Container Service for Kubernetes:Mount an OSS Bucket by using an ossfs 1.0 dynamically provisioned volume

1. Enable RRSA in your cluster

1. On the ACK Clusters page, find the cluster and click its name. In the left-side pane, click Cluster Information.

2. On the Basic Information tab, find the Security and Auditing section. Click Enable next to RRSA OIDC. Follow the on-screen prompts to complete enablement during off-peak hours. Wait for the cluster status to change from Updating to Running.

   Important

   After enabling RRSA, the maximum validity period for new ServiceAccount tokens in the cluster is 12 hours.

If you previously used RRSA with a CSI version earlier than v1.30.4, add the RAM role authorization configurations described in \[Product Change\] CSI ossfs version upgrade and mount process optimization.

2. Create a RAM role

Create a RAM role that Pods can assume to access the OSS bucket.

1. Go to the Create Role page. Select Identity Provider as the Principal Type, then click Switch to Policy Editor.

2. Select Identity Provider as the Principal and click Edit. Configure the settings below. Leave other parameters at their default values. For details, see Create a RAM role for an OIDC IdP. To use a different ServiceAccount or ARN, see How do I use specified ARNs or ServiceAccounts with RRSA authentication?

   Parameter	Value
   Identity Provider Type	OIDC
   Identity Provider	ack-rrsa-<cluster_id> — replace <cluster_id> with your cluster ID
   Condition — Key	oidc:sub
   Condition — Operator	StringEquals
   Condition — Value	system:serviceaccount:ack-csi-fuse:csi-fuse-ossfs (ack-csi-fuse is the fixed namespace for the ossfs client; csi-fuse-ossfs is the ServiceAccount name)
   Role Name	demo-role-for-rrsa (example name)

3. Create an access policy

Following the least privilege principle, create a custom policy that grants the minimum required access to the target OSS bucket.

1. Go to the Create Policy page. Switch to the JSON tab and enter one of the policy scripts below. Replace <myBucketName> with your actual bucket name. Read-only access:

   OSS read-only policy

   Replace <myBucketName> with your actual bucket name.

   {
       "Statement": [
           {
               "Action": [
                   "oss:Get*",
                   "oss:List*"
               ],
               "Effect": "Allow",
               "Resource": [
                   "acs:oss:*:*:<myBucketName>",
                   "acs:oss:*:*:<myBucketName>/*"
               ]
           }
       ],
       "Version": "1"
   }

   OSS read/write policy

   Replace <myBucketName> with your actual bucket name.

   {
       "Statement": [
           {
               "Action": "oss:*",
               "Effect": "Allow",
               "Resource": [
                   "acs:oss:*:*:<myBucketName>",
                   "acs:oss:*:*:<myBucketName>/*"
               ]
           }
       ],
       "Version": "1"
   }

2. (Optional) If OSS objects are encrypted with a customer master key (CMK) managed by Key Management Service (KMS), also grant KMS permissions to the role. See Use a specified CMK ID managed by KMS for encryption.

To reuse an existing RAM role that already has OSS permissions, modify its trust policy instead. See Pod permission isolation based on RRSA.

4. Attach the policy to the RAM role

1. Go to the Roles page. In the Actions column for the target role, click Grant Permissions.

2. In the Policy section, search for and select the policy you created, then confirm.

1. Create a RAM user and AccessKey

1. Go to the Create User page. Follow the prompts to create a RAM user. Skip this step if you already have one.

2. Go to the Create Policy page. Switch to the JSON tab and enter one of the policy scripts below. Replace <myBucketName> with your actual bucket name. Read-only access:

   OSS read-only policy

   Replace <myBucketName> with the actual bucket name.

   {
       "Statement": [
           {
               "Action": [
                   "oss:Get*",
                   "oss:List*"
               ],
               "Effect": "Allow",
               "Resource": [
                   "acs:oss:*:*:<myBucketName>",
                   "acs:oss:*:*:<myBucketName>/*"
               ]
           }
       ],
       "Version": "1"
   }

   OSS read/write policy

   Replace <myBucketName> with the actual bucket name.

   {
       "Statement": [
           {
               "Action": "oss:*",
               "Effect": "Allow",
               "Resource": [
                   "acs:oss:*:*:<myBucketName>",
                   "acs:oss:*:*:<myBucketName>/*"
               ]
           }
       ],
       "Version": "1"
   }

   If you plan to create a PV from the ACK console, also add oss:ListBuckets on all resources:

   {
     "Effect": "Allow",
     "Action": "oss:ListBuckets",
     "Resource": "*"
   }

3. (Optional) If OSS objects are encrypted with a CMK managed by KMS, also grant KMS permissions. See Use a specified CMK ID managed by KMS for encryption.

4. Go to the Users page. In the Actions column for the target user, click Add Permissions. Search for and select the policy you created.

5. On the Users page, click the target user. In the AccessKey section, click Create AccessKey. Follow the prompts and save the AccessKey ID and AccessKey secret securely.