File Storage NAS:Mount a NAS file system with the Alibaba Cloud CSI plug-in (Recommended)

Use onectl

1. Install and configure onectl on your local machine. For more information, see Manage registered clusters using onectl.

2. onectl uses the AccessKey of a RAM user to access cloud resources. Run the following command to grant the RAM user the required permissions for the CSI plug-in.

   onectl ram-user grant --addon csi-plugin

   Expected output:

   Ram policy ack-one-registered-cluster-policy-csi-plugin granted to ram user ack-one-user-ce313528c3 successfully.

Use the console

To install the CSI plug-in, your self-managed Kubernetes cluster requires an AccessKey to access cloud services. To obtain this AccessKey, you must first create a RAM user and grant it the necessary permissions.

1. Create a RAM user.

2. Create a custom policy. Use the following sample policy to grant permissions to manage disks, snapshots, snapshot policies, resource tags, instances, file systems, and buckets.

   Sample custom policy

   {
       "Version": "1",
       "Statement": [
           {
               "Action": [
                   "ecs:AttachDisk",
                   "ecs:DetachDisk",
                   "ecs:DescribeDisks",
                   "ecs:CreateDisk",
                   "ecs:ResizeDisk",
                   "ecs:CreateSnapshot",
                   "ecs:DeleteSnapshot",
                   "ecs:CreateAutoSnapshotPolicy",
                   "ecs:ApplyAutoSnapshotPolicy",
                   "ecs:CancelAutoSnapshotPolicy",
                   "ecs:DeleteAutoSnapshotPolicy",
                   "ecs:DescribeAutoSnapshotPolicyEX",
                   "ecs:ModifyAutoSnapshotPolicyEx",
                   "ecs:AddTags",
                   "ecs:DescribeTags",
                   "ecs:DescribeSnapshots",
                   "ecs:ListTagResources",
                   "ecs:TagResources",
                   "ecs:UntagResources",
                   "ecs:ModifyDiskSpec",
                   "ecs:CreateSnapshot",
                   "ecs:DeleteDisk",
                   "ecs:DescribeInstanceAttribute",
                   "ecs:DescribeInstances"
               ],
               "Resource": [
                   "*"
               ],
               "Effect": "Allow"
           },
           {
               "Action": [
                   "nas:DescribeFileSystems",
                   "nas:DescribeMountTargets",
                   "nas:AddTags",
                   "nas:DescribeTags",
                   "nas:RemoveTags",
                   "nas:CreateFileSystem",
                   "nas:DeleteFileSystem",
                   "nas:ModifyFileSystem",
                   "nas:CreateMountTarget",
                   "nas:DeleteMountTarget",
                   "nas:ModifyMountTarget",
                   "nas:TagResources",
                   "nas:SetDirQuota",
                   "nas:EnableRecycleBin",
                   "nas:GetRecycleBinAttribute"
               ],
               "Resource": [
                   "*"
               ],
               "Effect": "Allow"
           },
           {
               "Action": [
                   "oss:PutBucket",
                   "oss:GetObjectTagging",
                   "oss:ListBuckets",
                   "oss:PutBucketTags",
                   "oss:GetBucketTags",
                   "oss:PutBucketEncryption",
                   "oss:GetBucketInfo"
               ],
               "Resource": [
                   "*"
               ],
               "Effect": "Allow"
           }
       ]
   }

3. Manage RAM user permissions.

4. Create an AccessKey for the RAM user.

   Warning

   For enhanced security, configure a network access control policy for the AccessKey to restrict access to trusted network environments and improve security. For more information, see AccessKey-based network access restriction policies.

5. Use the AccessKey to create a Secret resource named alibaba-addon-secret in the registered cluster.

   The CSI plug-in automatically uses this AccessKey to access cloud services during installation.

   kubectl -n kube-system create secret generic alibaba-addon-secret --from-literal='access-key-id=<your access key id>' --from-literal='access-key-secret=<your access key secret>'

   Note

   Replace <your access key id> and <your access key secret> with the AccessKey credentials from the preceding step.

Use onectl

Run the following commands to install the CSI plug-in.

onectl addon install csi-plugin
onectl addon install csi-provisioner

Expected output:

Addon csi-plugin, version **** installed.
Addon csi-provisioner, version **** installed.

Use the console

1. Log on to the ACK console. In the left navigation pane, click Clusters.

2. On the Clusters page, click the name of your cluster. In the left navigation pane, click Components and Add-ons.

3. Click the Storage tab. On the csi-plugin and csi-provisioner cards, click Install.

4. After confirming the version information in the Prompt dialog box, click OK.