Hybrid DaaS clusters by MariekeGO · Pull Request #6385 · SkylineCommunications/dataminer-docs

MariekeGO · 2026-06-09T11:14:44Z

No description provided.

MariekeGO · 2026-06-09T11:15:46Z

+
+A hybrid DataMiner cluster combines nodes using a DataMiner as a Service (DaaS) deployment with self-managed nodes. This creates one clustered DataMiner System (DMS) that can span both cloud and on-premises infrastructure. Between the DaaS nodes and the self-managed nodes, a site-to-site VPN connection is set up.
+
+<!-- ![Schematic overview of a hybrid setup](~/dataminer/images/Hybrid.svg) -->


@EdithLansens, could you create an image for this page in the same style as the images here: https://docs.dataminer.services/dataminer/About_DataMiner/Deployment_models/Overview_hosting.html?

MariekeGO

@wobog, I've created this pull request to add the info about hybrid DaaS systems from internaldocs here. Could you take a look at my comments and also verify if I got everything right? It wasn't always as clear whether something should be done by Skyline or not, so I may still need to adjust some things in that respect.

MariekeGO · 2026-06-09T11:16:40Z

+  - Using DataMiner 10.5.0 [CU2]/10.5.5 or higher.
+
+- One or more on-premises servers ready to host DataMiner Agents (see [DataMiner Compute Requirements](xref:DataMiner_Compute_Requirements)).
+- An established site-to-site VPN connection between DaaS and the on-premises network (see [About the site-to-site VPN connection](xref:Connecting_to_private_data_sources#about-the-site-to-site-vpn-connection)).


I've added a reference to the VPN connection setup to connect Daas nodes to private data sources here. Is this indeed the same for end users?

Whether you are connecting DaaS to private data sources or connecting to an on-prem cluster, you will indeed need the same site-to-site connection. In the case of a hybrid cluster the same connection will most likely be used for both purposes.

MariekeGO · 2026-06-09T11:17:10Z

+
+1. Make sure self-signed certificates are trusted between DaaS and self-managed nodes. Your DaaS nodes must trust the certificate from the self-managed nodes and vice versa.
+
+   To export the certificate, run the following PowerShell commands:


Is this on the DaaS nodes? Will external users be able to do this or should we tell them to contact daas@dataminer.services for this?

This should be done on both the DaaS nodes and on-prem nodes. So they will need to contact daas@dataminer.services as well. They will have to share their exported certificates and vice-versa.

MariekeGO · 2026-06-09T11:17:23Z

+   $import | Import-Certificate -CertStoreLocation Cert:\LocalMachine\Root
+   ```
+
+1. Add the connection string URI of the other machine. See [Editing the connection string between two DataMiner Agents](xref:SLNetClientTest_editing_connection_string).


What do you mean with "the other machine"? Do you mean that you need to add the connection string of the DaaS node to the on-premises node?

This would need to be done on both DaaS and on-prem.
On the on-prem you should specify how to connect to the DaaS agent.
And on the DaaS agent we (DaaS team) should specify how to connect to the on-prem agent.
Will maybe elaborate on this together with comment on line R46.

MariekeGO · 2026-06-09T11:17:42Z

+### Network address space
+
+The DaaS network uses **address space 172.23.0.0/16** by default. If your on-premises network overlaps with this range, you will need to contact Skyline to change the DaaS address space before or after deployment, depending on the approach you use.


I'm not entirely sure if this is relevant enough for external users, as changing the address space will be something done by Skyline (if I understood everything correctly). Perhaps we should remove this here to avoid undue concern?

The DaaS team will indeed need to make these changes.
It is mentioned in the prerequisites.
I guess it makes sense to omit it here when providing a global overview.

wobog

After reviewing I realise we will need to double check some things, so I will do that (see comments). Will then make appropriate changes and review again.

wobog · 2026-06-09T11:56:26Z

+  - Using DataMiner 10.5.0 [CU2]/10.5.5 or higher.
+
+- One or more on-premises servers ready to host DataMiner Agents (see [DataMiner Compute Requirements](xref:DataMiner_Compute_Requirements)).
+- An established site-to-site VPN connection between DaaS and the on-premises network (see [About the site-to-site VPN connection](xref:Connecting_to_private_data_sources#about-the-site-to-site-vpn-connection)).


Whether you are connecting DaaS to private data sources or connecting to an on-prem cluster, you will indeed need the same site-to-site connection. In the case of a hybrid cluster the same connection will most likely be used for both purposes.

wobog · 2026-06-09T12:03:03Z

+  - Deployed in a region close to where your self-managed nodes are deployed to minimize latency.
+  - Using DataMiner 10.5.0 [CU2]/10.5.5 or higher.
+
+- One or more on-premises servers ready to host DataMiner Agents (see [DataMiner Compute Requirements](xref:DataMiner_Compute_Requirements)).


Can we add maybe more clearly that these should not contain DataMiner already? It is somewhat implied by the first step in the procedure, but just to be on the safe side.

wobog · 2026-06-09T12:05:31Z

+### Network address space
+
+The DaaS network uses **address space 172.23.0.0/16** by default. If your on-premises network overlaps with this range, you will need to contact Skyline to change the DaaS address space before or after deployment, depending on the approach you use.


The DaaS team will indeed need to make these changes.
It is mentioned in the prerequisites.
I guess it makes sense to omit it here when providing a global overview.

wobog · 2026-06-09T12:10:25Z

+
+1. Make sure self-signed certificates are trusted between DaaS and self-managed nodes. Your DaaS nodes must trust the certificate from the self-managed nodes and vice versa.
+
+   To export the certificate, run the following PowerShell commands:


This should be done on both the DaaS nodes and on-prem nodes. So they will need to contact daas@dataminer.services as well. They will have to share their exported certificates and vice-versa.

wobog · 2026-06-09T12:14:12Z

+
+1. [Enable Swarming](xref:EnableSwarming) on the new Agents.
+
+1. In DataMiner, create a new user account `DataMinerAdmin` with the password defined on the DaaS nodes, and give it administrator permissions.


This is a tricky one. In practice we cannot share these details with the customer. The internal guide was written on the premises that we have full control.
Allow me to find another approach for this first before we make this public.

wobog · 2026-06-09T12:18:02Z

+   $import | Import-Certificate -CertStoreLocation Cert:\LocalMachine\Root
+   ```
+
+1. Add the connection string URI of the other machine. See [Editing the connection string between two DataMiner Agents](xref:SLNetClientTest_editing_connection_string).


