Describe the solution you'd like
It could be useful to have a per-volume annotation for en- or disabling the autonomous Anti Ransomware Protection in NetApp, as it could be useful or mandatory for some Kubernetes workloards, while at the same time being unsuited for others [0]. Right now, no such annotation exists [1] and I think the ONTAP-API does not expose such an endpoint itself (see Anti Ransomware [2] and Volume [3] endpoints).
Describe alternatives you've considered
An individual selection for volumes with and without ARP enabled could be solved by creating a second SVM and have it globally enabled on one of them but not the other. Then an additional StorageClass could be used to select between the two.
The drawback however is, that switching it on and off later on won't be possible without migrating the volume or contacting the NetApp admins.
Additional context
Toggling the ARP for individual volumes in ONTAP is possible [4], but not exposed via API and thereby also not via Trident-Operator (if this requests therefore belongs to another place, please let me know). Therefore every individual switch, for example because it wasn't yet known the workload is unsuitable for ARP, requires help of someone with access to the ONTAP backend, which I think kinda defeats the purpose of this operator.
Let me know what you think, and whether I forgot something in my considerations (I'm a Trident-Operator user, not an ONTAP admin 😉).
[0] https://docs.netapp.com/us-en/ontap/anti-ransomware/use-cases-restrictions-concept.html
[1] https://docs.netapp.com/us-en/trident/trident-reference/objects.html#kubernetes-persistentvolumeclaim-objects
[2] https://docs.netapp.com/us-en/ontap-restapi/security_anti-ransomware_endpoint_overview.html#retrieving-the-anti-ransomware-package-version-of-all-nodes-in-the-cluster
[3] https://docs.netapp.com/us-en/ontap-restapi/storage_volumes_endpoint_overview.html
[4] https://docs.netapp.com/us-en/ontap/anti-ransomware/enable-task.html
Describe the solution you'd like
It could be useful to have a per-volume annotation for en- or disabling the autonomous Anti Ransomware Protection in NetApp, as it could be useful or mandatory for some Kubernetes workloards, while at the same time being unsuited for others [0]. Right now, no such annotation exists [1] and I think the ONTAP-API does not expose such an endpoint itself (see Anti Ransomware [2] and Volume [3] endpoints).
Describe alternatives you've considered
An individual selection for volumes with and without ARP enabled could be solved by creating a second SVM and have it globally enabled on one of them but not the other. Then an additional StorageClass could be used to select between the two.
The drawback however is, that switching it on and off later on won't be possible without migrating the volume or contacting the NetApp admins.
Additional context
Toggling the ARP for individual volumes in ONTAP is possible [4], but not exposed via API and thereby also not via Trident-Operator (if this requests therefore belongs to another place, please let me know). Therefore every individual switch, for example because it wasn't yet known the workload is unsuitable for ARP, requires help of someone with access to the ONTAP backend, which I think kinda defeats the purpose of this operator.
Let me know what you think, and whether I forgot something in my considerations (I'm a Trident-Operator user, not an ONTAP admin 😉).
[0] https://docs.netapp.com/us-en/ontap/anti-ransomware/use-cases-restrictions-concept.html
[1] https://docs.netapp.com/us-en/trident/trident-reference/objects.html#kubernetes-persistentvolumeclaim-objects
[2] https://docs.netapp.com/us-en/ontap-restapi/security_anti-ransomware_endpoint_overview.html#retrieving-the-anti-ransomware-package-version-of-all-nodes-in-the-cluster
[3] https://docs.netapp.com/us-en/ontap-restapi/storage_volumes_endpoint_overview.html
[4] https://docs.netapp.com/us-en/ontap/anti-ransomware/enable-task.html