S3 Site Replication

Terminology

administrativemetadata;itnotwrites.

sites,external andpreparation

independent

Term	Meaning
Primary site	The currentmetadata authoritativeprimary writeowns site.
Secondaryis site	Anecessarily remotethe only site receivingaccepting asynchronousobject changes.
	The configured object-storage service, endpointsynchronization and backingrecovery: Cephnative storage.
IP Group	Service addressesprotection and orderedlocal eligibleincoming gatewaystate. nodes at 1. onePrerequisites cluster.
Disaster Use recoveryhealthy mode	Secondary site remains read-only until controlled promotion.
Active-active mode	Writes are allowed at more than one site; use onlyclusters with compatible applications.
Invitation	Short-lived trust package used once to join a destination site.

1. Configure the IP Group at each site

Open Cluster Management and select Create IP Group. Define a neutral group name, the ordered gateway nodes and one or more service addresses. With one address, the service runs through one gateway at a time. Multiple distributed addresses can spread client connections when all addresses are published under one DNS name.

• Place the preferred gateway first and define secondary and fallback nodes.
• Select Keep addresses together for a simple active/passive service address.
• Select Distribute addresses across gateway nodes only when at least two addresses and suitable DNS client distribution are available.
• Verify that the address network is reachable from S3 clients.

2. Create the S3 services

Create the primary S3 storage service and assign its IP Group, DNS name, certificate choice and local storage. At the destination, create a separate S3 service with itslocal ownstorage, an IP GroupGroup, eligible gateway nodes, stable DNS and storage,trusted butHTTPS docertificates. Verify routing, firewalls, time synchronization and endpoint reachability.

For native joining, the destination S3 service must be empty, with no buckets. Joining adopts that service; it does not createmerge bucketspopulated ornamespaces.

upload

For objects.online Onlyinvitations, enable the source REST API and allow the destination to reach the source management HTTPS listener, normally port 18443.

Record versioning, Object Lock, retention, legal holds, permissions and SMB gateway configuration. Define recovery authority, fencing, client routing, RPO and RTO.

For archive jobs, ensure the chosen worker node has source/archive connectivity and enough staging disk.

Keep certificate verification enabled. Configure private CA trust where needed; accepting an emptyuntrusted destinationcertificate serviceis canan beexplicit adoptedexception byfor controlled private systems.

2. Configure native eEKAS replication

Set up the replicationsource topology.

installation

Open
3.S3 Enable replication at the primary site
eEKAS
sync
Open→ S3Set Console,up choosesource Site Replication and select Enable Replication.
installation.
• Select the source S3 service instanceand to protect.
• Enterenter a neutral physical site name, for example primary-site-01.name.
• Select Disaster recovery unless(read-only thedestination), applicationor hasActive-active been(writes validatedallowed forat every site) only when applications tolerate concurrent multi-siteasynchronous writes.
• SelectKeep peer certificate verification enabled. Choose Enable and wait for the relationshiprelationship. toActive-active appear.requires acknowledgment of write conflicts.

Create a destinationone-time invitation

On the primary relationship, select Add Site. For normal connected deployments, choose One-time online invitation.

• Confirm the primary management address andnormally HTTPS port 18443.
• Choose 15 minutes, 60 minutes or 24 hours validity. Create the shortest practical invitation lifetime.
• Select Create Invitation and securelytransfer copy the one-timeits token and displayed management address.securely.
• Use the token before expiry. Review Invitations and revoke unused valid tokens.

The encrypted invitation-file methodoption whenrequires a passphrase of at least 12 characters. Transfer file and passphrase separately. The current destination web form accepts an online address and token; arrange the supported administrative import procedure before choosing the file method.



Join an empty destination

1. At the destination cannotopen reacheEKAS theto primaryeEKAS managementsync listener.→ TransferConnect thethis file and its passphrase through separate secure channels.installation.

5. Join the destination site

site

name.

Sign in to the destination cluster, open S3 Console, choose Site Replication and select Join Replication Site.

The screenshot was captured after the laboratory destination had already joined, so the empty-service list is blank. During first-time configuration it lists only eligible empty S3 services.

• Select the empty destination S3 service. ItsLocal storage, IP Group, listener portGroup and gateway-nodegateway selectionnodes willare beused adopted.
by
• Enterthe a neutral destination site name.replica.
• Enter the primarysource management address and one-time invitationtoken. token.Configure trusted CA information where applicable.
• Select Allow the private or untrusted certificate only for a controlled laboratory or private-certificate bootstrap where the certificate has been independently verified.
• Keep Disaster recovery as theintended destination modemode, unlesschoose active-active operation has been approved.
• Select Validate and Join.Join, Doreview the endpoint and acknowledge adoption of the empty service.
• Wait for setup and initial synchronization. Check both installations and read test objects through their actual S3 endpoints. In DR mode, verify destination writes are rejected.



