Abstract: Systems and methods for role-based access control for a storage system are described. An illustrative method includes an access control system identifying, based on a role of a user requesting access to the storage system, a permission of the role to access a resource type; determining, based on the resource type and on a mapping of resources of different secured endpoints of the storage system to resource types, a set of resources of the storage system that the role has permission to access; identifying a subset of the set of resources of the storage system that the user is authorized to access; and granting the user role-based access to the subset of the set of resources of the storage system.

Abstract: Data protection for container storage, including: assigning, to a container storage volume of a storage system, a volume-level access policy; and determining whether to allow access to the container storage volume based on the volume-level access policy and one or more attributes of a request for the access, including allowing the access responsive to the one or more attributes meeting the volume-level access policy or denying the access responsive to the one or more attributes failing to meet the volume-level access policy.

Abstract: Automatic storage system configuration for mediation services that includes: determining that a particular storage system of the storage systems is not configured to request mediation from a mediation target for mediation between storage systems synchronously replicating a dataset; requesting, by the particular storage system from a configuration service, configuration information indicating one or more service handles for a mediation service; and configuring, in dependence upon the one or more service handles received from the configuration service, a mediation handler to communicate with the mediation service responsive to detecting a communication fault with one of the storage systems.

Abstract: A method for processing blocks of flash memory to decrease raw bit errors from the flash memory is provided. The method includes identifying one or more blocks of the flash memory for a refresh operation and writing information regarding the identified blocks, to a data structure. The method includes issuing background reads to the identified blocks, according to the data structure, as the refresh operation. The method may be embodied on a computer readable medium. In some embodiments the background reads may be based on a time based refresh responsive to an increase in raw bit error count in the flash memory over time.

Abstract: A method for execution by one or more computing devices of a storage network includes identifying a storage unit of a set of storage units for testing, where a data segment of data is error encoded into a set of encoded data slices that is stored in the set of storage units. The method further includes determining whether a threshold number of favorably performing other storage units of the set of storage units will be available during the testing. When the threshold number of favorably performing other storage units will be available, the method further includes initiating the testing of the storage unit and setting a status of the storage unit to unavailable. When the testing has been completed, the method further includes updating the status of the storage unit to available. The method further includes generating a testing report regarding the testing of the storage unit.

Abstract: A system and method for efficient use of zones in a storage system. The method includes: building a frontier set comprising one or more zones of one or more storage devices for writing to; writing data to at least one zone of the one or more zones included in the frontier set; and during a bootup sequence: accessing a frontier set list to identify the one or more zones in the frontier set; and scanning the one or more zones to identify the at least one zone that data was written to.

Abstract: A storage system and related method are for operating solid-state storage memory in a storage system. Zones of solid-state storage memory are provided. Each zone includes a portion of the solid-state storage memory. The zone has a data write requirement for the zone for reliability of data reads. The storage system adjusts power loss protection for at least one zone. The adjusting is based on the data write requirement for the zone and responsive to detecting a power loss.

Abstract: A storage system determines a change in storage system geometry that affects at least one previously formed resiliency group of storage system resources. The storage system forms at least one resiliency group of storage system resources in accordance with rules that emphasize stability of formation of resiliency groups. The storage system accesses data stripes across storage system resources of resiliency groups.

Abstract: Performing a tune-up procedure on a storage device including determining, during a boot process, that a first storage device is available for a tune-up procedure, wherein the tune-up procedure prepares the first storage device for use after being offline; reserving the first storage device to perform the tune-up procedure, wherein reserving the first storage device prevents another system from performing the tune-up procedure on the first storage device; and executing the tune-up procedure on the first storage device.

Abstract: Creating a replica of a storage system, including: receiving, by a first storage system from a computing device, data to be stored on the first storage system; reducing, by the first storage system, the data using one or more data reduction techniques; sending, from the first storage system to the second storage system, the reduced data, wherein the reduced data is encrypted; and sending, from the second storage system to a third storage system, the reduced data, wherein the reduced data is encrypted.

