Container Service for Kubernetes:Use OSS volumes

Usage notes

• OSS provides shared storage. You can mount a single OSS bucket to multiple Pods.

• Avoid storing more than 1,000 files in the mount directory. If the file count is too high, ossfs can consume excessive memory and cause an Out of Memory (OOM) error in the Pod.

Procedure

1. Obtain your OSS bucket information.

   If you do not have an OSS bucket, create one in the OSS console. For more information, see Create a bucket.

   1. Log on to the OSS console. In the left-side navigation pane, click Bucket List.

   2. On the Bucket List page, click the name of the target bucket.

   3. On the bucket details page, click the Overview tab. In the Access Port section, copy the target endpoint.

      • If the bucket and the cluster are in the same region, copy the VPC endpoint.

      • If the bucket and the cluster are in different regions, copy the Internet endpoint.

2. Choose an authorization method.

   • Method 1 (Recommended): Use a RAM role.

     Create a RAM role and grant permissions to it. When you create the role, set Principal Type to Cloud Service and Principal Name to ECS. Then, attach the AliyunOSSFullAccess policy to the role. For more information, see Create a RAM role for a trusted Alibaba Cloud service and Grant permissions to a RAM role.

   • Method 2: Use an AccessKey pair.

     Obtain an AccessKey ID and an AccessKey Secret. For more information, see Obtain an AccessKey pair.

3. Create a file named test-ack-oss.yaml with the following content.

   Note

   This example uses a VPC environment. For VPC access, make sure that the instance, container image repository, and OSS endpoint are in the same region, such as China (Beijing).

   If you need to mount OSS or pull images across Regions, you must configure internet access and change the image address or OSS url to the corresponding internet access format in the following code.

   • image: Set to registry.cn-beijing.aliyuncs.com/eci_open/nginx:1.14.2.

   • url: The public endpoint.

   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: test-ack-oss
     labels:
       alibabacloud.com/eci: "true"
   spec:
     replicas: 2
     selector:
       matchLabels:
         alibabacloud.com/eci: "true"
     template:
       metadata:
         labels:
           alibabacloud.com/eci: "true"
       spec:
         containers:
         - name: nginx
           image: registry-vpc.cn-beijing.aliyuncs.com/eci_open/nginx:1.14.2
           ports:
           - containerPort: 80
           volumeMounts:
             - name: cache-volume
               mountPath: /cache-test
         volumes:
           - name: cache-volume
             persistentVolumeClaim:
               claimName: oss-pvc
   ---
   apiVersion: v1
   kind: PersistentVolumeClaim
   metadata:
     name: oss-pvc
   spec:
     storageClassName: test
     accessModes:
       - ReadWriteMany
     resources:
       requests:
         storage: 5Gi
     selector:
       matchLabels:
         alicloud-pvname: pv-oss
   ---
   apiVersion: v1
   kind: PersistentVolume
   metadata:
     name: oss-csi-pv
     labels:
       alicloud-pvname: pv-oss
   spec:
     storageClassName: test
     capacity:
       storage: 5Gi
     accessModes:
       - ReadWriteMany
     persistentVolumeReclaimPolicy: Retain
     csi:
       driver: ossplugin.csi.alibabacloud.com
       volumeHandle: oss-csi-pv
       volumeAttributes:
         bucket: "oss-test"
         url: "oss-cn-beijing-internal.aliyuncs.com"
         otherOpts: "-o max_stat_cache_size=0 -o allow_other"
         ramRole: "<your RAM Role Name>"

   The preceding example uses a RAM role for authorization. If you need to use an AccessKey for direct authorization, replace ramRole: "<your RAM Role Name>" with the following YAML:

         akId: "<your AccessKey ID>"
         akSecret: "<your AccessKey Secret>"

   Note

   To mount a cross-account OSS bucket, configure the AccessKey ID and AccessKey Secret for the target account.

   The following OSS-related parameters must be configured in volumeAttributes:

   Parameter	Description
   bucket	The name of the OSS bucket.
   path	The path of the subdirectory in the bucket to mount. The default is /, which mounts the entire bucket. For example, setting this to /data mounts only the data directory in the bucket.
   url	The OSS endpoint is obtained from Step 1. If the bucket and the cluster are in the same region, use the VPC endpoint. If the bucket and the cluster are in different regions, use the Internet endpoint.
   otherOpts	When you mount OSS, you can enter custom parameters in the format -o -o . For example: -o max_stat_cache_size=0 -o allow_other.
   ramRole	The RAM role to use for authorization.
   akId	The AccessKey ID to use for authorization.
   AccessKeySecret	The AccessKey Secret to use for authorization.

4. Run the following command to create the ECI Pods and mount the OSS volume.

   kubectl create -f test-ack-oss.yaml

5. Run the following command to verify the Pods.

   kubectl get pods -o wide

   The expected output is similar to the following:

   NAME                              READY   STATUS    RESTARTS   AGE     IP              NODE                           NOMINATED NODE   READINESS GATES
   test-ack-oss-655db9d64d-5q7d9     1/1     Running   0          46s     172.16.XX.XXX   virtual-kubelet-cn-****-k   <none>           <none>
   test-ack-oss-655db9d64d-m5vct     1/1     Running   0          46s     172.16.XX.XXX   virtual-kubelet-cn-****-k   <none>           <none>

   View the file directory in the Pod. You can see that the /cache-test mount directory for OSS is created. Files written in the first Pod can be viewed in the second Pod, which means the two Pods share the OSS storage.

   shell@Alicloud:~$ kubectl exec -it test-ack-oss-655db9d64d-5q7d9 -- bash
   root@test-ack-oss-655db9d64d-5q7d9:/# ls
   bin  boot  cache-test  dev  etc  home  lib  lib64  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var
   root@test-ack-oss-655db9d64d-5q7d9:/# ls /cache-test
   root@test-ack-oss-655db9d64d-5q7d9:/# echo "hell oss">/cache-test/ack-oss
   root@test-ack-oss-655db9d64d-5q7d9:/# ls /cache-test
   ack-oss
   root@test-ack-oss-655db9d64d-5q7d9:/# cat /cache-test/ack-oss
   hell oss
   root@test-ack-oss-655db9d64d-5q7d9:/# exit
   exit
   shell@Alicloud:~$ kubectl exec -it test-ack-oss-655db9d64d-m5vct -- bash
   root@test-ack-oss-655db9d64d-m5vct:/# ls /cache-test
   ack-oss
   root@test-ack-oss-655db9d64d-m5vct:/# cat /cache-test/ack-oss
   hell oss

Related documents

For more information about OSS volumes, see OSS volume overview.