Installation Guide for Data Orchestration for Dell

Introduction

This guide provides instructions to deploy and license Data Orchestration for Dell (Superna Golden Copy). It covers appliance sizing, VM deployment, PowerScale/Isilon source cluster preparation (service account and NFS export configuration), and initial licensing. Follow the outlined procedures in order to ensure a working deployment before configuring archive folders and copy jobs.

info

For upgrading an existing deployment instead of a new install, see the Upgrade Guide.

Platform Requirements

• vCenter: 6.x, 6.5, and 7.0.1 (build 17491160).
• Appliance operating system: openSUSE 15.1. Patching the operating system and allowing internet repository access for automatic patching is the customer's responsibility — the OS itself is not covered by the support agreement.
• Supported browsers for the GUI: Chrome (Windows) and Edge (Chromium-based).

Review the current release's supported OneFS and S3 storage target versions on the Release Notes page before deploying.

Appliance Sizing

Data Orchestration deploys as one or more virtual appliance nodes. Choose a sizing configuration based on your use case:

Configuration	Nodes	vCPU (per node)	RAM (per node)	Disk (per node)	Notes
Small — Lab testing	1	4	16 GB	400 GB	For evaluation and testing only
Small — Production use (default)	1	4	16 GB	400 GB	Limited to 4 folder definitions; each additional 10 folders requires +110 GB disk
Vertical scaling — High-performance archiving	1	12	32 GB	600 GB	Requires manual RAM/CPU/config changes; see below
Scale-out — High-performance/concurrent jobs	6	4 (each)	16 GB (each)	400 GB (each)	Virtual Accelerator Nodes (VANs) added to a single management node

note

Regardless of configuration, disk latency (read/write) must be under 20 ms. Validate with iostat -xyz -d 3 before and after deployment.

For the Vertical Scaling configuration, after deploying the VM but before first power-on, increase the VM's vCPU and RAM. To increase the number of parallel file copies per node, edit /opt/superna/eca/eca-env-common.conf and add:

export ARCHIVE_PARALLEL_THREAD_COUNT=400

To increase container memory limits for high-throughput environments, edit /opt/superna/eca/docker-compose.overrides (indentation matters):

version: '2.4'

services:
  indexworker:
    mem_limit: 8GB
    mem_reservation: 8GB
    memswap_limit: 8GB

  archiveworker:
    mem_limit: 8GB
    mem_reservation: 8GB
    memswap_limit: 8GB

  kafka:
    mem_limit: 4GB
    mem_reservation: 4GB
    memswap_limit: 4GB

Network and Firewall Requirements

• Cloud storage connectivity: Direct NAT (private-to-public IP) network path to the cloud storage target, or a configured proxy (see Troubleshooting).
• All ports must be open between appliance nodes. Private VLANs and firewalls between appliance nodes are not supported.
• Restricting outbound firewall rules to cloud provider IP ranges: if outbound connectivity from the appliance is restricted rather than fully open to the Internet, both AWS and Azure publish downloadable IP range lists that can be used to scope firewall rules to just the storage service ranges. For AWS, use the published IP ranges JSON together with the regional firewall port guide. For Azure, download the Azure IP range JSON file and search it for AzureStorage to find the IP addresses for your region.

Port/Protocol	Direction	Purpose
ICMP (ping)	Node 1 → PowerScale	Verify reachability before adding a cluster
TCP 22	Admin workstation → appliance	Management CLI (SSH) access
HTTPS 443	Admin workstation → appliance	Management GUI access
HTTPS 8080, TCP 22	Appliance → PowerScale	REST API access and SSH
NFS (UDP/TCP 111, TCP/UDP 2049, UDP 300)	Appliance and VAN nodes → PowerScale	NFS mounts in the System zone
TCP 9020/9021	Appliance and VAN nodes → Dell ECS	S3 protocol (HTTP 9020 / HTTPS 9021)
HTTPS 443	Appliance and VAN nodes → AWS S3	S3 protocol
HTTPS 443	Appliance and VAN nodes → Azure Blob	Azure Blob REST API

Prepare the Source PowerScale/Isilon Cluster

Complete these steps on the source cluster before deploying the appliance.

Time Synchronization (Mandatory)

The source cluster and the Data Orchestration appliance must be time-synced and within 15 minutes of an NTP time source. If time is not synced, S3 targets will reject uploads due to time skew. Configure NTP on both the source cluster and the appliance before continuing.