Abstract: An illustrative method includes determining that a total amount of read traffic and write traffic processed by a storage system during a time period exceeds a threshold; determining a first compressibility metric associated with the write traffic; determining a second compressibility metric associated with the read traffic; determining, based on a comparison of the first compressibility metric with the second compressibility metric, that the write traffic is less compressible than the read traffic; determining, based on the total amount of read traffic and write traffic exceeding the threshold and on the write traffic being less compressible than the read traffic, that the storage system is possibly being targeted by a security threat; and modifying, in response to the determining that the storage system is possibly being targeted by the security threat, a data protection parameter set for one or more recovery datasets generated by the storage system.

Abstract: A method includes identifying traits associated with a number of storage units of a storage network to produce identified traits. The method further includes determining a plurality of sets of storage pool traits based on the identified traits, where a first set of storage pool traits of the plurality of sets of storage pool traits has a common trait of the identified traits. The method further includes selecting a plurality of groups of storage units from the number of storage units based on the plurality of sets of storage pool traits. The method further includes selecting a storage unit from each of the plurality of groups of storage units in accordance with a selection approach to produce a storage set of selected storage units. The method further includes utilizing the storage set of selected storage units for storing data in the storage network.

Abstract: Restoring a storage system from a replication target, including: receiving, by a first storage system from a computing device, data to be stored on the first storage system; reducing, by the first storage system, the data using one or more data reduction techniques; sending, from the first storage system to the second storage system, the reduced data, wherein the reduced data is encrypted; and retrieving, by the first storage system from the second storage system, the reduced data, wherein the reduced data is encrypted.

Abstract: In a particular embodiment, a virtual namespace identifier is mapped to one or more volumes stored among a pool of storage resources, wherein at least a first storage system and a second storage system are utilized to provide the storage resources. The virtual namespace identifier is migrated among the pool of storage resources to virtualize a data path for the one or more volumes.

Abstract: Coalescing write operations in a cloud-based storage system including receiving, from a storage controller application of the cloud-based storage system, a first plurality of write operations, wherein each of the first plurality of write operations comprises a respective write to a storage volume; coalescing the first plurality of write operations into a plurality of coalesced write operations, wherein each of the coalesced write operations are configured to effect two or more of the first plurality of write operations; and performing the plurality of coalesced write operations on the storage volume.

Abstract: A processing system is operable to encode data to produce a first set of data slices based on a value of a width parameter. The data is stored based on maintaining storage of the first set of data slices across a set of storage units of a storage pool. Storage of the first set of data slices is maintained in the set of storage units of the storage pool after addition of an additional set of storage units added to the storage pool. The value of the width parameter is increased to an increased value to produce an updated width parameter. The data is re-encoded in accordance with the updated width parameter to produce a second set of data slices. The data is re-stored based on maintaining storage of the second set of data slices across the expanded set of storage units of the storage pool.

Abstract: A processing system of a storage network operates by: selecting a queue memory type of a plurality of memory types to store a data object, based on a size parameter associated with the data object; storing the data object in a queue memory device having the queue memory type, when the queue memory type is selected; selecting a main memory type of a plurality of memory types to store the data object, when the queue memory type is not selected; and storing the data object in a main memory device having the main memory type, when the queue memory type is not selected; wherein the data object is dispersed error encoded and stored as a plurality of encoded data slices.

Abstract: A method for execution by one or more computing devices of a storage network includes generating an audit record data file regarding the execution of a data access request associated with a transaction within the storage network, where the transaction is associated with encoded data slices. The method continues with generating an audit object data log that includes at least the audit record data file and storing the audit object data log in at least one memory of the storage network. The method continues retrieving, from the at least one memory, the audit record data file of the audit object data log based on the information associated with the transaction. The method continues auditing the transaction for storage network operational compliance based on at least the audit record data file.

Abstract: A storage network operates by: encoding a data segment into a set of encoded data slices, wherein a read threshold of encoded data slices of the set of encoded data slices is required to decode the data segment, wherein the read threshold has a value greater than one, and wherein the data segment has an associated security level; selecting a subset of the plurality of storage units based on the security level, wherein the subset includes at least the read threshold of storage units of the plurality of storage units, wherein each of the subset of the plurality of storage units has a connection security approach that corresponds to the security level; and communicating the set of encoded data slices to the subset of the plurality of storage units in accordance with the connection security approach associated with each of the subset of the plurality of storage units.

Abstract: An illustrative method includes a storage management system detecting an event within a storage system, determining an operation based on the event, and providing a notification of the operation to an orchestration system configured to manage an execution of the operation by a computing system associated with the storage system.