Skip to content

Commit d6cd6be

Browse files
kcantrelkcantrel
authored
Merge pull request #215 from NetApp/add_cf_ext_samples
Add the CloudFormation custom resources examples
2 parents bc03a79 + a482d43 commit d6cd6be

18 files changed

+1586
-0
lines changed

‎CloudFormation/NetApp-FSxN-Custom-Resources-Samples/README.md‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
# NetApp FSxN Third Party CloudFormation Extensions Examples
2+
3+
## Overview
4+
This repository contains example CloudFormation templates that use the NetApp FSxN Third Party CloudFormation Extensions.
5+
6+
It also contains shell scripts that can be used to get you started quickly, as well as some shell
7+
scripts that allow you to deploy these examples with the AWS CLI.
8+
9+
And, as a bonus, there is one Python script that can be used to create a clone of an existing FSx for NetApp ONTAP volume.
10+
11+
## Prerequisites
12+
### Get a Preview Key
13+
- The first thing you need to do before you can use any of the NetApp FSxN Third Party CloudFormation Extensions is obtain a `preview key`.
14+
You can get one of those by sending an email to [[email protected]](mailto:[email protected]) requesting one.
15+
16+
## Getting Started
17+
Once you have the preview key, you are ready to activate the extensions and start using them.
18+
19+
### Step 1 Create an IAM role
20+
You need to create an IAM role that the extensions will assume to create and/or modify resources on your behalf.
21+
The following is a CloudFormation template that you can use to create the role:
22+
```
23+
AWSTemplateFormatVersion: "2010-09-09"
24+
Description: >
25+
This CloudFormation template creates a role assumed by CloudFormation
26+
during CRUDL operations to mutate resources on your behalf.
27+
28+
Resources:
29+
ExecutionRole:
30+
Type: AWS::IAM::Role
31+
Properties:
32+
MaxSessionDuration: 8400
33+
AssumeRolePolicyDocument:
34+
Version: '2012-10-17'
35+
Statement:
36+
- Effect: Allow
37+
Principal:
38+
Service: resources.cloudformation.amazonaws.com
39+
Action: sts:AssumeRole
40+
Path: "/"
41+
Policies:
42+
- PolicyName: ResourceTypePolicy
43+
PolicyDocument:
44+
Version: '2012-10-17'
45+
Statement:
46+
- Effect: Allow
47+
Action:
48+
- "fsx:DescribeFileSystems"
49+
- "lambda:InvokeFunction"
50+
- "secretsmanager:GetSecretValue"
51+
Resource: "*"
52+
Outputs:
53+
ExecutionRoleArn:
54+
Value:
55+
Fn::GetAtt: ExecutionRole.Arn
56+
```
57+
You can use the above template to create the role by running the following command:
58+
```
59+
aws cloudformation create-stack --stack-name create_execution_role_for_NetApp_CF_extensions --template-body file://<path-to-template> --capabilities CAPABILITY_NAMED_IAM
60+
```
61+
62+
### Step 2: Activate the Extensions
63+
The next step is to activate all the extension. You can do that by running the `activate_extensions`
64+
script found in the `scripts` directory in this repository.
65+
```
66+
./activate_extensions -r <aws-region> -p <preview-key> -a <role-arn>
67+
```
68+
Where:
69+
- `<aws-region>` is the AWS region you want to activate the extensions in.
70+
- `<preview-key>` is the preview key you obtained from NetApp.
71+
- `<role-arn>` is the ARN of the role that the extensions will assume to create resources.
72+
73+
### Step 3: Deploy a Workload Factory Link
74+
Before you can use any of the FSxN extensions you must have a Workload Factory Link deployed.
75+
If you don't already have one, you can either deploy one via the [Workload Factory console](https://console.workloads.netapp.com),
76+
or you can create one by using the `NetApp::FSxN::Link::MODULE` CloudFormation module, which is part of the third party extensions.
77+
To make deploying the Workload Factory Link easy you can use the `deploy_link` script found in the `scripts` directory in this repository.
78+
It invokes the `NetApp::FSxN::Link::Module` module with the appropriate parameters and will output the ARN
79+
of the Workload Factory Link Lambda function that will be used in all of the CloudFormation templates that use these FSxN extensions.
80+
81+
Here is the synopsis of how to use the `deploy_link` script:
82+
```
83+
./deploy_link -r <aws-region> -s <subnet-id>,<subnet-id> -g <security-group-id>,<security-group-id> -n <link_name>
84+
```
85+
Where:
86+
- `<aws-region>` is the AWS region you want to activate the extensions in.
87+
- `<subnet-id>,<subnet-id>` are the subnet(s) you want to deploy the link in. No spaces between the subnet IDs.
88+
Only one is required, but is recommended to have at least two. These subnets must have access to the FSxN management endpoint.
89+
- `<security-group-id>,<security-group-id>` are the security group that will be attached to the Lambda Link function.
90+
No spaces between the security group IDs. Only one is required.
91+
- `<link_name>` is the name you want to give the link. It is also used as the name assigned to the link Lambda function.
92+
93+
Once you have done this, you are ready to start using the examples in this repository.
94+
95+
| File | Description |
96+
|------|-------------|
97+
|create_clone.yaml|Creates a clone of an existing FSx for NetApp ONTAP volume.|
98+
|create_export.yaml|Creates an export policy for an FSx for NetApp ONTAP file system.|
99+
|create_sm_with_peering.yaml|Creates a SnapMirror relationship with a specified source volume. It will also establish the vserver and cluster peering relationships.|
100+
|create_sm_without_peering.yaml|Creates a SnapMirror relationship with a specified source volume. It assumes that there is already a peering relationship between the source and destination clusters and vservers.|
101+
|create_snapshot.yaml|Creates a snapshot of an FSx for NetApp ONTAP volume.|
102+
|create_volume.yaml|Creates an FSx for NetApp ONTAP volume.|
103+
104+
Note that there is a script, in the `scripts` directory, for each of these CloudFormation templates that can be used to deploy them via the AWS CLI.
105+
106+
## Author Information
107+
108+
This repository is maintained by the contributors listed on [GitHub](https://github.com/NetApp/FSx-ONTAP-samples-scripts/graphs/contributors).
109+
110+
## License
111+
112+
Licensed under the Apache License, Version 2.0 (the "License").
113+
114+
You may obtain a copy of the License at [apache.org/licenses/LICENSE-2.0](http://www.apache.org/licenses/LICENSE-2.0).
115+
116+
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an _"AS IS"_ basis, without WARRANTIES or conditions of any kind, either express or implied.
117+
118+
See the License for the specific language governing permissions and limitations under the License.
119+
120+
© 2025 NetApp, Inc. All Rights Reserved.