Create the Service Account and Configure Privileges

Create the eyeglassSR service account and role on the source cluster. SSH to the cluster and run:

isi auth roles create --name EyeglassAdminSR --description "Eyeglass Search & Recover role"
isi auth users create eyeglassSR --enabled yes --password 3y3gl4ss
isi auth users modify eyeglassSR --password-expires no
isi auth roles modify EyeglassAdminSR --add-user eyeglassSR
isi auth roles modify EyeglassAdminSR --add-priv-ro ISI_PRIV_LOGIN_PAPI
isi auth roles modify EyeglassAdminSR --add-priv-ro ISI_PRIV_AUTH
isi auth roles modify EyeglassAdminSR --add-priv-ro ISI_PRIV_SMB
isi auth roles modify EyeglassAdminSR --add-priv-ro ISI_PRIV_NFS
isi auth roles modify EyeglassAdminSR --add-priv ISI_PRIV_SNAPSHOT
isi auth roles modify EyeglassAdminSR --add-priv-ro ISI_PRIV_DEVICES
isi auth roles modify EyeglassAdminSR --add-priv-ro ISI_PRIV_NS_TRAVERSE
isi auth roles modify EyeglassAdminSR --add-priv-ro ISI_PRIV_NS_IFS_ACCESS
isi auth roles modify EyeglassAdminSR --add-priv ISI_PRIV_JOB_ENGINE
isi auth roles modify EyeglassAdminSR --add-priv-ro ISI_PRIV_NETWORK
isi auth roles modify EyeglassAdminSR --add-priv-ro ISI_PRIV_STATISTICS
isi auth roles modify EyeglassAdminSR --add-priv ISI_PRIV_CONFIGURATION

The following privileges are required only for ACL security mode and the file recovery portal feature:

isi auth roles modify EyeglassAdminSR --add-priv-ro ISI_PRIV_IFS_BACKUP
isi auth roles modify EyeglassAdminSR --add-priv-ro ISI_PRIV_IFS_RESTORE

The following privileges are required for file pool reporting and for Golden Copy 1.1.6 and later:

isi auth roles modify EyeglassAdminSR --add-priv-ro ISI_PRIV_CLOUDPOOLS
isi auth roles modify EyeglassAdminSR --add-priv-ro ISI_PRIV_SMARTPOOLS
isi auth roles modify EyeglassAdminSR --add-priv-ro ISI_PRIV_LOGIN_SSH

note

The default password shown above (3y3gl4ss) is the documented default for this service account. Change it to a site-specific password during setup and record it — you will supply it when adding the cluster to inventory.

note

This service account is shared across other Superna Eyeglass products. Only the privileges listed above are documented specifically for Search & Recover and Golden Copy (Data Orchestration). Sudo file entries for other Eyeglass products (such as Disaster Recovery or Smart AirGap) are not required for Data Orchestration alone.

Create NFS Exports for Data Orchestration

The appliance reads data from a PowerScale/Isilon snapshot and writes recalled data back through NFS. Both exports must be created in the System Access Zone.

1. Create (or confirm) an IP pool in the System Access Zone with at least 3 nodes as members, and a DNS SmartConnect name assigned to the management IP pool in the System zone.
2. Record the cluster's GUID and name (visible in the OneFS GUI under Cluster Management → General Settings). You will need these values for the NFS mount configuration below.
3. Create an NFS export in the System Access Zone on /ifs/.snapshot, with the client list and root client list containing the IP addresses of the appliance node(s) and any Virtual Accelerator Nodes (VANs).
4. Create the recall path /ifs/goldencopy/recall (via SSH as root), then create an NFS export for that path with the same client/root client list.

Deploy the Appliance

1. Download the OVA file from the Superna support portal.

2. Deploy the OVA using vCenter:

   • vCenter 6.5/6.7 requires the Flash/Flex interface (HTML5 is not supported for this step).
   • Set the node IP address, gateway, DNS, and NTP server.
   • Set the ECA cluster name (lowercase only, no special characters).
   • If deploying the Vertical Scaling configuration, edit the VM to 12 vCPU / 32 GB RAM before powering on.
   • Power on the VM.

3. SSH to the node 1 IP address and log in as user ecaadmin (default password 3y3gl4ss).

4. Start the cluster:

   ecactl cluster up

5. Retrieve the appliance ID (required when requesting license keys from Superna):

   ecactl version

Deploy Virtual Accelerator Nodes (Optional, Scale-Out Configuration)

Virtual Accelerator Nodes (VANs) scale out copy job performance. The scale-out configuration requires 6 VMs total (1 management node + 5 VANs, or as sized for your environment).

1. Download the OVA and deploy each VAN VM with vCenter, following the same IP/gateway/DNS/NTP and ECA cluster name steps as above.