If joining fails, inspect the returned error and Event Log. Partially completed setup may need administrator cleanup; do not closedelete replica pools or retained original storage to fix a naming error.

3. Policies and daily operation





The evaluated source view lists its local card, while the destination gatewayview is being deployed.

6. Verify synchronization

Return to the Site Replication overview and select Status. Confirm that both sites are present, the intended site is Primary, the destination is Primary/Secondary andlabels read-only,do andnot theprove relationshipremote reportshealth. synchronized.

• Verify both clusters report healthy storage and all intended S3 gateway instances are running.
• Upload a small non-sensitive test object at the primary site.
• Read the objectseparate throughsynchronization thestate destinationand endpoint.
gateway
• In disaster recovery mode, confirm that a write to the destination is rejected.
• Delete the test objectcount at theevery primary and confirm that the deletion is transferred.

Interpret status correctly

Synchronized means reported local incoming streams are caught up. It does not certify the opposite direction, zero data loss or physical-media backup. Check both sites. Syncing/behind requires follow-up, error indicates a problem, and unknown is insufficient evidence.

• Use Refresh and review endpoints, modes, gateways and Event Log.
• Operations offers local per-bucket statistics with Search and Next page, up to 50 entries per page. Counts do not verify the remote inventory.
• Pause/Resume affects local incoming synchronization. In active-active mode, this does not pause all outgoing or remote streams.
• Use Allow Writes or Make Read-only at the relevant secondary; recheck synchronization and applications.

Backfill, credentials and removal

Start Backfill Existing Objects on a destination for objects predating a replication rule. Monitor Backfill Jobs; pause, resume or cancel as needed. Treat backfill as a separate load phase and verify bytes and versions afterward.

Credential rotation: Stage Replacement at the primary → Adopt Replacement at every secondary → Activate Replacement at the primary → Finalize Rotation only after synchronization is healthy. The old key remains valid until finalization.

Removing a secondary from the primary topology is separate from decommissioning its installation. Local decommission stops gateways and removes replica configuration; data is retained unless deletion is explicitly selected and confirmed. Verify recovery alternatives first.

4. Native recovery

Recover S3 gateways

AnFor an unavailable endpoint on a running installation, check gateways, networking and IP Group protectshealth. Recover S3 gateways restarts local gateways and refreshes endpoint resources. Review the result, test a real S3 read/write and check catch-up. This does not rebuild lost storage or promote a secondary.

Promote a standby site

1. Identify the intended authority and latest replicated content; stop application writes during the decision where practical.
2. Stop or isolate the old primary and confirm fencing so it cannot resume independent authority.
3. Inspect surviving-site incoming synchronization, gateways and endpoint. Run Validate Recovery Readiness in Operations.
4. Choose Promote or configured Orchestrated Recovery, select the destination, type the displayed zone name and confirm primary isolation.
5. Use emergency force options only after explicitly accepting and recording possible loss of recent objects.
6. Update client routing manually or through tested global endpoint insideintegration. eachVerify site.bytes, Ifpermissions, WORM and application access.
7. Keep the activeformer gatewayprimary isolated on return. Refresh topology, reconcile and synchronize before enabling writes or arranging failback.

Recovery hooks and DNS/load-balancer integration need secure executables and tested configuration; a hostname alone does not provide automatic failover. Active-active object writes at a surviving site do not resolve metadata-primary loss. Total-primary-cluster loss and full promotion/failback were not exercised in the recorded evaluation.

5. Mirror current objects to another S3 instance

1. At the metadata-primary installation choose Sync to other S3 instance → Mirror current objects, select the source service and Configure one-way mirror.
2. In External Archive, enable the destination and enter its name, HTTPS endpoint, existing bucket, signing region, access key and secret.
3. Choose Mirror for current content and source deletions, or Copy only to keep extra destination objects. Choose Manual, Hourly or Daily.
4. Review Protection, deletion delay, protected archive, source scope and advanced rules. Save.
5. For a manual run choose Operations → Run Archive Now. Review results and Event Log; verify destination bytes and test overwrite/deletion in dedicated test buckets.

Each source bucket uses a same-named prefix inside the destination bucket. There is no reverse synchronization, checkpoint preview/restore, original-version reconstruction or ownership recovery. Copy only can overwrite an existing destination key. The delayed-deletion area is not a recovery catalogue. Keep unrelated content outside managed prefixes. Qualify listing duration and worker memory for large buckets; new independent external-mirror acceptance remains outstanding.

