Container Service for Kubernetes:Use Alibaba Cloud CSI storage

Use onectl

1. Install onectl on your on-premises machine. For more information, see Use onectl to manage registered clusters.

2. Run the following command to grant the RAM user the permissions required by the CSI plug-in:

   onectl ram-user grant --addon csi-plugin

   The expected output is similar to:

   Ram policy ack-one-registered-cluster-policy-csi-plugin granted to ram user ack-one-user-ce313528c3 successfully.

Use the console

1. Create a RAM user.

2. Create a custom policy using the following sample. The policy grants permissions to manage disks, snapshots, snapshot policies, resource tags, instances, NAS file systems, and OSS buckets.

   Show sample policy

   {
       "Version": "1",
       "Statement": [
           {
               "Action": [
                   "ecs:AttachDisk",
                   "ecs:DetachDisk",
                   "ecs:DescribeDisks",
                   "ecs:CreateDisk",
                   "ecs:ResizeDisk",
                   "ecs:CreateSnapshot",
                   "ecs:DeleteSnapshot",
                   "ecs:CreateAutoSnapshotPolicy",
                   "ecs:ApplyAutoSnapshotPolicy",
                   "ecs:CancelAutoSnapshotPolicy",
                   "ecs:DeleteAutoSnapshotPolicy",
                   "ecs:DescribeAutoSnapshotPolicyEX",
                   "ecs:ModifyAutoSnapshotPolicyEx",
                   "ecs:AddTags",
                   "ecs:DescribeTags",
                   "ecs:DescribeSnapshots",
                   "ecs:ListTagResources",
                   "ecs:TagResources",
                   "ecs:UntagResources",
                   "ecs:ModifyDiskSpec",
                   "ecs:DeleteDisk",
                   "ecs:DescribeInstanceAttribute",
                   "ecs:DescribeInstances"
               ],
               "Resource": ["*"],
               "Effect": "Allow"
           },
           {
               "Action": [
                   "nas:DescribeFileSystems",
                   "nas:DescribeMountTargets",
                   "nas:AddTags",
                   "nas:DescribeTags",
                   "nas:RemoveTags",
                   "nas:CreateFileSystem",
                   "nas:DeleteFileSystem",
                   "nas:ModifyFileSystem",
                   "nas:CreateMountTarget",
                   "nas:DeleteMountTarget",
                   "nas:ModifyMountTarget",
                   "nas:TagResources",
                   "nas:SetDirQuota",
                   "nas:EnableRecycleBin",
                   "nas:GetRecycleBinAttribute"
               ],
               "Resource": ["*"],
               "Effect": "Allow"
           },
           {
               "Action": [
                   "oss:PutBucket",
                   "oss:GetObjectTagging",
                   "oss:ListBuckets",
                   "oss:PutBucketTags",
                   "oss:GetBucketTags",
                   "oss:PutBucketEncryption",
                   "oss:GetBucketInfo"
               ],
               "Resource": ["*"],
               "Effect": "Allow"
           }
       ]
   }

3. Attach the custom policy to the RAM user.

4. Create an AccessKey for the RAM user.

   Warning

   Configure a network policy to restrict AccessKey calls to trusted network environments. For more information, see AccessKey network access restriction policy.

5. Create a Kubernetes Secret named alibaba-addon-secret in the kube-system namespace using the AccessKey pair. The CSI plug-in reads this Secret to authenticate with Alibaba Cloud services.

   kubectl -n kube-system create secret generic alibaba-addon-secret \
     --from-literal='access-key-id=<your-access-key-id>' \
     --from-literal='access-key-secret=<your-access-key-secret>'

   Replace <your-access-key-id> and <your-access-key-secret> with the AccessKey pair you created in the previous step.

Use onectl

Run the following commands:

onectl addon install csi-plugin
onectl addon install csi-provisioner

The expected output is similar to:

Addon csi-plugin, version **** installed.
Addon csi-provisioner, version **** installed.

Use the console

1. Log on to the ACK console. In the left navigation pane, click Clusters.

2. Click the name of your cluster. In the left navigation pane, click Add-ons.

3. Click the Volumes tab. Find the csi-plugin and csi-provisioner cards, then click Install on each card.

4. In the Message dialog box, confirm the versions and click OK.