Manage NAS file systems using CNFS - Container Service for Kubernetes

Container Network File System (CNFS) lets you manage NAS file systems as native Kubernetes objects that you can create and use declaratively. This provides simple, efficient persistent volumes for workloads like websites and data analytics and supports various use cases such as data sharing and isolation.

Prerequisites

An ACK Pro managed cluster of version 1.20 or later is required. To upgrade the cluster, see Manually upgrade a cluster.
Kubectl management of CNFS requires version 1.20 or later.
The following storage add-on versions are required. To upgrade the components, see Components.
- csi-plugin and csi-provisioner: v1.24.11-5221f79-aliyun or later.
- storage-operator: v1.26.2-1de13b6-aliyun or later.
The File Storage NAS service must be activated. The following limits apply to NAS file systems. For more information, see Limitations.
- Only General Purpose NAS file systems of the Capacity, Performance, and Premium types are supported; Extreme NAS is not.
- There is an upper limit on the number of NAS file systems that you can create per account in a single region.
- To use KMS encryption for a NAS file system, activate the KMS service. For more information, see Activate Key Management Service.

Create a NAS file system

Create and use a NAS file system

Before you begin, choose how to provide a NAS file system for your cluster.

Method	Description	Volume provisioning method	Use cases
Method 1: Create and use a default NAS file system	CNFS automatically creates and manages a NAS file system with a fixed configuration for fast mounts.	dynamic volume	For quick feature validation. You do not need to manage the underlying storage details. However, the created NAS file system has a fixed configuration. You cannot select the storage type, customize encryption, or fine-tune the recycle bin.
Method 2: Create and use a custom NAS file system	CNFS creates a new, customizable NAS file system based on the parameters you specify.	dynamic volume static volume	When you have specific requirements for performance, encryption, or cost, or need fine-grained storage management.
Method 3: Manage and use an existing NAS file system	CNFS integrates an existing NAS file system for centralized management.	dynamic volume static volume	For integrating an existing NAS file system into your cluster.

Method 1: Automatically create a NAS file system

You can use Container Network File System (CNFS) to automatically create a NAS file system with a default configuration. CNFS creates the file system based on your cluster environment. By default, the file system is not encrypted. If Capacity NAS is not supported in the current region, a Performance NAS file system is created instead.

After you create a CNFS resource and a StorageClass, your workload can request storage by using a PersistentVolumeClaim (PVC). This dynamically creates a PersistentVolume (PV) on the NAS file system and mounts it to a Pod.

kubectl

1. Create a CNFS

Create a ContainerNetworkFileSystem object. If you do not specify the server parameter or other custom parameters, CNFS automatically creates a default NAS file system.

apiVersion: storage.alibabacloud.com/v1beta1
kind: ContainerNetworkFileSystem
metadata:
  name: cnfs-nas-filesystem
spec:
  description: "cnfs"
  type: nas
  # Only Retain is supported. The backend NAS instance is not deleted when the CNFS is deleted.
  reclaimPolicy: Retain
  parameters:
    # Specifies whether to enable NAS-managed encryption. Set to SSE-KMS to enable this feature.
    encryptType: SSE-KMS
    # Specifies whether to enable the recycle bin feature. Set to "true" to enable it.
    enableTrashCan: "true"

Parameters

Parameter	Description
`description`	A description of the CNFS.
`type`	The volume type. Set this to `nas`.
`reclaimPolicy`	The reclaim policy. Currently, only `Retain` is supported. This policy prevents data loss by ensuring the backend NAS file system is not deleted when the CNFS object is deleted.
`parameters.encryptType`	Optional. Specifies the encryption method. `None`: Disables encryption. `SSE-KMS`: Enables NAS-managed encryption. A key that is fully managed by NAS is used to encrypt each file system. This key is created and managed by NAS in Key Management Service (KMS).
`parameters.enableTrashCan`	Enables the recycle bin to prevent business disruption and data loss from accidental file deletion. `true`: Enables the feature. `false`: Disables the feature.

Run kubectl get cnfs to view the created NAS file system.
Run kubectl get cnfs/cnfs-nas-filesystem -o yaml to view the details of the NAS file system.
For more information about the YAML parameters, see CNFS YAML reference.

2. Create a StorageClass

Create a StorageClass object to serve as a storage template. Use the containerNetworkFileSystem parameter to associate it with the CNFS you created earlier.

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: alibabacloud-cnfs-nas
provisioner: nasplugin.csi.alibabacloud.com
parameters:
  # A separate subdirectory is created under the NAS root directory for each PVC.
  volumeAs: subpath
  # Associates with the CNFS defined above.
  containerNetworkFileSystem: cnfs-nas-filesystem
  path: "/"
# We recommend setting this to Retain to preserve the backend subdirectory data when the PVC is deleted.
reclaimPolicy: Retain
# Allows volume expansion.
allowVolumeExpansion: true
mountOptions:
  - nolock,tcp,noresvport
  - vers=3

3. Create a PVC

The application requests a volume by using a PVC and references the StorageClass as its configuration template.

kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: cnfs-nas-pvc
spec:
  accessModes:
    - ReadWriteMany
  storageClassName: alibabacloud-cnfs-nas
  resources:
    requests:
      # If allowVolumeExpansion is true, the value of storage is used as the quota for the subdirectory corresponding to this PVC. The maximum amount of data that can be written to the dynamically created directory is 70 GiB.
      storage: 70Gi

4. Create an application and mount the PVC

After the PVC is created, deploy a sample application, such as a Deployment or a StatefulSet, and mount the PV bound to the PVC to the application.

Deployment: All Pod replicas reference the same PVC and mount the same directory on the backend NAS file system to share data.