6. Configure backup and archive

1. Choose Sync to other S3 instance → Configure backup and archive, or New backup under S3 archive and recovery.
2. Enter a unique Backup name, external HTTPS address, existing destination bucket and access/secret keys.
3. Select the source zone. Whole zone covers current and future buckets; Individual buckets opens Available buckets and Selected for backup.
4. Search and add buckets. Selection persists across search/pages; Add this page adds only the displayed page. Remove excludes a selection.
5. Choose Standard backup (recommended), or planned Extra protection for older versions.
6. Choose the eEKAS node under Run this backup on. Create the backup through that node’s management page; verify connectivity and staging space.
7. Review advanced settings, Save backup, then Start backup. Saving alone does not start export. Wait for a completed checkpoint.

Standard backup reads generations still available at the source; it cannot capture a version already removed before reading. Maintain source versioning and WORM. Extra protection creates a local history zone/gateway with separate unused port (for example 9443), HTTPS endpoint, certificate/private key and storage. It adds capacity needs and does not itself survive total primary-site loss.

Use Backup settings for connection settings. For changes to storage identity, protection level or bucket set, create a new backup and retain access to old recovery points.

7. Monitor export and preserve recovery information

Select the backup and Refresh. States distinguish Starting backup, Copying files, Checking source files, Creating recovery point and Up to date — watching for changes. Check worker heartbeat, errors/retries, saved/waiting counters and latest completed checkpoint. Worker unavailable needs investigation at the selected node. Inventory continues if notification registration needs attention.

Pause export finishes current work before stopping; Resume export continues. Uploaded objects become part of supported recovery only when the next eligiblefull node.catalogue Clientsfinishes. shouldA reconnectcopy usingacknowledgment or quiet queue does not prove physical tape completion or verification.

1. Choose Export recovery bundle.
2. Use an encryption password of at least 16 characters and download the samebundle.
DNS
3. Keep namebundle, password and servicearchive address.access Clientinformation timeoutoutside the primary cluster; store password separately. Protect them as credentials.
4. Refresh recovery information after configuration changes and retryrehearse policyimport influenceon an isolated replacement.

8. Restore a checkpoint

1. Prepare a working replacement S3 service and credentials able to create/read/write recovery buckets. WORM requires supported protection operations.
2. Choose Restore from archive and a completed checkpoint by its UTC date; the visibleoriginal interruption.
   identifier
   appears in brackets. Load more if needed.
   • DoLeave Source bucket empty for all protected buckets, or restrict by bucket, literal prefix or exact object key. Prefix is not createa wildcard. Browse saved generations for older copies; preview is limited to 1,000 matches.
   • Enter destination HTTPS endpoint, credentials and private CA chain where needed. Use a separate applicationrecovery credentialsbucket prefix, such as recovery-. A single target bucket requires one source bucket.
   • Keep replacement of existing objects disabled unless needed for eachunprotected localdata. gateway;WORM recovery requires new buckets regardless of overwrite settings.
   • Create recovery preview; inspect counts, conflicts, unavailable generations and protection information before starting.
   • Start the gatewaysreviewed servejob and monitor progress, failures, pause/resume or cancellation.
   • Verify bytes, retention and legal holds. Review bucket-configuration preview before applying ownership and permissions. Original ownership can remove the samerecovery S3account’s service.
   access;
   • Monitorlifecycle theexpiration servingstays nodedisabled andduring gateway health after maintenance or failover.
   • Test local failover separately from site disasterconfiguration recovery.
3. Restore client
   routing

   Siteand outageSMB procedure

   gateway/share configuration after content and permissions pass validation.

AUse sitenew promotionbucket isnames arather controlledthan disaster-recoverydeleting decision,WORM buckets or weakening retention. Older checkpoints without verified Object Lock metadata are refused. Independently restored objects need not anretain automaticoriginal responseS3 toversion temporaryidentifiers.

After loss of connectivity.

• Confirm the primary siteinstallation

continue serving writes. Exclude
1. Prepare a networkworking partitionreplacement oreEKAS isolatedinstallation management-pathand failure.S3 service, worker connectivity and staging disk.
2. RecordChoose the last known replication state and business approval for theImport recovery action.
bundle;
3. Verify the destination cluster, storage, gateways, endpoint and capacity are healthy.
4. Use the approved promotion control for the local secondary site. If the GUI does not present a promotion control, stop and update to a software release that provides the approved workflow or contact euroNAS support; do not improvise a second write site.
5. Redirect application DNS or load-balancer traffic only after the promoted endpoint is confirmed writable.
6. Before returning service toprovide the original site,archive followidentifier, encrypted bundle smaller than 16 MB and password.
7. The imported configuration is recovery-only with export disabled. Verify archive connection details and keep export disabled during recovery.
8. Preview and restore the checkpoint, recover reviewed bucket settings, validate namespace/permissions and cut over clients.

The bundle is not a standalone generic-server restore application. Slow/offline media may require long recall waits; obtain and role-reversaltest procedure.the Neverprovider’s permit uncontrolled writes at both sites in disasterphysical-media recovery mode.

SMB

The