VAST Data集群管理工具

Prerequisites

• Python 3.10+
• jq: Command-line JSON processor (required for field transformations in YAML templates)

Installing jq

macOS:

brew install jq

Linux (Ubuntu/Debian):

sudo apt-get install jq

Linux (RHEL/CentOS):

sudo yum install jq

Optional Dependencies

```bash

All optional dependencies

pip install 'vast-admin-mcp[all]' ```

1. Install

Install vast-admin-mcp:

```bash

If installed via pip

pip install vast-admin-mcp

```

2. Initial Setup

Configure your VAST cluster connection:

```bash

If installed via pip

vast-admin-mcp setup

This will prompt you for: - Cluster address (IP, FQDN, or URL like https://host:port) - Username and password - Tenant (for tenant admins) - Tenant (for super admins - which tenant context to use) ```

Installation

Basic Installation

pip install vast-admin-mcp

HTTP server support (for network deployment)

pip install 'vast-admin-mcp[http]'

Docker Installation

Building the Docker Image

Quick Build (Recommended)

Use the provided build script that automatically handles versioning:

make build-docker

This will: - Extract version from src/vast_admin_mcp/__about__.py - Tag the image with both version number and latest - Add metadata labels (version, build date, git commit)

Manual Build

```bash

Simple build

docker build -t vast-admin-mcp:latest .

Build with version tags

VERSION=$(grep -E '^version' src/vast_admin_mcp/about.py | sed 's/version\s*=\s*"\([^"]*\)"/\1/') docker build \ --build-arg VERSION="${VERSION}" \ --build-arg BUILD_DATE="$(date -u +'%Y-%m-%dT%H:%M:%SZ')" \ --build-arg VCS_REF="$(git rev-parse --short HEAD)" \ -t vast-admin-mcp:${VERSION} \ -t vast-admin-mcp:latest \ . ```

Running CLI Commands in Docker

Option 1: Using the helper script (recommended)

```bash

Configuring MCP Server for Desktop LLMs (Docker)

When running mcpsetup inside Docker, it will automatically detect Docker and generate appropriate docker run or docker exec commands:

```bash

Inside Docker container

./vast-admin-mcp-docker.sh mcpsetup claude-desktop

Or using docker-compose

docker-compose exec app vast-admin-mcp mcpsetup claude-desktop

The generated configuration will use Docker commands that the host can execute, with proper volume mounts for configuration files.

**Environment Variables for Docker:**
- `DOCKER_CONTAINER_NAME`: Use existing container name (for `docker exec`)
- `DOCKER_IMAGE`: Docker image name (for `docker run`)
- `DOCKER_CONFIG_MOUNT`: Container path for config mount (default: `/root/.vast-admin-mcp`)
- `DOCKER_TEMPLATE_FILE`: Host path to custom template file (optional, for override)

**Example:**

Set container name for docker exec mode

export DOCKER_CONTAINER_NAME=vast-admin-mcp ./vast-admin-mcp-docker.sh mcpsetup cursor

Or set image for docker run mode

export DOCKER_IMAGE=vast-admin-mcp:latest ./vast-admin-mcp-docker.sh mcpsetup claude-desktop

Network Deployment (HTTP)

By default, the MCP server uses stdio transport for desktop AI assistant integration. For network access (remote clients, Kubernetes, containerized deployments), you can run the server with HTTP transport.

Docker HTTP Mode

```bash

Kubernetes / OpenShift Deployment

Complete Kubernetes and OpenShift manifests are provided in deploy/kubernetes/. See the Kubernetes Deployment Guide for detailed instructions.

Quick Start

```bash

3. Deploy (HTTP)

kubectl apply -f deploy/kubernetes/vast-admin-mcp.yaml -n vast-admin-mcp

Setup Menu for HTTP Configuration

Run vast-admin-mcp setup to interactively configure HTTP server settings:

```

Install PySocks for SOCKS proxy support

pip install 'vast-admin-mcp[socks]'

Quick Start

Prompt Examples

#### For Read-only mode

List all VAST clusters 
List all views on cluster cluster1
Show me all tenants across all clusters
Create bandwidth and iops graph for cluster1 over the last hour
create dataflow diagram for cluster1 for /path view on the tenant3 tenant for the last hour 
show me dataflow diagram for 172.21.224.139 on cluster1
Show me the hardware topology for cluster cluster1 
Are there any issues with my configured data protection relationships ? 
Create mini support bundle on cluster1 and name it bundle1. Timeframe should be yesterday at midnight for 4m. Generate it only for cnodes prefixed by cnode-128 and upload it to support without private data.
Find all users prefixed with "s3" on cluster cluster1 tenant tenant1
Are there any critical alerts on my clusters that were not acknoledged ?
List all snapshots for view path /data/app1 on cluster cluster1 tenant tenant1
Show me all quotas configured for tenant tenant1 on cluster cluster1
Get performance metrics for cnodes on cluster cluster1 over the last 7 day
Show me all view policies on cluster cluster1 that support S3 
First, get all available clusters. Then compare views with path "/" across all clusters, showing capcity information
Show me all tenants on cluster cluster1, for each tenant show me the 5 views with the highest used capacity
Get performance metrics for cluster cluster1, then get metrics for all cnodes, and finally get metrics for top 3 views. Show me a summary of IOPS and bandwidth for each object type
Find all views where logical used capacity is greater than 1TB. For each of these views, get their performance metrics over the last 24 hours and show which views have the highest IOPS

