Container Service for Kubernetes:Manage the lifecycle of OSS buckets

Step 1: Create the CNFS CRD and StorageClass

Create the Secret, ContainerNetworkFileSystem CRD, and StorageClass. Replace <clusterid> with your cluster ID.

cat << EOF | kubectl apply -f -
apiVersion: v1
kind: Secret
metadata:
  name: oss-secret
stringData:
  akId: "xxxx"      # AccessKey ID for mounting the OSS bucket
  akSecret: "xxxx"  # AccessKey Secret for mounting the OSS bucket
---
apiVersion: storage.alibabacloud.com/v1beta1
kind: ContainerNetworkFileSystem
metadata:
  name: cnfs-oss-<clusterid>   # Set the CNFS CRD name to match the bucket name
spec:
  description: "cnfs-oss"
  type: oss
  reclaimPolicy: Retain         # Only Retain is supported. Deleting the CRD keeps the bucket.
  parameters:
    bucketName: cnfs-oss-<clusterid>   # Replace <clusterid> with your cluster ID; bucket name must be unique
    encryptType: "AES256"              # AES-256 server-side encryption
    storageType: "Standard"            # Storage class
    aclType: "private"                 # Bucket owner and authorized users only
---
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: alibabacloud-cnfs-oss
parameters:
  containerNetworkFileSystem: cnfs-oss-<clusterid>           # Reference to the CNFS CRD
  otherOpts: -o max_stat_cache_size=0 -o allow_other         # Cache settings
  path: /
  # volumeAs: subpath   # Uncomment to auto-create a subpath for each PV
  csi.storage.k8s.io/node-publish-secret-name: oss-secret
  csi.storage.k8s.io/node-publish-secret-namespace: default
provisioner: ossplugin.csi.alibabacloud.com
reclaimPolicy: Retain
EOF

The following table describes the CNFS CRD parameters.

Step 2: Create a PVC and sample workloads

Create a persistent volume claim (PVC), a Deployment, and a StatefulSet to verify the bucket mounts correctly.

cat << EOF | kubectl apply -f -
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: cnfs-oss-pvc
spec:
  accessModes:
    - ReadOnlyMany
  storageClassName: alibabacloud-cnfs-oss
  resources:
    requests:
      storage: 100Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: cnfs-oss-deployment
  labels:
    app: nginx
spec:
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx
        volumeMounts:
        - mountPath: "/data"
          name: cnfs-oss-pvc
      volumes:
      - name: cnfs-oss-pvc
        persistentVolumeClaim:
          claimName: cnfs-oss-pvc
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: cnfs-oss-sts
  labels:
    app: nginx
spec:
  serviceName: "nginx"
  replicas: 2
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx
        volumeMounts:
        - mountPath: "/data"
          name: www
  volumeClaimTemplates:
  - metadata:
      name: www
    spec:
      accessModes: [ "ReadOnlyMany" ]
      storageClassName: "alibabacloud-cnfs-oss"
      resources:
        requests:
          storage: 100Gi
EOF

Step 3: Verify the bucket and workloads

Run the following commands to confirm the OSS bucket and pods are ready.

Verify the CNFS CRD:

kubectl get cnfs/cnfs-oss-<clusterid> -o yaml

Expected output:

apiVersion: storage.alibabacloud.com/v1beta1
kind: ContainerNetworkFileSystem
...
status:
  conditions:
  - lastProbeTime: "2022-09-18 15:02:39"
    reason: The oss bucket is complete initialization.
    status: Ready
  fsAttributes:
    accessGroupName: DEFAULT_VPC_GROUP_NAME
    aclType: private
    bucketName: cnfs-oss-****
    encryptType: AES256
    endPoint:
      extranet: oss-****.aliyuncs.com
      internal: oss-****-internal.aliyuncs.com
    regionId: ****
    storageType: Standard
  status: Available

The status.status field shows Available when the bucket is ready. The following table describes the status fields.

Verify the pods:

kubectl get pod

Expected output:

NAME                                   READY   STATUS    RESTARTS   AGE
cnfs-oss-deployment-5864fd8d98-4****   1/1     Running   0          2m21s
cnfs-oss-sts-0                         1/1     Running   0          2m21s
cnfs-oss-sts-1                         1/1     Running   0          2m16s

All pods show Running, confirming the Deployment and StatefulSet have successfully mounted the OSS bucket.

Step 1: Create the CNFS CRD

cat <<EOF | kubectl apply -f -
apiVersion: storage.alibabacloud.com/v1beta1
kind: ContainerNetworkFileSystem
metadata:
  name: cnfs-oss-exist-bucket-name
spec:
  description: "cnfs-oss"
  type: oss
  reclaimPolicy: Retain
  parameters:
    bucketName: bucket-name   # Name of your existing OSS bucket
EOF

Step 2: Verify the CNFS CRD

kubectl get cnfs/cnfs-oss-exist-bucket-name -o yaml

Expected output:

apiVersion: storage.alibabacloud.com/v1beta1
kind: ContainerNetworkFileSystem
...
status:
  conditions:
  - lastProbeTime: "2022-09-14 17:00:21"
    reason: The oss bucket is complete initialization.
    status: Ready
  fsAttributes:
    accessGroupName: DEFAULT_VPC_GROUP_NAME
    aclType: private
    bucketName: exist-bucket-name
    encryptType: AES256
    endPoint:
      extranet: oss-****.aliyuncs.com
      internal: oss-****-internal.aliyuncs.com
    regionId: ****
    storageType: Standard
  status: Available

Step 3: Mount the bucket to a workload

Mount the OSS bucket to your Deployment as a statically or dynamically provisioned volume. Follow the same steps as Step 2: Create a PVC and sample workloads in Method 1, referencing the CNFS CRD created in this method.