Sample code

apiVersion: apps/v1
kind: Deployment
metadata:
  name: cnfs-nas-deployment
  labels:
    app: nginx
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: anolis-registry.cn-zhangjiakou.cr.aliyuncs.com/openanolis/nginx:1.14.1-8.6
        volumeMounts:
        - mountPath: "/data"
          name: cnfs-nas-pvc
      volumes:
      - name: cnfs-nas-pvc
        persistentVolumeClaim:
          claimName: cnfs-nas-pvc

StatefulSet: Using the volumeClaimTemplates template, a unique PVC is automatically created for each Pod replica. Each PVC mounts to a dedicated subdirectory on the backend NAS file system for data isolation.

Sample code

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: cnfs-nas-sts
  labels:
    app: nginx
spec:
  serviceName: "nginx"
  replicas: 2
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: anolis-registry.cn-zhangjiakou.cr.aliyuncs.com/openanolis/nginx:1.14.1-8.6
        volumeMounts:
        - mountPath: "/data"
          name: www
  volumeClaimTemplates:
  - metadata:
      name: www
    spec:
      accessModes: [ "ReadWriteOnce" ]
      storageClassName: "alibabacloud-cnfs-nas"
      resources:
        requests:
          # If allowVolumeExpansion is true, the storage parameter takes effect. The maximum amount of data that can be written to the dynamically created directory is 50 GiB.
          storage: 50Gi

5. Verify the results

Run kubectl get pvc to check the PVC status.
The PVC STATUS should be Bound, indicating it is bound to a PV.
Run kubectl get pods -l app=nginx to check the application status.
Verify the shared and persistent storage of the Deployment.
Verify the data isolation and persistent storage of the StatefulSet.

Console

1. Create a CNFS	Log on to the ACK console. In the left navigation pane, click Clusters. On the Clusters page, click the name of your cluster. In the left navigation pane, click Volumes > CNFS. Click Create CNFS File System and configure the CNFS by following the on-screen instructions. Select NAS File System Select Create Default NAS File System After the CNFS is created, you can click its name in the CNFS list to view its details. Then, click the NAS ID to go to the details page of the created NAS file system. Click the Mount Targets tab. You can find the address of the mount target in the Mount Target column.
2. Create a StorageClass	On the Clusters page, click the name of your cluster. In the left navigation pane, click Volumes > StorageClasses. On the StorageClasses page, click Create. Set PV Type to NAS and configure the StorageClass by following the on-screen instructions. Key parameters are described below. For more information, see Create a StorageClass. Select Mount Target: Select the mount target address of the NAS file system that is created or managed by CNFS. For more information about how to view a mount target address, see Manage mount targets. Mount Path: The NAS subdirectory to be mounted. If you do not specify this parameter, the root directory is mounted by default. The root directory of a General-purpose NAS file system is `/`. If the directory does not exist on the NAS file system, the system automatically creates and mounts it. Reclaim Policy: Retain (default): When the PVC is deleted, the PV and NAS files are not deleted. You must manually delete them. Delete: Deletes the PV when the associated PVC is deleted. This policy requires `archiveOnDelete`. However, static PVs do not support `archiveOnDelete`. Therefore, when this policy is set to `Delete`, deleting the PVC does not delete the PV or the files on the NAS file system. To configure `archiveOnDelete`, see Use dynamically provisioned NAS volumes.
3. Create a PVC	In the left navigation pane of the cluster management page, choose Storage > PVCs. On the Persistent Volume Claims page, click Create. Set PVC Type to NAS and configure the PVC by following the on-screen instructions. Allocation Mode: The provisioning method for the volume. Existing StorageClass: Click Select Storage Class and select the StorageClass that you created. Capacity: The capacity of the volume to be created. This value cannot exceed the total capacity of the NAS file system. Access Mode: The default value is ReadWriteMany. You can also select ReadWriteOnce or ReadOnlyMany.
4. Create an application and mount the NAS file system	When creating a Deployment or a StatefulSet, you can mount a PVC to a container in the Volumes section of the Container page. The following example shows how to mount the NAS file system created using CNFS to the /data path in a container. Configuration details: Set Volume Type to Cloud Storage, select the corresponding CNFS NAS PVC (for example, `cnfs-nas-pvc`) for Mount Source, and enter `/data` for Container Path.

Method 2: Create a custom NAS file system

Use Container Network File System (CNFS) to create a NAS file system with custom parameters.

Define a ContainerNetworkFileSystem resource to provision a new NAS file system.
Make the file system available to applications in the cluster by creating a static persistent volume (PV) or a dynamic StorageClass.

kubectl

1. Create a custom NAS file system

Create a ContainerNetworkFileSystem object and specify the NAS details, such as storage type, encryption type, and vSwitch.

apiVersion: storage.alibabacloud.com/v1beta1
kind: ContainerNetworkFileSystem
metadata:
  name: cnfs-nas-filesystem
spec:
  description: "cnfs"
  type: nas
  reclaimPolicy: Retain
  parameters:
    filesystemType: standard
    storageType: Capacity
    protocolType: NFS
    encryptType: SSE-KMS
    enableTrashCan: "true"
    trashCanReservedDays: "5"
    vSwitchId: vsw-2ze9l3ppwzg6bl02j****