Create a new NFS view on cluster cluster1 with path /data/newview in tenant tenant1
Create a view on cluster cluster1 with path /shared/data in tenant tenant1 that supports both NFS and S3 protocols
Create a snapshot named "backup-2024-01-15" for view path /data/app1 on cluster cluster1, tenant tenant1 and keep it for 24h
Create a clone from snapshot "backup-2024-01-15" of view /data/app1. The clone should be at path /data/app1-clone in tenant tenant1 on cluster cluster1
Set a hard quota of 10TB for view path /data/app1 on cluster cluster1, tenant tenant1
Create 3 new views for vmware based on template. 
Create a indestructible snapshot named resrote-point_<view name> for all vmware views on cluster1 
Refresh a clone from most recent snapshot of view /data/app1 at path /data/app1-clone in tenant tenant1 on cluster cluster1

3. Configure MCP Server in you AI assistance

Use mcpsetup to get instructions for common AI assistance tools:

```bash

Optional: Set version (defaults to 0.1.3)

export VERSION=0.2.3

Select option 5: Configure HTTP server settings

Select option 2 or 3 for OAuth configuration

```

Supports: - Built-in providers: GitHub, Google, Azure AD - Generic OAuth/OIDC: Okta, Keycloak, Auth0, or any OIDC-compliant provider

With custom options

vast-admin-mcp gencert --cn mcp.example.com --days 365

2. Edit vast-admin-mcp.yaml with your credentials and cluster config

VAST Admin MCP - Configuration Management

HTTP Server: Disabled

Available options: 5. Configure HTTP server settings 6. Manage authentication token ```

Option 5 allows you to configure: - Enable/disable HTTP server - Host, port, and URL path - Authentication (bearer token, OAuth, or none) - SSL/TLS (existing certs, generate self-signed, or none)

Option 6 allows you to: - Generate new authentication tokens - View or export current token - Rotate tokens

Configuration

• Config File: ~/.vast-admin-mcp/config.json (cluster configurations, no env var override)
• Default Template File: mcp_list_cmds_template.yaml in project root (shipped template)
• Template Modifications File: ~/.vast-admin-mcp/mcp_list_template_modifications.yaml (user customizations)
• View Templates File: ~/.vast-admin-mcp/view_templates.json (for view template-based creation). This file can be modified based on the template example view_templates_example.yaml in project root (shipped template)
• Log Files: ~/.vast-admin-mcp/vast_admin_mcp.log

Environment Variables

Authentication

• VAST_ADMIN_MCP_AUTH_TOKEN: Bearer token for HTTP authentication

export VAST_ADMIN_MCP_AUTH_TOKEN="vamt_your-secure-token"
vast-admin-mcp mcp --transport http --host 0.0.0.0

Template File Paths

Template file paths can be overridden using environment variables:

• VAST_ADMIN_MCP_DEFAULT_TEMPLATE_FILE: Override default template file path
• VAST_ADMIN_MCP_TEMPLATE_MODIFICATIONS_FILE: Override template modifications file path
• VAST_ADMIN_MCP_VIEW_TEMPLATE_FILE: Override view templates file path

Example:

export VAST_ADMIN_MCP_DEFAULT_TEMPLATE_FILE=/custom/path/default_template.yaml
export VAST_ADMIN_MCP_TEMPLATE_MODIFICATIONS_FILE=/custom/path/modifications.yaml
export VAST_ADMIN_MCP_VIEW_TEMPLATE_FILE=/custom/path/view_templates.json
vast-admin-mcp list views

Proxy Configuration

The server supports HTTP/HTTPS and SOCKS proxies for reaching VAST clusters through corporate or enterprise network environments. Proxies are configured via standard environment variables:

• HTTPS_PROXY or https_proxy — highest precedence (recommended for VAST since the API uses HTTPS)
• HTTP_PROXY or http_proxy — fallback
• ALL_PROXY or all_proxy — catch-all, recommended for SOCKS proxies

Bypassing the proxy (NO_PROXY):

Use NO_PROXY (or no_proxy) to list hosts that should connect directly, without going through the proxy. Separate multiple entries with commas. A wildcard * bypasses the proxy for all hosts.

```bash

Configuration

The whitelist is defined in the YAML template file:

api_whitelist:
  # Simple format - GET only
  - clusters
  - tenants
  
  # With methods - GET + specified methods
  - views: [post]  # GET + POST for create operations
  - snapshots: [post]  # GET + POST for create operations
  - quotas: [post, patch]  # GET + POST + PATCH for create/update operations

Run any CLI command

./vast-admin-mcp-docker.sh clusters ./vast-admin-mcp-docker.sh list views --cluster cluster1 ./vast-admin-mcp-docker.sh setup ./vast-admin-mcp-docker.sh mcpsetup cursor

#### Option 2: Using docker run directly

API Whitelist

The API whitelist provides security by restricting which VAST API endpoints and HTTP methods can be accessed. It is configured in the YAML template file's api_whitelist section.

Add additional Subject Alternative Names

vast-admin-mcp gencert --san mcp.example.com --san 192.168.1.100

#### Use with HTTP Server