Setting the Access Key (AK/SK) for Mounting a Parallel File System Volume

Scenarios

Before mounting a parallel file system volume to a pod, you need to set an access key (AK/SK). IAM users can use their own access keys to mount parallel file system volumes and control access to OBS. For details, see Differences Between OBS Permissions Control Methods.

Prerequisites

You have used ccictl to access CCI 2.0. For details, see ccictl Configuration Guide.

Constraints

When the access key (AK/SK) is used by a parallel file system volume, the AK/SK cannot be deleted or disabled. Otherwise, the service containers cannot access the mounted parallel file system.

Obtaining the Access Key

1. Log in to the CCI 2.0 console.
2. Hover the cursor over the username in the upper right corner and choose My Credentials from the drop-down list.
3. In the navigation pane, choose Access Keys.
4. Click Create Access Key. The Create Access Key dialog box is displayed.
5. Click OK to download the access key.

Creating a Secret Using an Access Key

1. Obtain the access key.
2. Encode the access key using Base64. (Assume that the AK is xxx and SK is yyy.) Run the following commands on Linux:

   echo -n xxx|base64
   echo -n yyy|base64

   Record the encoded AK and SK.

3. Create a YAML file, for example, secret-obs.yaml.

   apiVersion: cci/v2
   data:
     access.key: WE5WWVhVNU*****
     secret.key: Nnk4emJyZ0*****
   kind: Secret
   metadata:
     name: secret-obs
     namespace: test-obs-v1
     labels:
       secret.kubernetes.io/used-by: csi
   type: cci/secure-opaque

   The following table describes the involved parameters.

   Parameter	Mandatory	Type	Description
   access.key	Yes	String	Description: AK after Base64 encoding.
   secret.key	Yes	String	Description: SK after Base64 encoding.
   name	Yes	String	Description: secret name
   namespace	Yes	String	Description: namespace of the secret
   secret.kubernetes.io/used-by	Yes	String	Description: secret label used by CSI storage. Constraint: The value must be csi.
   type	Yes	String	Description: key type. Constraint: The value must be cci/secure-opaque. If this value is used, the data you enter will be automatically encrypted.

4. Create the secret.

   ccictl create -f secret-obs.yaml

Follow-up Operations

After setting the access key (AK/SK), you can use an existing parallel file system to create a storage volume.