Parameters

Parameter	Description
`description`	A description of the CNFS.
`type`	The volume type. Set this to `nas`.
`reclaimPolicy`	The reclaim policy. Currently, only `Retain` is supported. This policy prevents data loss by ensuring the backend NAS file system is not deleted when the CNFS object is deleted.
`parameters.filesystemType`	The file system type. The default is General-purpose NAS, specified as `standard`.
`parameters.storageType`	The storage type. General-purpose NAS supports `Performance`, `Capacity`, and `Premium` types.
`parameters.protocolType`	The file transfer protocol. Only the NFS protocol is supported.
`parameters.encryptType`	Optional. Specifies the encryption method. `None`: Disables encryption. `SSE-KMS`: Enables NAS-managed encryption. A key that is fully managed by NAS is used to encrypt each file system. This key is created and managed by NAS in Key Management Service (KMS).
`parameters.enableTrashCan`	Enables the recycle bin to prevent business disruption and data loss from accidental file deletion. `true`: Enables the feature. `false`: Disables the feature.
`parameters.trashCanReservedDays`	Specifies the maximum retention period for files in the recycle bin. The default value is 7 days. For example, `trashCanReservedDays: 5` indicates that files are retained for a maximum of 5 days.
`parameters.vSwitchId`	The ID of the vSwitch for the NAS file system. For information about the regions and availability zones that support General-purpose NAS, see Regions and availability zones.

Run kubectl get cnfs to view the created NAS file system.
Run kubectl get cnfs/cnfs-nas-filesystem -o yaml to view the details of the NAS file system.
For more information about the YAML parameters, see CNFS YAML reference.

2. Create a PV or StorageClass

After you create the CNFS, choose how your application will connect to and use the NAS file system.

Static persistent volume: Manually bind a persistent volume (PV) to an existing directory on the NAS file system. This method is suitable for scenarios where you need to access specific existing data.
Dynamic StorageClass: Create a StorageClass to serve as a template, allowing applications to automatically create new, independent subdirectories on demand.

Static PV

apiVersion: v1
kind: PersistentVolume
metadata:
  name: cnfs-nas-pv
  labels:
    alicloud-pvname: cnfs-nas-pv
spec:
  capacity:
    storage: 5Gi
  accessModes:
    - ReadWriteMany
  csi:
    driver: nasplugin.csi.alibabacloud.com
    # Must be the same as the PV name.
    volumeHandle: cnfs-nas-pv 
    volumeAttributes:
      # Specify the CNFS to use.
      containerNetworkFileSystem: cnfs-nas-filesystem
      # The path in the CNFS where the volume is mounted.
      path: "/"
  mountOptions:
    - nolock,tcp,noresvport
    - vers=3

For more information about PV parameters, see Use static NAS volumes.

Dynamic StorageClass

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: alibabacloud-nas-cnfs
mountOptions:
  - nolock,tcp,noresvport
  - vers=3
parameters:
  volumeAs: subpath
  # Specify the CNFS to use.
  containerNetworkFileSystem: cnfs-nas-filesystem
  # The path in the CNFS where the volume is mounted.
  path: "/"
provisioner: nasplugin.csi.alibabacloud.com
reclaimPolicy: Retain
# Set to true to allow the expansion of the directory quota for the volume.
allowVolumeExpansion: true

For more information about StorageClass parameters, see Use dynamic NAS volumes.

3. Create a PVC

Create a persistent volume claim (PVC) that references the NAS file system based on the static persistent volume or dynamic StorageClass you created earlier.

Static PV

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: cnfs-nas-pvc
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 5Gi
  selector:
    matchLabels:
      # Matches the previously created PV by using a label selector.
      alicloud-pvname: cnfs-nas-pv

Dynamic StorageClass

apiVersion: v1
kind: PersistentVolumeClaim
metadata: 
  name: cnfs-nas-pvc
spec:
  accessModes:
  - ReadWriteMany 
  storageClassName: alibabacloud-nas-cnfs
  resources: 
    requests:
      storage: 70Gi

4. Create an application and mount the NAS file system

After the persistent volume claim (PVC) is created, mount the bound PV to your application.

Sample code

apiVersion: apps/v1
kind: Deployment
metadata:
  name: cnfs-nas-deployment
  labels:
    app: nginx
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
        - name: nginx
          image: anolis-registry.cn-zhangjiakou.cr.aliyuncs.com/openanolis/nginx:1.14.1-8.6
          ports:
            - containerPort: 80
          volumeMounts:
            - name: cnfs-nas-pvc
              mountPath: "/data"
      volumes:
        - name: cnfs-nas-pvc
          persistentVolumeClaim:
            claimName: cnfs-nas-pvc

5. Verify the result

Run kubectl get pod -l app=nginx to check the application status.
Verify the shared and persistent storage of the Deployment.

