Using a Custom Access Key (AK/SK) to Mount an OBS Volume

Scenario

CCE supports custom access keys. In this way, IAM users can use their own custom access keys to mount an OBS volume. For details, see How Can I Control Access to OBS?

Constraints

When an OBS volume is mounted using a custom access key (AK/SK), the access key cannot be deleted or disabled. Otherwise, the service container cannot access the mounted OBS volume.

Obtaining an Access Key

1. Log in to the management console.
2. Hover the cursor over the username in the upper right corner and choose My Credentials from the drop-down list.
3. In the navigation pane, choose Access Keys.
4. Click Create Access Key. The Create Access Key dialog box is displayed.
5. Click OK to download the access key.

Creating a Secret Using an Access Key

1. Obtain an access key.
2. Encode the keys using Base64. (Assume that the AK is xxx and the SK is yyy.)

   echo -n xxx|base64

   echo -n yyy|base64

   Record the encoded AK and SK.

3. Create a YAML file for the secret, for example, test-user.yaml.

   apiVersion: v1
   data:
     access.key: WE5WWVhVNU*****
     secret.key: Nnk4emJyZ0*****
   kind: Secret
   metadata:
     name: test-user
     namespace: default
     labels:
       secret.kubernetes.io/used-by: csi
   type: cfe/secure-opaque

   Specifically:

   Parameter	Description
   access.key	Base64-encoded AK.
   secret.key	Base64-encoded SK.
   name	Secret name.
   namespace	Namespace of the secret.
   secret.kubernetes.io/used-by: csi	Add this label in the YAML file if you want to make it available on the CCE console when you create an OBS PV/PVC.
   type	Secret type. The value must be cfe/secure-opaque. When this type is used, the data entered by users is automatically encrypted.

4. Create the secret.

   kubectl create -f test-user.yaml

Mounting a Secret When Statically Creating an OBS Volume

After a secret is created using the AK/SK, you can associate the secret with the PV to be created and then use the AK/SK in the secret to mount an OBS volume.

1. Log in to the OBS console, create an OBS bucket, and record the bucket name and storage class. The parallel file system is used as an example.
2. Create a YAML file for the PV, for example, pv-example.yaml.

   apiVersion: v1
   kind: PersistentVolume
   metadata:
     name: pv-obs-example
     annotations:
       pv.kubernetes.io/provisioned-by: everest-csi-provisioner
   spec:
     accessModes:
     - ReadWriteMany
     capacity:
       storage: 1Gi
     csi:
       nodePublishSecretRef:
         name: test-user
         namespace: default
       driver: obs.csi.everest.io
       fsType: obsfs
       volumeAttributes:
         everest.io/obs-volume-type: STANDARD
         everest.io/region: ap-southeast-1
         storage.kubernetes.io/csiProvisionerIdentity: everest-csi-provisioner
       volumeHandle: obs-normal-static-pv
     persistentVolumeReclaimPolicy: Delete
     storageClassName: csi-obs

   Parameter	Description
   nodePublishSecretRef	Secret specified during the mounting. name: name of the secret namespace: namespace of the secret
   fsType	File type. The value can be obsfs or s3fs. If the value is s3fs, an OBS bucket is created and mounted using s3fs. If the value is obsfs, an OBS parallel file system is created and mounted using obsfs. You are advised to set this field to obsfs.
   volumeHandle	OBS bucket name.

3. Create a PV.

   kubectl create -f pv-example.yaml

   After a PV is created, you can create a PVC and associate it with the PV.

4. Create a YAML file for the PVC, for example, pvc-example.yaml.

   Example YAML file for the PVC:

   apiVersion: v1
   kind: PersistentVolumeClaim
   metadata:
     annotations:
       csi.storage.k8s.io/node-publish-secret-name: test-user
       csi.storage.k8s.io/node-publish-secret-namespace: default
       volume.beta.kubernetes.io/storage-provisioner: everest-csi-provisioner
       everest.io/obs-volume-type: STANDARD
       csi.storage.k8s.io/fstype: obsfs
     name: obs-secret
     namespace: default
   spec:
     accessModes:
     - ReadWriteMany
     resources:
       requests:
         storage: 1Gi
     storageClassName: csi-obs
     volumeName: pv-obs-example

   Parameter	Description
   csi.storage.k8s.io/node-publish-secret-name	Name of the secret
   csi.storage.k8s.io/node-publish-secret-namespace	Namespace of the secret

5. Create a PVC.

   kubectl create -f pvc-example.yaml

   After the PVC is created, you can create a workload and associate it with the PVC to create volumes.

Mounting a Secret When Dynamically Creating an OBS Volume

When dynamically creating an OBS volume, you can use the following method to specify a secret:

1. Create a YAML file for the PVC, for example, pvc-example.yaml.

   apiVersion: v1
   kind: PersistentVolumeClaim
   metadata:
     annotations:
       csi.storage.k8s.io/node-publish-secret-name: test-user
       csi.storage.k8s.io/node-publish-secret-namespace: default
       everest.io/obs-volume-type: STANDARD
       csi.storage.k8s.io/fstype: obsfs
     name: obs-secret
     namespace: default
   spec:
     accessModes:
     - ReadWriteMany
     resources:
       requests:
         storage: 1Gi
     storageClassName: csi-obs

   Parameter	Description
   csi.storage.k8s.io/node-publish-secret-name	Name of the secret
   csi.storage.k8s.io/node-publish-secret-namespace	Namespace of the secret

2. Create a PVC.

   kubectl create -f pvc-example.yaml

   After the PVC is created, you can create a workload and associate it with the PVC to create volumes.

Verification