Search the docs

Enable or Disable TLS

Enabling or disabling TLS from the CLI carries the same disruption and client remount requirements as doing so from the GUI. See Workflow Overview before running either command.

TLS is enabled and disabled cluster-wide using the cluster-config command.

To enable TLS and require mutual authentication on all NFS connections:

cluster-config --nfs-tls-required

To disable TLS and revert all NFS connections to plaintext:

cluster-config --nfs-tls-forbidden

Both commands start a background task named cluster-update and, by default, wait up to 5 minutes for it to finish:

  • If the task finishes within 5 minutes, the command prints the cluster configuration.

  • If the task is still running after 5 minutes, the command exits with the error cluster-config: Task-based operation still running after 5 minutes. To monitor progress, use: task-list --id <task-id>. The task keeps running.

  • If the task fails, stops, or is cancelled, the command prints Task failed. followed by the task’s details.

To make the command wait for the task however long it takes, add --no-timeout:

cluster-config --nfs-tls-required --no-timeout

To follow a task that is still running, run task-list --id <task-id>, or task-list --name cluster-update to list the cluster update tasks. The change is complete when the task’s status is COMPLETED and its status message is Updated: [nfsTransportPolicy -> TLS_REQUIRED_WITH_MUTUAL_AUTH] (or Updated: [nfsTransportPolicy -> TLS_FORBIDDEN]).

A policy change can take a few minutes or more than 30 minutes. Hammerspace configures the Anvil and DSX nodes one at a time, and on each DSX node it restarts the node’s internal mounts of the Hammerspace file system (the mounts that its NFS, SMB, and S3 data services use) one after another. A mount that is slow to come back is retried for up to 10 minutes. In testing, enabling TLS took from about 2½ minutes to about 35 minutes on clusters with one or two DSX nodes.

While the change runs, the task’s status message shows its progress, for example Updating NFS transport policy: Configuring metadata server, Updating NFS transport policy: Restarting metadata server, and Updating NFS transport policy: Configuring product nodes. Hammerspace makes up to three attempts to configure any node that fails before the task fails.

To return immediately without waiting, add --async, and monitor the task separately:

cluster-config --nfs-tls-required --async

The command returns at once with Process started. To monitor progress, use: task-list --id <task-id>.

To check the current TLS policy, run cluster-config --view (or cluster-config with no options) and find the NFS transport policy line:

cluster-config --view

The line reads TLS required with mutual auth when TLS is enabled and TLS forbidden when it is disabled. While a policy change is still running, the line still shows the previous policy; it changes only after the cluster-update task completes.

The cluster-config command also includes options for managing the management plane HTTPS certificate used by the GUI and REST API (--server-certificate-chain, --server-private-key, --server-certificate-reset). These options are unrelated to NFS over TLS and are not covered in this document. Run them separately: cluster-config does not accept them in the same command as --nfs-tls-required or --nfs-tls-forbidden.