Console

Create a CNFS	Log on to the ACK console. In the left navigation pane, click Clusters. On the Clusters page, click the name of your cluster. In the left navigation pane, click Volumes > CNFS. Click Create CNFS File System and configure the CNFS parameters as prompted. Select a NAS file system. Choose Select Existing NAS File System, and then click Create NAS File System to create a custom NAS file system. After the file system is created, select it. For more information about how to create a NAS file system, see Create a General-purpose NAS file system by using the console.
Create a PV or StorageClass	PV On the Clusters page, click the name of your cluster. In the left navigation pane, click Volumes > Persistent Volumes. Click Create, set PV Type to NAS, and then configure the PV parameters as prompted. The following list describes the key parameters. For detailed parameter descriptions, see Create a PV. Capacity: Specifies the capacity for the PV. This value is used to match the PV with a PVC and does not limit the actual storage size. Your application can use the full capacity of the underlying NAS file system. The actual capacity of a NAS file system is determined by its specifications. For more information, see General-purpose NAS. Enable CNFS: Specifies whether to enable CNFS. Select CNFS: If you enable CNFS, select the CNFS that you created earlier. Advanced Options (Optional): Mount Path: The NAS subdirectory to be mounted. If you do not specify this parameter, the root directory is mounted by default. The root directory of a General-purpose NAS file system is `/`. If the directory does not exist in the NAS file system, the system automatically creates and mounts it. Reclaim Policy: CNFS supports only Retain. StorageClass On the Clusters page, click the name of your cluster. In the left navigation pane, click Volumes > StorageClasses. On the StorageClasses page, click Create. Set PV Type to NAS and configure the StorageClass by following the on-screen instructions. Key parameters are described below. For more information, see Create a StorageClass. Select Mount Target: Select the mount target address of the NAS file system that is created or managed by CNFS. For more information about how to view a mount target address, see Manage mount targets. Mount Path: The NAS subdirectory to be mounted. If you do not specify this parameter, the root directory is mounted by default. The root directory of a General-purpose NAS file system is `/`. If the directory does not exist on the NAS file system, the system automatically creates and mounts it. Reclaim Policy: Retain (default): When the PVC is deleted, the PV and NAS files are not deleted. You must manually delete them. Delete: Deletes the PV when the associated PVC is deleted. This policy requires `archiveOnDelete`. However, static PVs do not support `archiveOnDelete`. Therefore, when this policy is set to `Delete`, deleting the PVC does not delete the PV or the files on the NAS file system. To configure `archiveOnDelete`, see Use dynamically provisioned NAS volumes.
Create a PVC	In the left navigation pane of the cluster management page, choose Storage > PVCs. On the Persistent Volume Claims page, click Create. Set PVC Type to NAS and configure the PVC by following the on-screen instructions. Allocation Mode: The provisioning method for the volume. Existing StorageClass: Click Select Storage Class and select the StorageClass that you created. Capacity: The capacity of the volume to be created. This value cannot exceed the total capacity of the NAS file system. Access Mode: The default value is ReadWriteMany. You can also select ReadWriteOnce or ReadOnlyMany.
Create an application and mount the NAS file system	When creating a Deployment or a StatefulSet, you can mount a PVC to a container in the Volumes section of the Container page. The following example shows how to mount the NAS file system created using CNFS to the /data path in a container. Configuration details: Set Volume Type to Cloud Storage, select the corresponding CNFS NAS PVC (for example, `cnfs-nas-pvc`) for Mount Source, and enter `/data` for Container Path.

Method 3: Use an existing NAS file system

Use CNFS to connect an existing NAS file system to your cluster, making it available for applications.

kubectl

1. Create a CNFS for an existing NAS file system

Create a ContainerNetworkFileSystem resource that references a NAS mount target.

apiVersion: storage.alibabacloud.com/v1beta1
kind: ContainerNetworkFileSystem
metadata:
  name: cnfs-nas-filesystem
spec:
  description: "cnfs"
  type: nas
  reclaimPolicy: Retain
  parameters:
    server: 17f7e4****-h****.cn-beijing.nas.aliyuncs.com

Parameters

Parameter	Description
`description`	A brief description of the file system.
`type`	The storage type. Set this value to nas.
`reclaimPolicy`	The reclaim policy. Currently, only `Retain` is supported. This policy prevents data loss by ensuring the backend NAS file system is not deleted when the CNFS object is deleted.
`parameters.server`	The address of the NAS mount target.

Run kubectl get cnfs to view the created NAS file system.
Run kubectl get cnfs/cnfs-nas-filesystem -o yaml to view the details of the NAS file system.
For more information about the YAML parameters, see CNFS YAML reference.

2. Create a PV or StorageClass

After you create the CNFS, choose how your application will connect to and use the NAS file system.

Static persistent volume: Manually bind a persistent volume (PV) to an existing directory on the NAS file system. This method is suitable for scenarios where you need to access specific existing data.
Dynamic StorageClass: Create a StorageClass to serve as a template, allowing applications to automatically create new, independent subdirectories on demand.

Static PV

apiVersion: v1
kind: PersistentVolume
metadata:
  name: cnfs-nas-pv
  labels:
    alicloud-pvname: cnfs-nas-pv
spec:
  capacity:
    storage: 5Gi
  accessModes:
    - ReadWriteMany
  csi:
    driver: nasplugin.csi.alibabacloud.com
    # Must be the same as the PV name.
    volumeHandle: cnfs-nas-pv 
    volumeAttributes:
      # Specify the CNFS to use.
      containerNetworkFileSystem: cnfs-nas-filesystem
      # The path in the CNFS where the volume is mounted.
      path: "/"
  mountOptions:
    - nolock,tcp,noresvport
    - vers=3

For more information about PV parameters, see Use static NAS volumes.

Dynamic StorageClass

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: alibabacloud-nas-cnfs
mountOptions:
  - nolock,tcp,noresvport
  - vers=3
parameters:
  volumeAs: subpath
  # Specify the CNFS to use.
  containerNetworkFileSystem: cnfs-nas-filesystem
  # The path in the CNFS where the volume is mounted.
  path: "/"
provisioner: nasplugin.csi.alibabacloud.com
reclaimPolicy: Retain
# Set to true to allow the expansion of the directory quota for the volume.
allowVolumeExpansion: true

For more information about StorageClass parameters, see Use dynamic NAS volumes.

3. Create a PVC

Create a persistent volume claim (PVC) that references the NAS file system based on the static persistent volume or dynamic StorageClass you created earlier.

Static PV

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: cnfs-nas-pvc
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 5Gi
  selector:
    matchLabels:
      # Matches the previously created PV by using a label selector.
      alicloud-pvname: cnfs-nas-pv

Dynamic StorageClass

apiVersion: v1
kind: PersistentVolumeClaim
metadata: 
  name: cnfs-nas-pvc
spec:
  accessModes:
  - ReadWriteMany 
  storageClassName: alibabacloud-nas-cnfs
  resources: 
    requests:
      storage: 70Gi

4. Create an application and mount the NAS file system

After the persistent volume claim (PVC) is created, mount the bound PV to your application.

