:Mount an OSS bucket to an RDS Custom container series node

Precautions

RDS Custom AI nodes and Node Lingjun support only plaintext AccessKeys for mounting OSS buckets.

Step 1: Create a RAM user with OSS access permissions and obtain an AccessKey

First, obtain the AccessKey for a Resource Access Management (RAM) user that has permissions to perform operations on an OSS bucket.

1. Create a RAM user. If you already have a RAM user, you can skip this step.

2. Create a custom policy.

   You can choose the read-only or read and write policy below as needed. Replace mybucket with the name of your bucket.

   • OSS read-only policy

     Expand to view the OSS read-only policy document

     {
         "Statement": [
             {
                 "Action": [
                     "oss:Get*",
                     "oss:List*"
                 ],
                 "Effect": "Allow",
                 "Resource": [
                     "acs:oss:*:*:mybucket",
                     "acs:oss:*:*:mybucket/*"
                 ]
             }
         ],
         "Version": "1"
     }

   • OSS read and write policy

     Expand to view the OSS read and write policy document

     {
         "Statement": [
             {
                 "Action": "oss:*",
                 "Effect": "Allow",
                 "Resource": [
                     "acs:oss:*:*:mybucket",
                     "acs:oss:*:*:mybucket/*"
                 ]
             }
         ],
         "Version": "1"
     }

3. Grant OSS permissions to the RAM user. For more information, see Grant permissions to a RAM user.

4. Create an AccessKey for the RAM user. For more information, see Obtain an AccessKey.

Step 2: Create a static persistent volume (PV)

kubectl create -f pv-oss.yaml

apiVersion: v1
kind: PersistentVolume
metadata:
  name: oss-csi-model-qwen-inner  # A unique name for the PV.
  labels:
    alicloud-pvname: oss-csi-model-qwen-inner  # A custom tag that identifies the PV.
spec:
  accessModes:
    - ReadWriteMany  # Supports multi-node read and write, a native attribute of OSS.
  capacity:
    storage: 63Gi     # The storage capacity of the PV. This must match the OSS bucket capacity.
  csi:
    driver: ossplugin.csi.alibabacloud.com  # The Alibaba Cloud OSS Container Storage Interface (CSI) driver.
    volumeAttributes:
      bucket: model-qwen  # The name of the target OSS bucket.
      path: /Qwen3-32B  # The mount path prefix in the bucket, such as the /Qwen3-32B folder.
      url: oss-cn-beijing-internal.aliyuncs.com  # The internal OSS endpoint for the China (Beijing) region.
      otherOpts: "-o allow_other"  # Mount option: allows other users to access the volume.
      akId: ******  # Your Alibaba Cloud AccessKey ID. Replace with the actual value.
      akSecret: *****  # Your AccessKey secret. Replace with the actual value.
    volumeHandle: oss-model-qwen-inner  # A unique identifier for the volume.
  persistentVolumeReclaimPolicy: Retain  # Retains data when the PV is deleted. This is the default behavior.
  storageClassName: oss  # The name of the associated StorageClass.
  volumeMode: Filesystem  # Mounts the volume as a file system.

Step 3: Create a persistent volume claim (PVC)

Run the following command to create a PVC.

kubectl create -f pvc-oss.yaml

The following code provides a sample oss-pvc-model-qwen-inner.yaml file for creating a PVC.

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: oss-pvc-model-qwen-inner  # The name of the PVC.
  namespace: default  # The namespace.
spec:
  accessModes:
    - ReadWriteMany  # Requests the same access mode as the PV.
  resources:
    requests:
      storage: 63Gi  # The requested storage capacity. The value must be less than or equal to the PV capacity.
  storageClassName: oss  # The associated StorageClass.
  volumeMode: Filesystem  # The file system mode.

Step 4: Deploy a pod and mount the PVC

Run the following command to deploy a pod and mount the PVC.

kubectl apply -f pod.yaml

The following code provides a sample sglang-qwen3.yaml file for deploying a pod.

apiVersion: v1
kind: Pod
metadata:
  name: sglang-qwen3  # The name of the pod.
spec:
  containers:
  - command:
    - sh
    - -c
    - echo hello world; sleep infinity;  # A test command. Replace this with your actual business logic.
    image: aliclouddb-pub-registry-vpc.cn-beijing.cr.aliyuncs.com/aliclouddb-public/des-ai-nv:25.05-sglang0.4.6.post4-pytorch2.6-cu124-20250513-serverless
    imagePullPolicy: IfNotPresent  # Pulls the image only if it is not already present.
    name: sglang  # The name of the container.
    ports:
    - containerPort: 8000  # The listener port of the container.
      name: restful
      protocol: TCP
    resources:
      requests:
        cpu: "80"  
        memory: "300Gi"  
        nvidia.com/gpu: "8"  
      limits:
        cpu: "80"  
        memory: "300Gi" 
        nvidia.com/gpu: "8"  
    volumeMounts:
      - name: oss-volume  # The mount name. This must match the name in the volumes section.
        mountPath: "/data"  # The mount path in the container. This path stores the OSS data.
  volumes:
    - name: oss-volume
      persistentVolumeClaim:
        claimName: oss-pvc-model-qwen-inner  # The name of the associated PVC.
  restartPolicy: Always  # Restarts the pod if it fails.
  nodeSelector:
    alibabacloud.com/virtual-node: "true"  # Schedules the pod to a virtual node.
  tolerations:
  - effect: NoSchedule
    key: virtual-kubelet.io/provider
    value: aliclouddb  # The toleration for taints on virtual nodes.

Step 5: Verify the pod

Run the following command to view the status of the pod.

kubectl get pod sglang-qwen3 -o wide

References

Introduction to RDS Custom