‎CloudFormation/NetApp-FSxN-Custom-Resources-Samples/create_clone.yaml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
Description: "Create a clone of a FSx for ONTAP volume."
2+
3+
Parameters:
4+
FileSystemId:
5+
Description: "The File System ID."
6+
Type: String
7+
8+
SecretArn:
9+
Description: "The Secret ARN."
10+
Type: String
11+
12+
SecretKey:
13+
Description: "The key to use within the AWS secret."
14+
Default: "password"
15+
Type: String
16+
17+
LinkArn:
18+
Description: "The ARN to the Lambda link function."
19+
Type: String
20+
21+
SvmName:
22+
Description: "The name of the SVM that hold the parent volume."
23+
Type: String
24+
25+
CloneVolumeName:
26+
Description: "The desired name for the cloned volume."
27+
Type: String
28+
29+
ParentVolumeName:
30+
Description: "The name of the parent volume."
31+
Type: String
32+
33+
IsCloned:
34+
Description: "Set to false, during an update, to split the clone from its parent."
35+
Type: String
36+
Default: "true"
37+
38+
Resources:
39+
CloneVolume:
40+
Type: "NetApp::FSxN::Volume"
41+
42+
Properties:
43+
FsxAdminPasswordSource:
44+
Secret:
45+
SecretArn: !Ref SecretArn
46+
SecretKey: !Ref SecretKey
47+
FileSystemId: !Ref FileSystemId
48+
LinkArn: !Ref LinkArn
49+
SVM:
50+
Name: !Ref SvmName
51+
Name: !Ref CloneVolumeName
52+
53+
Clone:
54+
ParentSVM:
55+
Name: !Ref SvmName
56+
ParentVolume:
57+
Name: !Ref ParentVolumeName
58+
IsCloned: !Ref IsCloned

