Object Stores

An object store turns a volume into an S3-compatible endpoint: instead of (or in addition to) mounting the volume as a block device or file share, applications talk to it over HTTP using the S3 API — buckets, objects, and standard S3 tooling all work against it. This is a good fit for backup targets, application data lakes, and any workload already written against S3.

An object store needs a volume that already has a file system assigned to it (see the Filesystems settings on the volume) — the object store runs on top of that file system rather than being a separate kind of volume. If a single volume isn't large enough, you can stripe the object store across several volumes so they present as one larger S3 endpoint.

Access to an object store is controlled by access keys rather than host/initiator mappings — see that page for creating and managing the access key credentials themselves.

Creating an object store

Using the web interface

Open Application Volumes > Volumes, select a volume that already has a file system, and choose Create Object Store.
Under Volume Selection, confirm the application and volume (and, optionally, Volume Striping to add more volumes to stripe across).
Under Network, set the floating IP and TCP port the object store will listen on, and whether to enable SSL.
Under Access Keys, choose the admin (and, optionally, regular) access keys that can connect to this object store.
Under Identity and Access Management, decide whether admin access keys may create their own IAM users, and whether those IAM users can manage their own policies.
Confirm to create the object store.

Using the CLI

applications objects stores create
    --application=<name> --volume=<name> [--stripedVolumes=<name...>]
    --floatingIp=<name> --port=<object_store_port> [--enableSsl]
    --adminAccessKeys=<name...> [--regularAccessKeys=<name...>
    --support_iam_credentials --editable_iam_credentials]

Option	Description
`--application=<name>`	The name of the application the object store will be created in.
`--volume=<name>`	The name of the volume on which the object store will be created.
`--stripedVolumes=<name...>`	Stripe this object store over additional volumes.
`--floatingIp=<name>`	The floating IP to use for this object store.
`--port=<object_store_port>`	The TCP port for this object store.
`--enableSsl`	Enable using SSL.
`--adminAccessKeys=<name...>`	Admin access keys with access to this object store.
`--regularAccessKeys=<name...>`	Regular (non-admin) access keys with access to this object store.
`--support_iam_credentials`	Allow admin access keys to create IAM users that can connect to this object store.
`--editable_iam_credentials`	Allow those IAM users to create, edit, delete, or assign policies.

Examples

Create a basic object store on the archive volume:

applications objects stores create --application backups --volume archive --floatingIp fip-1 --port 9000 --adminAccessKeys backup-admin

Create one with SSL enabled and a regular (restricted) access key added alongside the admin key:

applications objects stores create --application backups --volume archive --floatingIp fip-1 --port 9443 --enableSsl --adminAccessKeys backup-admin --regularAccessKeys backup-app

Create a larger object store striped across three volumes:

applications objects stores create --application backups --volume archive1 --stripedVolumes archive2 archive3 --floatingIp fip-1 --port 9000 --adminAccessKeys backup-admin

Editing an object store

You can change an object store's network settings, expand it with additional striped volumes, change which access keys can reach it, and change its IAM settings.

Using the web interface

Open Application Volumes > Volumes, select the object store's volume, and choose Edit Object Store.
Update the fields you need under Network, Volume Striping, Access Keys, or Identity and Access Management.
Confirm the change.

The CLI also offers two narrower shortcuts that aren't in the web interface — applications objects stores access_keys add and applications objects stores access_keys delete — for adding or removing access keys from a store without touching anything else.

Using the CLI

applications objects stores edit
    --application=<name> --volume=<name> [--stripedVolumes=<name...>
    --floatingIp=<name> --port=<object_store_port> --enableSsl|--disableSsl
    --adminAccessKeys=<name...> --regularAccessKeys=<name...>
    --support_iam_credentials|--do_not_support_iam_credentials --editable_iam_credentials|--do_not_support_editable_iam_credentials]

Option	Description
`--application=<name>`	The name of the application that contains the object store.
`--volume=<name>`	The name of the volume that contains the object store.
`--stripedVolumes=<name...>`	Expand the object store with additional volumes.
`--floatingIp=<name>`	The new floating IP to use for this object store.
`--port=<object_store_port>`	The new TCP port for this object store.
`--enableSsl`	Enable using SSL.
`--disableSsl`	Disable using SSL.
`--adminAccessKeys=<name...>`	Admin access keys with access to this object store.
`--regularAccessKeys=<name...>`	Regular (non-admin) access keys with access to this object store.
`--support_iam_credentials`	Allow admin access keys to create IAM users that can connect to this object store.
`--do_not_support_iam_credentials`	Do not allow admin access keys to create IAM users.
`--editable_iam_credentials`	Allow IAM users to create, edit, delete, or assign policies.
`--do_not_support_editable_iam_credentials`	Do not allow IAM users to manage policies.

If you supply --adminAccessKeys or --regularAccessKeys, the keys you list replace the object store's entire set of access keys (admin and regular together), so list every key that should keep access. If you supply neither, the existing keys are left alone. To add or remove individual keys without affecting the rest, use applications objects stores access_keys add or access_keys delete.

Examples

Move the object store to a new port:

applications objects stores edit --application backups --volume archive --port 9001

Enable SSL on an existing object store:

applications objects stores edit --application backups --volume archive --enableSsl

Add a striped volume to expand capacity:

applications objects stores edit --application backups --volume archive --stripedVolumes archive4

Adding or removing access keys directly (CLI only)

applications objects stores access_keys add --application=<name> --volume=<name> --accessKeys=<name...>
applications objects stores access_keys delete --application=<name> --volume=<name> --accessKeys=<name...>

Option	Description
`--application=<name>`	The name of the application that contains the object store.
`--volume=<name>`	The name of the volume that contains the object store.
`--accessKeys=<name...>`	The access keys to grant or remove access for.

Example — grant an additional access key access to an existing object store:

applications objects stores access_keys add --application backups --volume archive --accessKeys backup-app2

Listing object stores

Using the web interface

Open Application Volumes > Volumes and filter to object-store volumes, or open the object stores list directly to see every object store at once.

Using the CLI

applications objects stores list [--application=<name> --volume=<name>]

Option	Description
`--application=<name>`	Filter by the application that contains the object store.
`--volume=<name>`	Filter by the volume that contains the object store.

Example

applications objects stores list --application backups

Viewing object store metrics

Returns usage/performance metrics for an object store, useful for capacity planning and troubleshooting throughput.

Using the web interface

Open Application Volumes > Volumes, select the object store's volume, and open its Metrics view.

Using the CLI

applications objects stores metrics --application=<name> --volume=<name>

Option	Description
`--application=<name>`	The name of the application that contains the object store.
`--volume=<name>`	The name of the volume that contains the object store.

Example

applications objects stores metrics --application backups --volume archive

Next: Access Keys — creating and managing the credentials that connect to your object stores.