Container Service for Kubernetes:Mount a statically provisioned OSS volume

Step 1: Create a RAM role

This step is required if this is the first time you enable RRSA for your cluster. Skip this step if you have previously used RRSA authentication to mount OSS volumes in the cluster.

1. Log on to the ACK console and enable RRSA. For more information, see Enable RRSA.

2. Create a RAM role for mounting OSS volumes by using RRSA authentication. The RAM role is assumed by your cluster when it uses RRSA to mount OSS volumes.

   When you create the RAM role, select IdP for the Select Trusted Entity parameter. In the following example, a RAM role named demo-role-for-rrsa is created.

   1. Log on to the RAM console with your Alibaba Cloud account.

   2. In the left-side navigation pane, choose Identities > Roles. On the Roles page, click Create Role.

   3. In the Create Role panel, select IdP for Select Trusted Entity and click Next.

   4. On the Configure Role wizard page, set the following parameters and click OK.

      The following table describes the parameters.

      Parameter	Description
      RAM Role Name	Set the value to demo-role-for-rrsa.
      Note	Enter the description of the RAM role. This parameter is optional.
      IdP Type	Select OIDC.
      Select IdP	Select an identity provider (IdP). The IdP is named in the ack-rrsa-<cluster_id> format. <cluster_id> indicates the ID of your cluster.
      Conditions	oidc:iss: Use the default value. oidc:aud: Select sts.aliyuncs.com. oidc:sub: Select StringEquals and enter system:serviceaccount:ack-csi-fuse:csi-fuse-ossfs.

Step 2: Grant permissions to the demo-role-for-rrsa role

1. Create a custom policy to grant OSS access permissions to the RAM user. For more information, see Create custom policies.

   Select the read-only policy or read-write policy based on your business requirements. Replace mybucket with the name of the bucket you created.

   • Policy that provides read-only permissions on OSS

     Click to view policy content

     {
         "Statement": [
             {
                 "Action": [
                     "oss:Get*",
                     "oss:List*"
                 ],
                 "Effect": "Allow",
                 "Resource": [
                     "acs:oss:*:*:mybucket",
                     "acs:oss:*:*:mybucket/*"
                 ],
             }
         ],
         "Version": "1"
     }

   • Policy that provides read-write permissions on OSS

     Click to view policy content

     {
         "Statement": [
             {
                 "Action": "oss:*",
                 "Effect": "Allow",
                 "Resource": [
                     "acs:oss:*:*:mybucket",
                     "acs:oss:*:*:mybucket/*"
                 ],
             }
         ],
         "Version": "1"
     }

2. Optional. If the objects in the OSS bucket are encrypted by using a specified customer master key (CMK) in Key Management Service (KMS), you need to grant KMS access permissions to the RAM user. For more information, see Encrypt an OSS volume.

3. Grant the required permissions to the demo-role-for-rrsa role. For more information, see Grant permissions to a RAM role.

   Note

   If you want to use an existing RAM role that has OSS access permissions, you can modify the trust policy of the RAM role. For more information, see Use an existing RAM role and grant the required permissions to the RAM role.

Step 3: Create a PV and a PVC

1. Create a PV that uses RRSA authentication.

   1. Create a file named pv-rrsa.yaml. In this file, RRSA authentication is enabled.

      apiVersion: v1
      kind: PersistentVolume
      metadata:
        name: pv-oss
        labels:    
          alicloud-pvname: pv-oss
      spec:
        capacity:
          storage: 5Gi
        accessModes:
          - ReadOnlyMany
        persistentVolumeReclaimPolicy: Retain
        csi:
          driver: ossplugin.csi.alibabacloud.com
          volumeHandle: pv-oss # Specify the name of the PV. 
          volumeAttributes:
            bucket: "oss" # Replace the value with the name of the OSS bucket you created. 
            path: /
            url: "oss-cn-hangzhou.aliyuncs.com"
            otherOpts: "-o umask=022 -o max_stat_cache_size=0 -o allow_other"
            authType: "rrsa"
            roleName: "demo-role-for-rrsa"