Sample code

apiVersion: apps/v1
kind: Deployment
metadata:
  name: cnfs-nas-deployment
  labels:
    app: nginx
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
        - name: nginx
          image: anolis-registry.cn-zhangjiakou.cr.aliyuncs.com/openanolis/nginx:1.14.1-8.6
          ports:
            - containerPort: 80
          volumeMounts:
            - name: cnfs-nas-pvc
              mountPath: "/data"
      volumes:
        - name: cnfs-nas-pvc
          persistentVolumeClaim:
            claimName: cnfs-nas-pvc

5. Verify the result

Run kubectl get pod -l app=nginx to check the application status.
Verify the shared and persistent storage of the Deployment.

Console

Create a CNFS that uses an existing NAS file system	Log on to the ACK console. In the left navigation pane, click Clusters. On the Clusters page, click the name of your cluster. In the left navigation pane, click Volumes > CNFS. Click Create CNFS File System and follow the on-screen instructions to configure CNFS. In the Create CNFS File System panel, configure the parameters and click OK. Select the NAS file system type. Select Select Existing NAS File System and choose an existing NAS mount target from the drop-down list. Optional. Enable End-to-end Data Acceleration to use elastic acceleration for mounting and optimize data access performance.
Create a PV or StorageClass	PV On the Clusters page, click the name of your cluster. In the left navigation pane, click Volumes > Persistent Volumes. Click Create, set PV Type to NAS, and then configure the PV parameters as prompted. The following list describes the key parameters. For detailed parameter descriptions, see Create a PV. Capacity: Specifies the capacity for the PV. This value is used to match the PV with a PVC and does not limit the actual storage size. Your application can use the full capacity of the underlying NAS file system. The actual capacity of a NAS file system is determined by its specifications. For more information, see General-purpose NAS. Enable CNFS: Specifies whether to enable CNFS. Select CNFS: If you enable CNFS, select the CNFS that you created earlier. Advanced Options (Optional): Mount Path: The NAS subdirectory to be mounted. If you do not specify this parameter, the root directory is mounted by default. The root directory of a General-purpose NAS file system is `/`. If the directory does not exist in the NAS file system, the system automatically creates and mounts it. Reclaim Policy: CNFS supports only Retain. StorageClass On the Clusters page, click the name of your cluster. In the left navigation pane, click Volumes > StorageClasses. On the StorageClasses page, click Create. Set PV Type to NAS and configure the StorageClass by following the on-screen instructions. Key parameters are described below. For more information, see Create a StorageClass. Select Mount Target: Select the mount target address of the NAS file system that is created or managed by CNFS. For more information about how to view a mount target address, see Manage mount targets. Mount Path: The NAS subdirectory to be mounted. If you do not specify this parameter, the root directory is mounted by default. The root directory of a General-purpose NAS file system is `/`. If the directory does not exist on the NAS file system, the system automatically creates and mounts it. Reclaim Policy: Retain (default): When the PVC is deleted, the PV and NAS files are not deleted. You must manually delete them. Delete: Deletes the PV when the associated PVC is deleted. This policy requires `archiveOnDelete`. However, static PVs do not support `archiveOnDelete`. Therefore, when this policy is set to `Delete`, deleting the PVC does not delete the PV or the files on the NAS file system. To configure `archiveOnDelete`, see Use dynamically provisioned NAS volumes.
Create a PVC	In the left navigation pane of the cluster management page, choose Storage > PVCs. On the Persistent Volume Claims page, click Create. Set PVC Type to NAS and configure the PVC by following the on-screen instructions. Allocation Mode: The provisioning method for the volume. Existing StorageClass: Click Select Storage Class and select the StorageClass that you created. Capacity: The capacity of the volume to be created. This value cannot exceed the total capacity of the NAS file system. Access Mode: The default value is ReadWriteMany. You can also select ReadWriteOnce or ReadOnlyMany.
Create an application and mount the NAS file system	When creating a Deployment or a StatefulSet, you can mount a PVC to a container in the Volumes section of the Container page. The following example shows how to mount the NAS file system created using CNFS to the /data path in a container. Configuration details: Set Volume Type to Cloud Storage, select the corresponding CNFS NAS PVC (for example, `cnfs-nas-pvc`) for Mount Source, and enter `/data` for Container Path.

Configure shared and isolated storage

After creating a NAS file system, you can configure it for shared or isolated storage to meet your application's requirements.

Configure a shared NAS volume

To share data between Pods, mount the same directory from a NAS file system to multiple Pods as a shared volume.

How it works: This method uses a static volume. The path specified in the PersistentVolume (PV) is the exact directory that the CSI driver mounts. When multiple Pods mount this PV using the same PersistentVolumeClaim (PVC), they all access the same directory, which enables data sharing.
Key configuration: In the volumes section of your workload's Pod template (.spec.template), set the persistentVolumeClaim.claimName parameter to the same PVC name.

