Features of PFS

To exactly match a specific directory, the resource path in the policy must end with a slash (/). When checking permissions, parallel file systems consider objects as directories. Since objects do not end with a slash (/), PFS will add a slash (/) to the end of objects and then perform a policy matching.

Example 1: Grant a user the permissions required to download dir_1, excluding its subdirectories.

In the following configuration, the resource path ends with a slash (/). In such case, a success response can be returned when dir_1 or dir_1/ is contained in the URL of a head request.

Note that this configuration is not applied to subdirectories or files in dir_1. Therefore, a failure response will be returned if a head request is sent to dir_1/file1.

{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "obs:object:GetObject",
            ],
            "Resource": [
                "obs:*:*:object:examplebucket/dir_1/",
            ]
        }
    ]
}

Example 1: Grant a user the permissions required to download dir_1, excluding its subdirectories.

In the following configuration, the resource path ends with a slash (/). In such case, a success response can be returned when dir_1 or dir_1/ is contained in the URL of a head request.

{
    "Statement":[
    {
      "Sid":"test",
      "Effect":"Allow",
      "Principal": {"ID": ["domain/b4bf1b36d9ca43d984fbcb9491b6fce9:user/71f3901173514e6988115ea2c26d1999"]},
      "Action":["*"],
      "Resource":[
        "examplebucket/dir_1/",
      ]
    }
  ]
}

• A lifecycle rule can be used to manage files, but it cannot transition a directory to the Archive storage class. However, a lifecycle rule can delete an empty directory upon expiration.
• File deletion upon expiration and transition to the Archive storage class can be configured using either the API or console, while transition to Infrequent Access can only be configured using the API. PFS does not support versioning, so lifecycle actions (including deletion upon expiration and transition to the Archive or Infrequent Access storage class) that are related to versioning cannot be applied.
• If direct reading is enabled for a parallel file system, you can read files stored in the Archive storage class without restoring them first.
• A maximum of 20 lifecycle rules can be configured for a parallel file system.
• The time applied for a lifecycle rule to work on a file is when the data of the file was last updated.
• Lifecycle rules cannot transition files to the Deep Archive storage.
• A lifecycle rule configured for a parallel file system has limits on how many directories it can apply to. It will take longer time to execute the actions defined in the rule if:
  1. There are over 100,000 level-1 subdirectories in each directory.
  2. There are over 10 million subdirectories (folders) matching the specified prefix in total.
  3. There are over 30 million files matching the specified prefix in total.

• If renamed files or files in a renamed directory meet the conditions specified in a lifecycle rule, the time when the file data was most recently updated, not when the files were renamed, will be applied for the lifecycle rule to take effect. In addition, the effective time of the lifecycle rule may be delayed for up to seven days.

• For a file copy on a client, the lifecycle rule determines when to expire the file copy or transition it to the Archive storage class based on the file copy creation time.
  • For example, if a file, src.txt, was created on January 1, 2019, and was then copied to the des.txt file by running the cp -a src.txt des.txt command on September 1, 2019. Then the lifecycle rule calculated when to perform the specified actions on the file copy based on September 1, 2019.
• A lifecycle rule periodically scans directories in the file system and then deletes the directories that meet the expiration conditions. A scan starts from the deepest directory. The scanned empty directories that meet the expiration conditions will be deleted, and those non-empty directories will not be processed. Scan intervals (usually seven days) vary depending on cluster configurations. For this mechanism, a single-level directory that meets the expiration conditions will be deleted 0 to 7 days after it has been emptied. Accordingly, a two-level directory will be deleted 0 to 14 days after it has been emptied. Each time a directory level is added, the waiting time for deletion increases by seven days.