This would need to be done on both DaaS and on-prem.
On the on-prem you should specify how to connect to the DaaS agent.
And on the DaaS agent we (DaaS team) should specify how to connect to the on-prem agent.
Will maybe elaborate on this together with comment on line R46.

wobog · 2026-06-09T12:19:47Z

+
+## Prerequisites
+
+- A cluster consisting of one or more self-managed DataMiner nodes using [Storage as a Service](xref:STaaS).


The cluster already has to be cloud connected and using STaaS

wobog · 2026-06-09T12:23:41Z

+
+## Step-by-step procedure
+
+1. [Create the DaaS nodes](xref:Creating_a_DMS_on_dataminer_services) you want to add to the cluster.


This is not correct. Once you have an on-prem cluster, the customer cannot create a new DaaS system to add to it.
This step can only be done by Skyline (DaaS team).

wobog · 2026-06-09T12:24:14Z

+
+1. Make sure [Swarming is enabled](xref:EnableSwarming) in the self-managed cluster.
+
+1. In your existing cluster, create a user account `DataMinerAdmin` with the password defined for the Admin account of the DaaS nodes, and give it administrator permissions.


Same remark as before, will check how to properly handle this.

Hybrid DaaS clusters

8c81506

MariekeGO commented Jun 9, 2026

View reviewed changes

MariekeGO self-assigned this Jun 9, 2026

MariekeGO requested a review from wobog June 9, 2026 11:22

wobog suggested changes Jun 9, 2026

View reviewed changes

image

edbac61


		A hybrid DataMiner cluster combines nodes using a DataMiner as a Service (DaaS) deployment with self-managed nodes. This creates one clustered DataMiner System (DMS) that can span both cloud and on-premises infrastructure. Between the DaaS nodes and the self-managed nodes, a site-to-site VPN connection is set up.

		<!-- ![Schematic overview of a hybrid setup](~/dataminer/images/Hybrid.svg) -->


		1. Make sure self-signed certificates are trusted between DaaS and self-managed nodes. Your DaaS nodes must trust the certificate from the self-managed nodes and vice versa.

		To export the certificate, run the following PowerShell commands:

		### Network address space

		The DaaS network uses address space 172.23.0.0/16 by default. If your on-premises network overlaps with this range, you will need to contact Skyline to change the DaaS address space before or after deployment, depending on the approach you use.


		1. [Enable Swarming](xref:EnableSwarming) on the new Agents.

		1. In DataMiner, create a new user account `DataMinerAdmin` with the password defined on the DaaS nodes, and give it administrator permissions.


		## Prerequisites

		- A cluster consisting of one or more self-managed DataMiner nodes using [Storage as a Service](xref:STaaS).


		## Step-by-step procedure

		1. [Create the DaaS nodes](xref:Creating_a_DMS_on_dataminer_services) you want to add to the cluster.


		1. Make sure [Swarming is enabled](xref:EnableSwarming) in the self-managed cluster.

		1. In your existing cluster, create a user account `DataMinerAdmin` with the password defined for the Admin account of the DaaS nodes, and give it administrator permissions.

Uh oh!

Conversation

MariekeGO commented Jun 9, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

MariekeGO left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wobog left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants