Abstract: A storage system with storage drives and a processing device establishes resiliency groups of storage system resources. The storage system determines an explicit trade-off between data survivability over resource failures and data capacity efficiency, for the resiliency groups. Responsive to adding at least one storage drive, the storage system establishes re-formed resiliency groups according to the explicit trade-off, without decreasing data survivability. The storage system may bias to have more and narrower resiliency groups to increase mean time to data loss.

Abstract: One or more performance parameters associated with data stored at a storage device of a plurality of storage devices are received by a storage controller. A first number of blocks of the storage device to a high resiliency portion and a second number of blocks of the storage device to a low resiliency portion of the storage device are allocated based on the one or more performance parameters.

Abstract: An example method for monitoring volume dependencies for security threats comprises: detecting a request to perform an operation with respect to a volume included in a plurality of volumes included in a storage system; determining, based on a dependency mapping that specifies dependencies between the plurality of volumes, that performance of the operation would affect a dependency between the volume and one or more other volumes included in the plurality of volumes; and determining, based on the determining that the performance of the operation would affect the dependency between the volume and the one or more other volumes, that the request is possibly associated with a security threat against data stored by the storage system.

Abstract: A list of a available zones across respective SSD storage portions of a plurality of zoned storage devices of a storage system is maintained. Data is received from multiple sources, wherein the data is associated with processing a dataset, the dataset including multiple volumes and associated metadata. Shards of the data are determined such that each shard is capable of being written in parallel with the remaining shards. The shards are mapped to a subset of the available zones, respectively. The shards are written to the subset of the available zones in parallel.

Abstract: An illustrative system is configured to optimize a transfer of a file system from a source storage system to a target storage system. For example, the system, in association with the transfer, determines that a copy of a collection of blocks containing data of block objects of the file system is already stored at the target storage system. In certain examples, an identifier referencing the collection of blocks is shared by the source and target storage systems and is used to determine that the copy of the collection of blocks containing data of block objects of the file system is already stored at the target storage system. The system uses the copy of the collection of blocks already stored at the target storage system instead of transferring the collection of blocks from the source storage system to the target storage system as part of the transfer.

Abstract: A storage system, associated with a container system, may be configured to perform a method that includes: providing, by the storage system to a container operating within a container system, one or more storage services; determining, by the storage system, an interruption to the one or more storage services; and providing, based on the interruption and from the storage system to a container orchestrator for the container system, an alert associated with the container.

Abstract: A method includes a data protection system determining, based on a first security threat detection process, that a storage system is possibly being targeted by a security threat; performing, based on the determining that the storage system is possibly being targeted by the security threat, a first remedial action with respect to the storage system, the first remedial action comprising generating a snapshot of data stored by the storage system; confirming, based on a second security threat detection process, whether the storage system is possibly being targeted by the security threat; and performing, based on the confirming whether the storage system is possibly being targeted by the security threat, a second remedial action with respect to the storage system, the second remedial action comprising specifying a retention duration with respect to the snapshot.

Abstract: An illustrative method includes receiving, by a container storage interface (CSI) filter driver, a request provided by a source for a CSI driver associated with a storage system to perform a control plane operation with respect to the storage system, wherein the CSI filter driver and the CSI filter execute on a node of a cluster managed by a container orchestrator, and wherein the storage system is configured to store data associated with one or more containerized applications executing on the node; performing, by the CSI filter driver in response to receiving the request, an access control operation with respect the request; and allowing, by the CSI filter driver, the CSI driver to perform the control plane operation when the access control operation determines that the source is authorized to initiate the control plane operation.

Abstract: An illustrative method includes a storage management system receiving, from a containerized application, a storage operation request associated with a storage volume in a storage system, the storage system including a plurality of volume instances of the storage volume that correspond to a plurality of data management models, identifying, from the plurality of volume instances, one or more particular volume instances based on the storage operation request and a data management model of each volume instance in the plurality of volume instances, and directing the storage operation request to the one or more particular volume instances to be performed on the one or more particular volume instances.

Abstract: A method includes encoding a data segment into a set of encoded data slices using erasure coding; storing, in storage units of a storage network, the set of encoded data slices, in accordance with a shared key-based encryption system (SKBES) having keys shared with the storage units; retrieving, at a periodic rate and in accordance with the SKBES, the set of encoded data slices from the storage units of the storage unit to verify whether individual slices of the set of encoded data slices have been corrupted. When one of the set of encoded data slices stored in one of the storage units has been corrupted, rebuilding the one of the set of encoded data slices by: retrieving the decode threshold number of other slices of the set of encoded data slices, in accordance with the SKBES; reconstructing the one of the set of encoded data slices based on the erasure encoding, to generate a reconstructed data slice; and storing, in accordance with the SKBES, the reconstructed data slice in the one of the storage units.