1. Create a PV and PVC that point to a specific directory

Show sample code

apiVersion: v1
kind: PersistentVolume
metadata:
  name: cnfs-nas-static-pv
spec:
  accessModes:
  - ReadWriteMany
  capacity:
    storage: 50Gi
  csi:
    driver: nasplugin.csi.alibabacloud.com
    fsType: nfs
    volumeAttributes:
      # Specify the CNFS.
      containerNetworkFileSystem: cnfs-nas-filesystem
      mountProtocol: nfs
      path: /
      volumeAs: subpath
      volumeCapacity: "true"
    volumeHandle: cnfs-nas-static-pv
  mountOptions:
  - nolock,tcp,noresvport
  - vers=3
  persistentVolumeReclaimPolicy: Retain
  storageClassName: cnfs-nas-sc
  volumeMode: Filesystem
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: cnfs-nas-static-pvc
  namespace: default
spec:
  accessModes:
  - ReadWriteMany
  resources:
    requests:
      storage: 50Gi
  storageClassName: cnfs-nas-sc
  volumeMode: Filesystem
  # Reference the PV.
  volumeName: cnfs-nas-static-pv
status:
  accessModes:
  - ReadWriteMany
  capacity:
    storage: 50Gi

2. Create a sample Deployment

Show sample code

apiVersion: apps/v1
kind: Deployment
metadata:
  name: cnfs-nas-deployment
  labels:
    app: nginx
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: anolis-registry.cn-zhangjiakou.cr.aliyuncs.com/openanolis/nginx:1.14.1-8.6
        volumeMounts:
        - mountPath: "/data"
          # Reference the volume defined in the volumes section below.
          name: cnfs-nas-pvc
      volumes:
      # Define a volume named cnfs-nas-pvc.
      - name: cnfs-nas-pvc
        # All Pod replicas reference the same PVC to enable shared storage.
        persistentVolumeClaim:
          claimName: cnfs-nas-static-pvc

3. Verify the result

Check the mount status

kubectl exec cnfs-nas-deployment-*****a -- mount | grep nfs

The output includes the mount point, confirming a successful mount.

66bd9493d6-*****.cn-zhangjiakou.nas.aliyuncs.com:/ on /data type nfs (rw,relatime,vers=3,rsize=1048576,wsize=1048576,namlen=255,hard,nolock,noresvport,proto=tcp,timeo=600,retrans=2,sec=sys,mountaddr=10.XX.XX.199,mountvers=3,mountport=2049,mountproto=tcp,local_lock=all,addr=10.XX.XX.199)

Verify shared and persistent storage for the Deployment.

Configure an isolated NAS volume

For use cases requiring data isolation, such as multi-tenancy, you can provide each Pod or group of Pods with a dedicated storage directory.

How it works: This method uses a dynamic volume. The CSI driver automatically creates a dedicated subdirectory with the same name as the PV under the specified path to serve as the mount point. Because each PVC binds to a separate subdirectory, this ensures data isolation.
Key configuration:
- In the parameters section of your StorageClass, ensure volumeAs: subpath is set. This setting (which is the default) creates a dedicated subdirectory for each PVC.
- In the StatefulSet definition, use the volumeClaimTemplates section to automatically create and bind a unique PVC for each Pod.

1. Create a StorageClass for dynamic subdirectory creation

Show sample code

Reference the specified CNFS in the StorageClass and use volumeAs: subpath to have the CSI driver dynamically create an isolated subdirectory for each PVC request.

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: cnfs-nas-sc
mountOptions:
  - nolock,tcp,noresvport
  - vers=3
parameters:
  # The core parameter for enabling isolated volumes.
  volumeAs: subpath
  # Reference the created CNFS.
  containerNetworkFileSystem: cnfs-nas-filesystem
  # Specify the root path on the NAS file system for creating subdirectories.
  # The CSI driver creates a subdirectory under this path with the same name as the auto-generated PV.
  path: "/"
  archiveOnDelete: "false"
provisioner: nasplugin.csi.alibabacloud.com
# Automatically delete the corresponding NAS subdirectory when the PVC is deleted.
reclaimPolicy: Delete
allowVolumeExpansion: true

2. Create a sample StatefulSet

Show sample code

Dynamically creates and mounts an isolated storage volume for each Pod based on a template defined by the StorageClass.

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: cnfs-nas-sts
  labels:
    app: nginx
spec:
  serviceName: "nginx"
  replicas: 2
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: anolis-registry.cn-zhangjiakou.cr.aliyuncs.com/openanolis/nginx:1.14.1-8.6
        command: ["/bin/sh"]
        args: ["-c", "sleep 3600;"]
        volumeMounts:
        - mountPath: "/data"
          name: pvc
  # The volumeClaimTemplates section automatically creates a PVC for each Pod based on the following template.
  volumeClaimTemplates:
  - metadata:
      name: pvc
    spec:
      accessModes: [ "ReadWriteOnce" ]
      # Reference the previously created StorageClass.
      storageClassName: "cnfs-nas-sc" 
      resources:
        requests:
          # This value is for scheduling purposes only and does not represent a real quota. 
          # The actual available capacity is the total capacity of the NAS file system.
          storage: 50Gi

3. Verify the result

Check the mount status

Check the mount information for a Pod, such as cnfs-nas-sts-0.

kubectl exec cnfs-nas-sts-0 -- mount |grep nfs

The output confirms that a subdirectory on the NAS file system is mounted to the Pod's /data path.

66bd9493d6-*****.cn-zhangjiakou.nas.aliyuncs.com:/nas-e7242ba0-47ec-4410-9107-b0e247a***** on /data type nfs (rw,relatime,vers=3,rsize=1048576,wsize=1048576,namlen=255,hard,nolock,noresvport,proto=tcp,timeo=600,retrans=2,sec=sys,mountaddr=10.XX.XX.199,mountvers=3,mountport=2049,mountproto=tcp,local_lock=all,addr=10.XX.XX.199)

Verify data isolation and persistent storage for the StatefulSet.