2. Power on all VAN VMs.

3. SSH to the management node (node 1) and log in as ecaadmin.

4. Add each VAN node:

   ecactl cluster add-node <ip_of_new_node>

5. Upgrade each VAN VM to match the management node's release:

   chmod 777 /home/ecaadmin/<upgradefilename>.run
   ./home/ecaadmin/<upgradefilename>.run

6. From node 1, start the cluster:

   ecactl cluster up

7. Verify all nodes boot successfully. Manage the configuration from node 1 only.

Configure NFS Mounts on Every Appliance Node

Each appliance node (management node and any VANs) requires two NFS mounts — one for reading snapshot data, and one for writing recalled data.

1. SSH to the node as ecaadmin, then switch to root:

   sudo -s

2. Create the local mount directories (repeat for each source cluster added):

   mkdir -p /opt/superna/mnt/search/GUID/clusternamehere/
   mkdir -p /opt/superna/mnt/recall/GUID/clusternamehere/

   Replace GUID and clusternamehere with the values recorded earlier. If VAN nodes are present, this can be run across the whole cluster from the management node, for example:

   ecactl cluster exec "sudo mkdir -p /opt/superna/mnt/search/00505699937a5e1f5b5d8b2342c2c3fe9fd7/clustername"
   ecactl cluster exec "sudo mkdir -p /opt/superna/mnt/recall/00505699937a5e1f5b5d8b2342c2c3fe9fd7/clustername"

3. Configure the mounts to persist across reboots by adding them to /etc/fstab on each node:

   echo '<CLUSTER_NFS_FQDN>:/ifs/.snapshot /opt/superna/mnt/search/<GUID>/<NAME> nfs defaults,nfsvers=3 0 0' | sudo tee -a /etc/fstab
   echo '<CLUSTER_NFS_FQDN>:/ifs/goldencopy/recall /opt/superna/mnt/recall/<GUID>/<NAME> nfs defaults,nfsvers=3 0 0' | sudo tee -a /etc/fstab
   mount -a
   mount

   Repeat these steps on every node in the appliance cluster.

Enable Concurrent Job Execution (Multi-Node Deployments)

A single-node deployment only supports one folder's job running concurrently by default. To enable multiple concurrent jobs, edit /opt/superna/eca/eca-env-common.conf on node 1:

# Disable blocking of parallel jobs (enabled/true by default)
export ARCHIVE_BLOCK_PARALLEL_JOBS=false

# Number of parallel full archive jobs allowed
export ARCHIVE_FULL_PARALLEL_JOBS_ALLOWED=30

# Number of parallel incremental archive jobs allowed
export ARCHIVE_INCREMENTAL_PARALLEL_JOBS_ALLOWED=30

# Total number of parallel jobs allowed (defaults to 1 full + 1 incremental)
export ARCHIVE_TOTAL_JOBS_ALLOWED=60

Save the file, then restart the cluster for the change to take effect:

ecactl cluster down
ecactl cluster up

Licensing

1. Copy the license ZIP file received from Superna to /home/ecaadmin on node 1 and set permissions:

   chmod 777 /home/ecaadmin/<license file>.zip

2. Add the license:

   searchctl licenses add --path /home/ecaadmin/<name of zip>.zip

3. Verify the license is installed:

   searchctl licenses list

4. List the application types licensed on the system (used for unified Search & Recover and Data Orchestration deployments):

   searchctl licenses applications list

info

Once a license is assigned to a cluster it is locked and cannot be removed. An unlock license key must be purchased from Superna to re-assign it to a different cluster.

Add the Source Cluster to Inventory

Add the source PowerScale/Isilon cluster using the service account created earlier:

searchctl isilons add --host <ip address of Isilon in system zone> --user eyeglassSR --applications {GC, SR} [--recall-sourcepath RECALLSOURCEPATH]

• --applications — required; assigns the cluster to the Golden Copy (GC) application, the Search (SR) application, or both.
• --recall-sourcepath — optional; only used with the Pipeline feature (requires a Pipeline subscription license). This path should be /ifs/fromcloud.

Assign the appropriate license to the cluster. For a standard Golden Copy license:

searchctl isilons license --name <cluster name> --applications GC

For the Advanced license (GCA) or Pipeline license (GCP):

searchctl isilons license --name <cluster name> --applications GCA
searchctl isilons license --name <cluster name> --applications GCP

note

Adding the PowerScale/Isilon cluster by IP address (rather than hostname) is recommended.

Next Steps

With the appliance deployed, source cluster prepared, and license applied, continue to the Configuration Guide to add archive folders, configure copy and recall schedules, and use the Data Orchestration GUI, VM operations, and Cloud Browser.

Upgrade Guide

Upgrade an existing Data Orchestration appliance to a newer release.

See more