 -unix-permissions 777 volume modify -vserver DC1-S-VCVSM002 -volume DC1_S_VCVSM002_root -user 36 -group 36 -unix-permissions 777 # RHV requirement: every qtree that is a storage domain has mode 777 qtree modify -vserver DC1-S-VCVSM002 -volume DC1_S_VCVSM002_data -qtree data_sd -unix-permissions 777 qtree modify -vserver DC1-S-VCVSM002 -volume DC1_S_VCVSM002_data -qtree management_sd -unix-permissions 777 qtree modify -vserver DC1-S-VCVSM002 -volume DC1_S_VCVSM002_data -qtree iso_sd -unix-permissions 777 # Qtrees added later qtree modify -vserver DC1-S-VCVSM002 -volume DC1_S_VCVSM002_data -qtree management-43_sd -unix-permissions 777 qtree modify -vserver DC1-S-VCVSM002 -volume DC1_S_VCVSM002_data -qtree data-43_sd -unix-permissions 777 # Check volume show -vserver DC1-S-VCVSM002 -volume DC1_S_VCVSM002_data
The later qtrees on site 2, run on DC2-A-XNAS001, differ in names only:
| Site 1 | Site 2 |
|---|---|
-vserver DC1-S-VCVSM002 | -vserver DC2-S-VCVSM002 |
-volume DC1_S_VCVSM002_data | -volume DC2SVCVSM002_data |
What the commands do not show
The state that the missing commands produced, from the as-built report of DC1-A-XNAS001 and the design:
| Object | DC1-S-VCVSM001 (SCB) | DC1-S-VCVSM002 (KVM) |
|---|---|---|
| Allowed protocols | nfs, ndmp | nfs |
| NFS versions | v3 | v3, v4.0, v4.1 |
| Root volume | DC1_S_VCVSM001_root, 1 GB, unix | DC1_S_VCVSM002_root, 1 GB, unix |
| Data volume | DC1_S_VCVSM001_data, 100 GB, unix | DC1_S_VCVSM002_data, 10.1 TB, unix |
| Aggregate | DC1_A_ANAS002_data1 | DC1_A_ANAS001_data1 |
| Junction path | /DC1_S_VCVSM001_data | /DC1_S_VCVSM002_data |
| Qtrees | scb_system_backup and a _backup and _archive pair for the organisation and each of three partners | management_sd, iso_sd, data_sd |
| Qtree security style, oplocks | unix, enabled | unix, enabled |
| Export policy | default | default |
| Export rule 1 | client 10.11.18.225, nfs3, ro sys, rw sys, anon 65534, superuser any | client 10.11.10.64/27, nfs3 and nfs4, ro sys, rw sys, anon 65534, superuser any |
| Data LIF | 10.11.18.236/28 on a0a-1020 | 10.11.10.94/27 on a0a-1026 |
Checked against ONTAP 9.19.1
| As built | Today |
|---|---|
vserver nfs modify -mount-rootonly disabled | Still valid. The default is still enabled: MOUNT calls are accepted only from ports below 1024 |
| NFS versions switched on per SVM | NFSv3 is enabled by default; since ONTAP 9.9.1 NFSv4.1 and NFSv4.2 are enabled by default as well. pNFS (-v4.1-pnfs) is disabled by default |
volume modify … -user 36 -group 36 -unix-permissions 777 | Parameters unchanged |
qtree modify … -unix-permissions 777 | The command is volume qtree modify; -user, -group, -unix-permissions, -export-policy and -security-style exist |
check-access … | Documented as vserver export-policy check-access |
vserver create … | The command exists; whether -is-repository is still accepted could not be confirmed |
Export rules in the policy default, AUTH_SYS only | vserver export-policy rule create is unchanged. NFS over TLS exists from ONTAP 9.19.1 with the rule option -allow-nfs-tls-only; a FAS8200 cannot run it, its last release is 9.16.1 |
| Owner 36:36 and mode 777 for RHV | The oVirt administration guide still asks for owner 36:36 (vdsm:kvm) and sets mode 0755. Mode 777 is wider than documented |
The commands still work as written. What should not be copied is the combination of -mount-rootonly disabled, AUTH_SYS and world-writable qtrees. RHV itself is past its end of life: the Extended Life Phase of 4.4 ended on 31 August 2026.