Production recommendations

Data security
- Data encryption: When creating a new NAS file system, set encryptType: SSE-KMS in the parameters of the CNFS object. This enables server-side encryption and improves data security.
- Data protection and reclaim policy: The reclaimPolicy for a CNFS object is always Retain, which means deleting the CNFS object in Kubernetes does not delete the backend NAS instance. However, the reclaim policy for a PV is defined by its StorageClass. For production environments, set the reclaim policy to Retain to prevent accidental data loss.
- Recycle bin: When creating a NAS file system, enable the recycle bin by setting enableTrashCan: "true" to prevent accidental data deletion.
- Concurrent writes: When multiple Pods mount the same shared storage volume, avoid multiple application instances writing to the same file at the application level. This prevents file corruption from concurrent writes.
Operations and management
- Performance isolation: Isolated storage volumes only provide data-level isolation. All isolated volumes share the IOPS and throughput of the same backend NAS instance. For core applications with strict I/O performance requirements and a need for stable latency, provision a dedicated NAS file system.
- Capacity management: Set allowVolumeExpansion: true in your StorageClass to allow for the expansion of the storage volume's directory quota.
  The value of requests.storage in a PVC is primarily used for scheduling decisions and does not set a hard quota on the entire NAS file system.
- Monitoring and alerting: Use Container Storage Monitoring to configure alerts for key metrics such as capacity utilization, IOPS, and throughput of your NAS file system. This helps you promptly identify capacity or performance bottlenecks.
Cost optimization
- Choose the right storage type: Select a NAS type based on your cost and performance requirements. For guidance, see Select a NAS type. For example, Capacity NAS is a lower-cost option suitable for latency-insensitive tasks such as file sharing or archiving.
- Release resources promptly: After decommissioning an application, release all unused resources. Also, delete the backend NAS file system if it is no longer needed to avoid unexpected costs.

References

Verify shared storage, data isolation, and persistent storage

After the NAS file system is mounted, verify that the storage behaves as expected.

Verify shared and persistent storage for a deployment

Steps

Shared storage

Persistent storage

To verify shared storage, create a file in one pod and then check for it in another.

View the pod information to obtain the pod names.

kubectl get pod | grep cnfs-nas-deployment

Expected output:

cnfs-nas-deployment-*****a 1/1 Running 0 40s
cnfs-nas-deployment-*****b 1/1 Running 0 40s

Create a file in one of the pods. This example uses a pod named cnfs-nas-deployment-*****a.
```
kubectl exec cnfs-nas-deployment-*****a -- touch /data/test.txt
```
Check if the file exists in the other pod. This example uses a pod named cnfs-nas-deployment-*****b.
```
kubectl exec cnfs-nas-deployment-*****b -- ls /data
```
Expected output:
```
test.txt
```
The file appears in the output, which confirms that data is shared between pods.
Important
When multiple pods write to shared storage, CNFS cannot guarantee data consistency. To prevent file corruption, avoid concurrent writes to the same file.

To verify persistent storage, recreate the deployment and check if the data exists in the new pods.

Trigger a rolling restart of the deployment to recreate its pods.
```
kubectl rollout restart deploy cnfs-nas-deployment
```

View the pods and wait for the new pods to start and enter the Running state.

kubectl get pod | grep cnfs-nas-deployment

Expected output:

cnfs-nas-deployment-*****c 1/1 Running 0 67s
cnfs-nas-deployment-*****d 1/1 Running 0 49s

In a new pod, check if the previously created file exists. This example uses a pod named cnfs-nas-deployment-*****c.
```
kubectl exec cnfs-nas-deployment-*****c -- ls /data
```
Expected output:
```
test.txt
```
The previously written file appears in the output, confirming that the storage is persistent.

Verify data isolation and persistent storage for a StatefulSet

Steps

Each pod in a StatefulSet has an independent PVC, which ensures data isolation.

Data isolation

Persistent storage

To verify data isolation, create a file in one pod and confirm its absence in another.

View the pod information to obtain the pod names.

kubectl get pod | grep cnfs-nas-sts

Expected output:

cnfs-nas-sts-0 1/1 Running 0 5m
cnfs-nas-sts-1 1/1 Running 0 5m

Create an identifiable file in one of the pods. This example uses a pod named cnfs-nas-sts-0:
```
kubectl exec cnfs-nas-sts-0 -- touch /data/sts-0-data.txt
```
Check if the file exists in the other pod. This example uses a pod named cnfs-nas-sts-1.
```
kubectl exec cnfs-nas-sts-1 -- ls /data
```
The output does not show the file created in cnfs-nas-sts-0. This confirms that each StatefulSet pod uses an independent volume and their data is isolated.

Delete a specific pod, wait for it to be recreated, and then check if the data exists in the new pod.

Delete a pod to trigger its recreation. This example uses cnfs-nas-sts-0:
```
kubectl delete pod cnfs-nas-sts-0
```

View the pods and wait for a pod with the same name to start and enter the Running state. The StatefulSet recreates a pod with the same name and identity.

kubectl get pod | grep cnfs-nas-sts

Expected output:

cnfs-nas-sts-0                        1/1     Running   0          19s
cnfs-nas-sts-1                        1/1     Running   0          102s

In the new pod, check if the previously created file exists.
```
kubectl exec cnfs-nas-sts-0 -- ls /data
```
The previously written file appears in the output, confirming that persistent storage works correctly.
```
sts-0-data.txt
```

CNFS YAML

Run kubectl get cnfs/<cnfsName> -o yaml to view the complete configuration and real-time status of the CNFS object.

This section provides an example of running the kubectl get cnfs/cnfs-nas-filesystem -o yaml command in Method 2 to view the cnfs-nas-filesystem YAML.