Abstract: An illustrative method includes an access control list (ACL) management system generating an ACL file containing an ACL that describes one or more access permissions in a file system, storing the ACL file within an ACL directory structure, the ACL file uniquely representing the ACL in the ACL directory structure, generating an ACL identifier for the ACL file, and mapping, using the ACL identifier, the ACL file to one or more data files in the file system to apply the ACL in the ACL file to the one or more data files.

Abstract: Providing persistent storage to transient cloud computing services, including: creating a cloud computing instance, wherein the cloud computing instance is created on on-premises cloud infrastructure; and storing, in non-volatile storage in a storage system that is communicatively coupled to the on-premises cloud infrastructure, data associated with the cloud computing instance.

Abstract: Coordinated checkpoints among storage systems implementing checkpoint-based replication, including orchestrating one or more coordinated lightweight checkpoints for a source dataset stored across two or more source storage systems; and coordinating a replication of the one or more coordinated lightweight checkpoints from the two or more source storage systems to two or more target storage systems.

Abstract: A storage system is provided. The storage system includes a plurality of non-volatile memory units and a processor operatively coupled to a plurality of non-volatile memory units. The processor is to perform a method including receiving a request to read data from the storage system. The method also includes determining whether a storage operation should be delayed, based on the request to read the data from the storage system. The method further includes in response to determining that the storage operation should be delayed, delaying the storage operation. The method further includes performing a read operation for the request to read the data.

Abstract: Migrating workloads to a preferred environment, including: predicting, for each of a plurality of environments, a performance load on each of a plurality of environments that would result from placing one or more of a plurality of workloads on the environment; determining a preferred environment for each of the plurality of workloads by determining a placement of each of the plurality of workloads that results in a best fit for the plurality of workloads; and deploying each of the plurality of workloads in the corresponding preferred environment.

Abstract: An illustrative method includes detecting a request to perform a cluster-wide snapshot of a cluster comprising one or more nodes on which one or more containerized applications are deployed, the snapshot corresponding to a point in time; preparing, based on the request, objects within the cluster for the snapshot; and generating, in response to the preparing, the cluster-wide snapshot of the cluster.

Abstract: Illustrative systems and methods provide application-aware management of storage systems, including application-aware orchestration of operations of storage systems by way of a telemetry-based orchestration pipeline. In certain examples, a remote management system receives, by way of a connection initiated by a storage device connected to a host to transmit telemetry data to the management system, data describing performance characteristics of the host and transmits, to the storage device by way of the same connection, data describing a set of instructions for orchestrating operations of the host. The storage device provides the set of instructions to the host to orchestrate operations of the host, such as by orchestrating operations of one or more applications executing on the host.

Abstract: Data protection in a storage system that includes a plurality of Non-Volatile Memory Express (‘NVMe’) Solid State Drives (‘SSDs’), including: retrieving, from a plurality of NVMe SSDs (‘Non-Volatile Memory Express Solid State Drives’) of a storage system, one or more unencrypted shares of a master secret; reconstructing the master secret using the shares of the master secret; decrypting one or more encrypted device keys using the master secret; and using the decrypted device keys to perform a plurality of accesses to one or more of the NVMe SSDs.

Abstract: A storage system has NVRAM (nonvolatile random-access memory), storage memory that includes SLC (single level cell) flash memory and QLC (quad level cell) flash memory, and a processor. The processor performs a method that includes determining that a size of a buffer of a storage system should be adjusted. The storage system comprises a non-volatile random-access memory (NVRAM), single level cell (SLC) flash memory, and quad level cell (QLC) flash memory. The buffer of the storage system comprises one or more of the NVRAM and a portion of the SLC flash memory. The method also includes adjusting the size of the buffer of the storage system to a first size.

Abstract: A method for execution by a storage unit of a storage begins by determining to perform a delete request, logging the deletion request and then replicating the delete request. The method then continues by sending a replicated delete request to every other storage unit of a set of storage units, wherein the set of storage units includes the storage unit. When a delete request acknowledgment is received from at least a delete threshold number of storage units of the set of storage units, the method then continues, by facilitating execution of the delete request by each storage unit of the set of storage units.