‎CloudFormation/NetApp-FSxN-Custom-Resources-Samples/create_export_policy.yaml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
Description: "Create an export policy for an FSx for ONTAP file system.."
2+
3+
Parameters:
4+
FileSystemId:
5+
Description: "The File System ID."
6+
Type: String
7+
8+
SecretArn:
9+
Description: "The Secret ARN."
10+
Type: String
11+
12+
SecretKey:
13+
Description: "The key within the AWS secret that holds the password."
14+
Default: "password"
15+
Type: String
16+
17+
LinkArn:
18+
Description: "The ARN to the Lambda link function."
19+
Type: String
20+
21+
SvmName:
22+
Description: "The SVM Name."
23+
Type: String
24+
25+
PolicyName:
26+
Description: "The Desired Export Policy Name."
27+
Type: String
28+
29+
MatchCidr:
30+
Description: "The IP CIDR to match."
31+
Type: String
32+
33+
Protocols:
34+
Description: "The protocols to allow."
35+
Type: CommaDelimitedList
36+
37+
Resources:
38+
ExportPolicy:
39+
Type: "NetApp::FSxN::ExportPolicy"
40+
41+
Properties:
42+
FsxAdminPasswordSource:
43+
Secret:
44+
SecretArn: !Ref SecretArn
45+
SecretKey: !Ref SecretKey
46+
FileSystemId: !Ref FileSystemId
47+
LinkArn: !Ref LinkArn
48+
SVM:
49+
Name: !Ref SvmName
50+
Name: !Ref PolicyName
51+
Rules:
52+
- AllowSuid: true
53+
Clients:
54+
- Match: !Ref MatchCidr
55+
Protocols: !Ref Protocols
56+
RoRule:
57+
- any
58+
RwRule:
59+
- any
60+
Superuser:
61+
- any

‎CloudFormation/NetApp-FSxN-Custom-Resources-Samples/create_sm_with_peering.yaml‎