YAML example

Details

apiVersion: storage.alibabacloud.com/v1beta1
kind: ContainerNetworkFileSystem
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"storage.alibabacloud.com/v1beta1","kind":"ContainerNetworkFileSystem","metadata":{"annotations":{},"name":"cnfs-nas-filesystem"},"spec":{"description":"cnfs","parameters":{"encryptType":"SSE-KMS","enableTrashCan":"true","filesystemType":"standard","protocolType":"NFS","storageType":"Capacity","trashCanReservedDays":"5","vSwitchId":"vsw-2ze9l3ppwzg6bl02j****"},"reclaimPolicy":"Retain","type":"nas"}}
  creationTimestamp: "20**-05-14T08:20:09Z"
  finalizers:
  - protection.alibabacloud.com/cnfs
  generation: 6
  name: cnfs-nas-filesystem
  resourceVersion: "122342382"
  uid: a9e9650c-68b2-405b-8274-0f5b6063****
spec:
  description: "cnfs"
  reclaimPolicy: Retain
  type: nas
  parameters:
    encryptType: SSE-KMS
    enableTrashCan: "true"
    filesystemType: standard
    protocolType: NFS
    storageType: Capacity
    trashCanReservedDays: "5"
    vSwitchId: vsw-2ze9l3ppwzg6bl02j****
status:
  conditions:
  - lastProbeTime: "20**-05-14 16:20:15"
    reason: The nas filesystem and mount target complete initialization.
    status: Ready
  fsAttributes:
    accessGroupName: DEFAULT_VPC_GROUP_NAME
    encryptType: SSE-KMS
    enableTrashCan: "true"
    filesystemId: 17f7e*****
    filesystemType: standard
    protocolType: NFS
    regionId: cn-beijing
    server: 17f7e48ece-h****.cn-beijing.nas.aliyuncs.com
    storageType: Capacity
    vSwitchId: vsw-2ze9l3ppwzg6bl02j****
    vpcId: vpc-2ze9sgmehjvwv5x74****
    zoneId: cn-beijing-h
  status: Available

Parameters

Details

Parameter	Description
`status`	The current status of the CNFS. Possible values are Pending, Creating, Initialization (creating the file system), Available, Unavailable (temporarily unavailable but can recover), Fatal (unavailable and cannot recover), and Terminating.
`conditions.lastProbeTime`	The timestamp of the last liveness probe.
`conditions.reason`	The reason for the current status.
`conditions.status`	The current status. The status is `Ready` if the resource is available, and `NotReady` if the resource is unavailable.
`fsAttributes.accessGroupName`	The name of the permission group applied to the mount target. Currently, only `DEFAULT_VPC_GROUP_NAME` (the default permission group for the VPC) is supported.
`fsAttributes.encryptType`	Optional. Specifies the encryption method. `None`: Disables encryption. `SSE-KMS`: Enables NAS-managed encryption. A key that is fully managed by NAS is used to encrypt each file system. This key is created and managed by NAS in Key Management Service (KMS).
`fsAttributes.enableTrashCan`	Enables the recycle bin to prevent business disruption and data loss from accidental file deletion. `true`: Enables the feature. `false`: Disables the feature.
`fsAttributes.filesystemId`	The ID of the file system.
`fsAttributes.filesystemType`	The file system type. The default is General-purpose NAS, specified as `standard`.
`fsAttributes.protocolType`	The file transfer protocol. Currently, only the NFS protocol is supported.
`fsAttributes.regionId`	The region where the CNFS is located.
`fsAttributes.server`	The address of the NAS mount target.
`fsAttributes.storageType`	The storage type. General-purpose NAS supports `Performance`, `Capacity`, and `Premium` types.
`fsAttributes.vSwitchId`	The vSwitch used by the CNFS.
`fsAttributes.vpcId`	The VPC where the CNFS is located.
`fsAttributes.zoneId`	The availability zone where the CNFS is located.

Resource cleanup

To avoid unexpected charges and ensure data security, follow these steps to release resources that are no longer in use.

Delete the workload
- Action: Delete all applications that use the relevant PVCs, such as deployments and StatefulSets. This action stops the pods and unmounts the volumes.
- Example command: kubectl delete deployment <YOUR-DEPLOYMENT-NAME>
Delete the PVCs
- Action: Delete the PVC associated with the application. The result of the PV deletion depends on the reclaim policy (reclaimPolicy).
  - Retain (Recommended): After you delete the PVC, the data and directories on the backend NAS are completely retained.
  - Delete: When a PVC is deleted, its bound PV is also deleted. The data and directories on the backend NAS will be handled based on the setting of the archiveOnDelete parameter in the StorageClass.
    - "true" (default): The directory or file is not actually deleted. Instead, it is renamed to archived-{pvName}.{timestamp}.
    - "false" : Data is permanently deleted. This operation is irreversible. Use with caution.
- Example command: kubectl delete pvc <YOUR-PVC-NAME>
Delete the PV
- Operation: Delete the PV. This operation is primarily for static PVs or for PVs that are in the Released state after the Retain policy is used in the previous step.
  This action only removes the resource definition from Kubernetes. It does not delete the data on the backend NAS.
- Example command: kubectl delete pv <YOUR-PV-NAME>
Delete Kubernetes storage definitions (Optional)
- Action: Delete the StorageClass and CNFS objects that are no longer needed.
  This action only removes the resource definitions from Kubernetes. It does not delete the data on the backend NAS.
- Example commands: kubectl delete sc <YOUR-STORAGECLASS-NAME> and kubectl delete cnfs <YOUR-CNFS-NAME>
Delete the backend NAS file system
- Action: See Delete a file system. This irreversible action permanently deletes all data on the NAS. Use with extreme caution. Before you proceed, ensure that no other services depend on this NAS file system.