Container Service for Kubernetes:Use the CSI plug-in

Use onectl

1. Install onectl on your on-premises machine. For more information, see Use onectl to manage registered clusters.

2. onectl uses the AccessKey pair of a Resource Access Management (RAM) user to access Alibaba Cloud resources. Run the following command to grant the RAM user the permissions to manage the CSI component:

   onectl ram-user grant --addon csi-plugin

   Expected output:

   Ram policy ack-one-registered-cluster-policy-csi-plugin granted to ram user ack-one-user-ce313528c3 successfully.

Use the console

Before you install the CSI plug-in in a registered external cluster, you must set an AccessKey pair in the cluster to access related cloud resources. Before you set the AccessKey pair, create a RAM user and grant the RAM user the permissions to access Alibaba Cloud resources.

1. Create a RAM user.

2. Create a custom policy. The following sample custom policy grants the permissions to manage disks, snapshots, snapshot policies, resource labels, instances, file systems, and repositories.

   Show sample code

   {
       "Version": "1",
       "Statement": [
           {
               "Action": [
                   "ecs:AttachDisk",
                   "ecs:DetachDisk",
                   "ecs:DescribeDisks",
                   "ecs:CreateDisk",
                   "ecs:ResizeDisk",
                   "ecs:CreateSnapshot",
                   "ecs:DeleteSnapshot",
                   "ecs:CreateAutoSnapshotPolicy",
                   "ecs:ApplyAutoSnapshotPolicy",
                   "ecs:CancelAutoSnapshotPolicy",
                   "ecs:DeleteAutoSnapshotPolicy",
                   "ecs:DescribeAutoSnapshotPolicyEX",
                   "ecs:ModifyAutoSnapshotPolicyEx",
                   "ecs:AddTags",
                   "ecs:DescribeTags",
                   "ecs:DescribeSnapshots",
                   "ecs:ListTagResources",
                   "ecs:TagResources",
                   "ecs:UntagResources",
                   "ecs:ModifyDiskSpec",
                   "ecs:CreateSnapshot",
                   "ecs:DeleteDisk",
                   "ecs:DescribeInstanceAttribute",
                   "ecs:DescribeInstances"
               ],
               "Resource": [
                   "*"
               ],
               "Effect": "Allow"
           },
           {
               "Action": [
                   "nas:DescribeFileSystems",
                   "nas:DescribeMountTargets",
                   "nas:AddTags",
                   "nas:DescribeTags",
                   "nas:RemoveTags",
                   "nas:CreateFileSystem",
                   "nas:DeleteFileSystem",
                   "nas:ModifyFileSystem",
                   "nas:CreateMountTarget",
                   "nas:DeleteMountTarget",
                   "nas:ModifyMountTarget",
                   "nas:TagResources",
                   "nas:SetDirQuota",
                   "nas:EnableRecycleBin",
                   "nas:GetRecycleBinAttribute"
               ],
               "Resource": [
                   "*"
               ],
               "Effect": "Allow"
           },
           {
               "Action": [
                   "oss:PutBucket",
                   "oss:GetObjectTagging",
                   "oss:ListBuckets",
                   "oss:PutBucketTags",
                   "oss:GetBucketTags",
                   "oss:PutBucketEncryption",
                   "oss:GetBucketInfo"
               ],
               "Resource": [
                   "*"
               ],
               "Effect": "Allow"
           }
       ]
   }

3. Attach the custom policy to the RAM user.

4. Create an AccessKey pair for the RAM user.

   Warning

   We recommend that you configure AccessKey pair-based policies for network access control, limiting AccessKey invocation sources to trusted network environments to enhance AccessKey security.

5. Use the AccessKey pair to create a Secret named alibaba-addon-secret in the registered cluster.

   The system automatically uses the AccessKey pair to access cloud resources when you install the CSI component.

   kubectl -n kube-system create secret generic alibaba-addon-secret --from-literal='access-key-id=<your access key id>' --from-literal='access-key-secret=<your access key secret>'

   Note

   Replace <your access key id> and <your access key secret> with the AccessKey pair that you obtained in the previous step.

Use onectl

Run the following command to install the CSI component:

onectl addon install csi-plugin
onectl addon install csi-provisioner

Expected output:

Addon csi-plugin, version **** installed.
Addon csi-provisioner, version **** installed.

Use the console

1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

2. On the Clusters page, find the one you want to manage and click its name. In the left-side navigation pane, choose Operations > Add-ons.

3. Click the Storage tab, find csi-plugin and csi-provisioner, and then click Install.

4. In the Note message, confirm the versions of the plug-ins and click OK.