Elastic Container Instance:Mount an OSS bucket

Usage notes

• OSS provides shared storage. You can mount a single OSS bucket to multiple pods.

• Dynamic provisioning is not supported for OSS.

• We recommend storing no more than 1,000 files in the mount directory. A large number of files can cause ossfs to consume excessive memory, leading to an Out of Memory (OOM) error in the pod.

Procedure

1. Create an OSS bucket.

   1. Log on to the OSS console.

   2. Create an OSS bucket.

      For more information, see Create a bucket.

2. Choose an authorization method.

   • Use a RAM role for authorization.

     Create a RAM role and grant it permissions. When you create the role, set the trusted entity type to Alibaba Cloud Service, the role type to Normal Service Role, and the trusted service to Elastic Compute Service. Then, grant the role the AliyunOSSFullAccess permission policy.

     For more information, see Create a RAM role and Manage the permissions of a RAM role.

   • (Not recommended) Use an AccessKey pair for direct authorization.

     Obtain an AccessKey ID and an AccessKey secret. For more information, see Obtain an AccessKey pair.

3. Create a PV.

   1. Save the following content as oss-pv.yaml.

      apiVersion: v1
      kind: PersistentVolume
      metadata:
        name: oss-pv
        labels:
          alicloud-pvname: oss-pv
      spec:
        capacity:
          storage: 25Gi
        accessModes:
          - ReadWriteMany
        persistentVolumeReclaimPolicy: Retain
        csi:
          driver: ossplugin.csi.alibabacloud.com
          volumeHandle: oss-pv
          volumeAttributes:
            bucket: "oss-test"
            url: "oss-cn-beijing-internal.aliyuncs.com"
            otherOpts: "-o max_stat_cache_size=0 -o allow_other"
            path: "/"
            ramRole: "<your RAM Role Name>"

      The preceding example uses a RAM role. To use an AccessKey pair instead, replace ramRole: "<your RAM Role Name>" with the following YAML content:

            akId: "<your AccessKey ID>"
            akSecret: "<your AccessKey Secret>"

      The following table describes the parameters.

      Parameter	Description
      driver	The type of the driver. Set this value to ossplugin.csi.alibabacloud.com to use the Alibaba Cloud CSI driver.
      volumeHandle	A unique identifier for the PV. The value must be the same as the name defined in metadata.
      bucket	The name of the OSS bucket.
      url	The endpoint of the OSS bucket. If the mount node (VNode) and the bucket are in the same region, use an internal endpoint. If the mount node (VNode) and the bucket are in different regions, use a public endpoint.
      otherOpts	Additional ossfs mount options. Use the format -o option1 -o option2, for example, -o max_stat_cache_size=0 -o allow_other.
      path	The directory path relative to the bucket root. The default value is /.
      ramRole	The name of the RAM role.
      akId and akSecret	The AccessKey ID and AccessKey secret.

   2. Run the following command to create the PV:

      kubectl create -f oss-pv.yaml

4. Create a PVC.

   1. Save the following content as oss-pvc.yaml.

      apiVersion: v1
      kind: PersistentVolumeClaim
      metadata:
        name: oss-pvc
      spec:
        accessModes:
          - ReadWriteMany
        resources:
          requests:
            storage: 25Gi
        selector:
          matchLabels:
            alicloud-pvname: oss-pv

   2. Run the following command to create the PVC:

      kubectl create -f oss-pvc.yaml

5. Mount the OSS bucket to an ECI pod.

   1. Save the following content as oss-test.yaml.

      apiVersion: apps/v1
      kind: Deployment
      metadata:
        name: oss-test
        labels:
          app: nginx
      spec:
        replicas: 2
        selector:
          matchLabels:
            app: nginx
        template:
          metadata:
            labels:
              app: nginx
          spec:
            nodeSelector:    
              k8s.aliyun.com/vnode: "true"
            tolerations:     
            - key: k8s.aliyun.com/vnode
              operator: "Equal"
              value: "true"
              effect: "NoSchedule"
            containers:
            - name: nginx
              image: registry-vpc.cn-beijing.aliyuncs.com/eci_open/nginx:1.14.2
              ports:
              - containerPort: 80
              volumeMounts:
                - name: pvc-oss
                  mountPath: "/data"
            volumes:
              - name: pvc-oss
                persistentVolumeClaim:
                  claimName: oss-pvc

   2. Run the following command to create the Deployment:

      kubectl create -f oss-test.yaml

   3. Verify the result.

      kubectl get pods -o wide

      Expected output:

      NAME                              READY   STATUS    RESTARTS   AGE     IP             NODE                                  NOMINATED NODE   READINESS GATES
      oss-test-647bf5d6b-ms9fx          1/1     Running   0          21s     172.16.XX.XX   cn-beijing.vnd-2ze8nd8xcl33t4pa****   <none>           <none>
      oss-test-647bf5d6b-rsxrd          1/1     Running   0          21s     172.16.XX.XX   cn-beijing.vnd-2ze8nd8xcl33t4pa****   <none>           <none>

      Verify the mount in the pods. The /data directory, which is the mount point for the OSS bucket, is created. A file written in the first pod can be read from the second pod. This confirms that both pods share the same OSS volume.

      [root@k8s-master ~]# kubectl exec -it oss-test-647bf5d6b-ms9fx  -- bash
      root@oss-test-647bf5d6b-ms9fx:/# ls
      bin  boot  data  dev  etc  home  lib  lib64  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var
      root@oss-test-647bf5d6b-ms9fx:/# ls /data
      root@oss-test-647bf5d6b-ms9fx:/# echo "hello oss" >/data/test
      root@oss-test-647bf5d6b-ms9fx:/# ls /data
      test
      root@oss-test-647bf5d6b-ms9fx:/# cat /data/test
      hello oss
      root@oss-test-647bf5d6b-ms9fx:/# exit
      exit
      [root@k8s-master ~]# kubectl exec -it oss-test-647bf5d6b-rsxrd  -- bash
      root@oss-test-647bf5d6b-rsxrd:/# ls /data
      test
      root@oss-test-647bf5d6b-rsxrd:/# cat /data/test
      hello oss