Lines changed: 148 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
Description: "Create a SM relationship between two volumes. Includes peering the clusters and vservers. It assumes the destination volume does not exist and will create it."
2+
3+
Parameters:
4+
SourceLinkArn:
5+
Description: "The ARN to the Lambda link function."
6+
Type: String
7+
8+
SourceSecretArn:
9+
Description: "The Secret ARN that holds the source fsxadmin password."
10+
Type: String
11+
12+
SourceSecretKey:
13+
Description: "The key to use within the AWS secret that holds the faxadmin password."
14+
Default: "password"
15+
Type: String
16+
17+
SourceFileSystemId:
18+
Description: "The File System ID of the source volume."
19+
Type: String
20+
21+
SourceSvmName:
22+
Description: "The SVM name that holds the source volume."
23+
Type: String
24+
25+
SourceVolumeName:
26+
Description: "The name of the source volume."
27+
Type: String
28+
29+
DestinationLinkArn:
30+
Description: "The ARN to the Lambda link function that manages the destination FSxN file system."
31+
Type: String
32+
33+
DestinationSecretArn:
34+
Description: "The Secret ARN that holds the destination fsxadmin password."
35+
Type: String
36+
37+
DestinationSecretKey:
38+
Description: "The key to use within the AWS secret that holds the destination fsxadmin password."
39+
Default: "password"
40+
Type: String
41+
42+
DestinationFileSystemId:
43+
Description: "The File System ID of the destination file system."
44+
Type: String
45+
46+
DestinationSvmName:
47+
Description: "The name of the SVM that holds the destination volume."
48+
Type: String
49+
50+
DestinationVolumeName:
51+
Description: "The name of the destination volume."
52+
Type: String
53+
54+
DestinationAggregate:
55+
Description: "The aggregate to use when creating the destination volume."
56+
Type: CommaDelimitedList
57+
Default: "aggr1"
58+
59+
Policy:
60+
Description: "The SnapMirror policy to use."
61+
Type: String
62+
Default: "MirrorAllSnapshots"
63+
64+
Reverse:
65+
Description: "Reverse the relationship. Can be set to 'true' during an CloudFormation update to reverse the relationship."
66+
Type: String
67+
Default: "false"
68+
69+
Resources:
70+
SnapMirrorRelationship:
71+
Type: "NetApp::FSxN::SnapMirror"
72+
73+
DependsOn: "SvmPeerRelations"
74+
Properties:
75+
FsxAdminPasswordSource:
76+
Secret:
77+
SecretArn: !Ref SourceSecretArn
78+
SecretKey: !Ref SourceSecretKey
79+
FileSystemId: !Ref SourceFileSystemId
80+
LinkArn: !Ref SourceLinkArn
81+
82+
FsxnDestinationInfo:
83+
FsxAdminPasswordSource:
84+
Secret:
85+
SecretArn: !Ref DestinationSecretArn
86+
SecretKey: !Ref DestinationSecretKey
87+
FileSystemId: !Ref DestinationFileSystemId
88+
LinkArn: !Ref DestinationLinkArn
89+
90+
SnapMirrorSourceEndpoint:
91+
SVM:
92+
Name: !Ref SourceSvmName
93+
Volume: !Ref SourceVolumeName
94+
95+
SnapMirrorEndpoint:
96+
SVM:
97+
Name: !Ref DestinationSvmName
98+
Volume: !Ref DestinationVolumeName
99+
100+
SnapMirrorDestinationCreation:
101+
Aggregates: !Ref DestinationAggregate
102+
103+
Policy: !Ref Policy
104+
Reverse: !Ref Reverse
105+
106+
ClusterPeerRelations:
107+
Type: "NetApp::FSxN::ClusterPeer"
108+
109+
Properties:
110+
FsxAdminPasswordSource:
111+
Secret:
112+
SecretArn: !Ref SourceSecretArn
113+
SecretKey: !Ref SourceSecretKey
114+
FileSystemId: !Ref SourceFileSystemId
115+
LinkArn: !Ref SourceLinkArn
116+
117+
FsxnDestinationInfo:
118+
FsxAdminPasswordSource:
119+
Secret:
120+
SecretArn: !Ref DestinationSecretArn
121+
SecretKey: !Ref DestinationSecretKey
122+
FileSystemId: !Ref DestinationFileSystemId
123+
LinkArn: !Ref DestinationLinkArn
124+
125+
SvmPeerRelations:
126+
Type: "NetApp::FSxN::SvmPeer"
127+
128+
DependsOn: "ClusterPeerRelations"
129+
Properties:
130+
FsxAdminPasswordSource:
131+
Secret:
132+
SecretArn: !Ref SourceSecretArn
133+
SecretKey: !Ref SourceSecretKey
134+
FileSystemId: !Ref SourceFileSystemId
135+
LinkArn: !Ref SourceLinkArn
136+
137+
FsxnDestinationInfo:
138+
FsxAdminPasswordSource:
139+
Secret:
140+
SecretArn: !Ref DestinationSecretArn
141+
SecretKey: !Ref DestinationSecretKey
142+
FileSystemId: !Ref DestinationFileSystemId
143+
LinkArn: !Ref DestinationLinkArn
144+
145+
PeerSvmName: !Ref DestinationSvmName
146+
SVM:
147+
Name: !Ref SourceSvmName
148+
Applications: ["snapmirror"]

0 commit comments

Comments
 (0)