      Parameter	Description
      name	The name of the PV.
      labels	The labels that are added to the PV.
      storage	The available storage of the OSS bucket.
      accessModes	The access mode. Valid values: ReadOnlyMany and ReadWriteMany. If you select ReadOnlyMany, ossfs mounts the OSS bucket in read-only mode.
      persistentVolumeReclaimPolicy	The reclaim policy of the PV. OSS volumes support only the Retain policy, which indicates that the PV and data in the bucket are not deleted when you delete the PVC.
      driver	The type of volume driver. In this example, the value is set to ossplugin.csi.alibabacloud.com. This indicates that the OSS CSI plug-in provided by Alibaba Cloud is used.
      volumeHandle	The name of the PV.
      bucket	The OSS bucket that you want to mount.
      path	The path relative to the root directory of the OSS bucket to be mounted. The default value is /. This parameter is supported by CSI 1.14.8.32-c77e277b-aliyun and later. If you use an ossfs version earlier than 1.91, you must create the path in the OSS bucket in advance. For more information, see Features of ossfs 1.91 and later and ossfs performance benchmarking.
      url	The endpoint of the OSS bucket you want to mount. You can retrieve the endpoint from the Overview page of the bucket in the OSS console. If the bucket is mounted to a node in the same region as the bucket or the bucket can be connected to the node through a virtual private cloud (VPC), use the internal endpoint of the bucket. If the bucket is mounted to a node in a different region, use the public endpoint of the bucket. Public endpoints and internal endpoints have different formats: Format of internal endpoints: http://oss-{{regionName}}-internal.aliyuncs.com or https://oss-{{regionName}}-internal.aliyuncs.com. Format of public endpoints: http://oss-{{regionName}}.aliyuncs.com or https://oss-{{regionName}}.aliyuncs.com. Important The vpc100-oss-{{regionName}}.aliyuncs.com format for internal endpoints is deprecated.
      otherOpts	You can configure custom parameters in the -o *** -o *** format for the OSS volume. Example: -o umask=022 -o max_stat_cache_size=0 -o allow_other. umask: modifies the permission mask of files in ossfs. For example, if you specify umask=022, the permission mask of files in ossfs changes to 755. By default, the permission mask of files uploaded by using the OSS SDK or the OSS console is 640 in ossfs. Therefore, we recommend that you specify the umask parameter if you want to split reads and writes. max_stat_cache_size: The maximum number of files whose metadata can be cached in the metadata cache. Metadata caching can accelerate List operations. However, if you modify files by using methods other than ossfs, such as the OSS console, OSS SDK, or ossutil, the metadata of the files may not be updated in real time. allow_other: allows other users to access the mounted directory. However, these users cannot access the files in the directory. For more information, see Options supported by ossfs.
      authType	The authentication method. Set this parameter to rrsa, which indicates that RRSA authentication is used.
      roleName	Set the value to the name of the RAM role you created or modified in Step 1: Create a RAM role. If you need to configure different permissions for different PVs, you can create multiple RAM roles and specify the RAM roles in the roleName parameter.

      Note

      For more information about how to use specified Alibaba Cloud Resource Names (ARNs) or ServiceAccounts in RRSA authentication, see How do I use the specified ARNs or ServiceAccount in RRSA authentication?

   2. Run the following command to create a PV that uses RRSA authentication:

      kubectl create -f pv-rrsa.yaml

2. Run the following command to create a PVC:

   kubectl create -f pvc-oss.yaml

   The following pvc-oss.yaml file is used to create the PVC:

   apiVersion: v1
   kind: PersistentVolumeClaim
   metadata:
     name: pvc-oss
   spec:
     accessModes:
       - ReadOnlyMany
     resources:
       requests:
         storage: 5Gi
     selector:
       matchLabels:
         alicloud-pvname: pv-oss

   Parameter	Description
   name	The name of the PVC.
   accessModes	The access mode. Valid values: ReadOnlyMany and ReadWriteMany. If you select ReadOnlyMany, ossfs mounts the OSS bucket in read-only mode.
   storage	The capacity claimed by the PVC. The claimed capacity cannot exceed the capacity of the PV that is bound to the PVC.
   alicloud-pvname	The labels that are used to select and bind a PV to the PVC. The labels must be the same as those of the PV to be bound to the PVC.

   In the left-side navigation pane, choose Volumes > Persistent Volume Claims. On the Persistent Volume Claims page, you can find the created PVC.

Step 1: Create a RAM user that has OSS access permissions and obtain the AccessKey pair of the RAM user

Create a RAM user that has OSS access permissions and obtain the AccessKey pair of the RAM user. Then, grant the RAM user the permissions to access the OSS bucket you created.

1. Create a RAM user. You can skip this step if you have an existing RAM user. For more information about how to create a RAM user, see Create a RAM user.

2. Create a custom policy to grant OSS access permissions to the RAM user. For more information, see Create custom policies.

   Select the read-only policy or read-write policy based on your business requirements. Replace mybucket with the name of the bucket you created.

   • Policy that provides read-only permissions on OSS

     Click to view policy content

     {
         "Statement": [
             {
                 "Action": [
                     "oss:Get*",
                     "oss:List*"
                 ],
                 "Effect": "Allow",
                 "Resource": [
                     "acs:oss:*:*:mybucket",
                     "acs:oss:*:*:mybucket/*"
                 ],
             }
         ],
         "Version": "1"
     }

   • Policy that provides read-write permissions on OSS

     Click to view policy content

     {
         "Statement": [
             {
                 "Action": "oss:*",
                 "Effect": "Allow",
                 "Resource": [
                     "acs:oss:*:*:mybucket",
                     "acs:oss:*:*:mybucket/*"
                 ],
             }
         ],
         "Version": "1"
     }

3. Optional. If the objects in the OSS bucket are encrypted by using a specified customer master key (CMK) in Key Management Service (KMS), you need to grant KMS access permissions to the RAM user. For more information, see Encrypt an OSS volume.

4. Grant OSS access permissions to the RAM user. For more information, see Grant permissions to a RAM user.

5. Create an AccessKey pair for the RAM user. For more information, see Create an AccessKey pair.

Step 2: Create a PV and a PVC and use the PV and PVC to mount the OSS bucket to an application

You can create a PV and a PVC, and then use the PV and PVC to mount the OSS bucket to an application in the ACK console or by using kubectl.

kubectl create -f oss-static.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: oss-static
  labels:
    app: nginx
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: anolis-registry.cn-zhangjiakou.cr.aliyuncs.com/openanolis/nginx:1.14.1-8.6
        ports:
        - containerPort: 80
        volumeMounts:
          - name: pvc-oss
            mountPath: "/data"
          - name: pvc-oss
            mountPath: "/data1"
        livenessProbe:
          exec:
            command:
            - sh
            - -c
            - cd /data
          initialDelaySeconds: 30
          periodSeconds: 30
      volumes:
        - name: pvc-oss
          persistentVolumeClaim:
            claimName: pvc-oss