Using an OBS Bucket Through a Dynamic PV

Constraints

• If OBS volumes are used, the owner group and permission of the mount point cannot be modified.
• CCE allows parallel file systems to be mounted using OBS SDKs or PVCs. If PVC mounting is used, the obsfs tool provided by OBS must be used. An obsfs resident process is generated each time an object storage volume generated from the parallel file system is mounted to a node, as shown in the following figure.
  Figure 1 obsfs resident process
  

  Reserve 1 GiB of memory for each obsfs process. For example, for a node with 4 vCPUs and 8 GiB of memory, an obsfs parallel file system should be mounted to no more than eight pods.

  

  • An obsfs resident process runs on a node. If the consumed memory exceeds the upper limit of the node, the node malfunctions. On a node with 4 vCPUs and 8 GiB of memory, if more than 100 pods are mounted to a parallel file system, the node will be unavailable. Control the number of pods mounted to a parallel file system on a single node.
• Kata containers do not support OBS volumes.

• OBS allows a single user to create a maximum of 100 buckets. If a large number of dynamic PVCs are created, the number of buckets may exceed the upper limit, and no more OBS buckets can be created. In this case, use OBS by calling its API or SDK and do not mount OBS buckets to workloads.

Automatically Creating an OBS Volume on the Console

1. Log in to the CCE console and click the cluster name to access the cluster console.
2. Dynamically create a PVC and PV.
   1. Choose Storage in the navigation pane and click the PersistentVolumeClaims (PVCs) tab. Click Create PVC in the upper right corner. In the dialog box displayed, configure the PVC parameters.

      Parameter	Description
      PVC Type	In this example, select OBS.
      PVC Name	Enter the PVC name, which must be unique in the same namespace.
      Creation Method	If no underlying storage is available, select Dynamically provision to create a PVC, PV, and underlying storage on the console in cascading mode. If underlying storage is available, create a storage volume or use an existing storage volume to statically create a PVC based on whether a PV has been created. For details, see Using an Existing OBS Bucket Through a Static PV. In this example, select Dynamically provision.
      Storage Classes	The storage class of OBS volumes is csi-obs.
      Instance Type	Parallel file system: a high-performance file system provided by OBS. It provides millisecond-level access latency, TB/s-level bandwidth, and million-level IOPS. Parallel file systems are recommended. Object bucket: a container that stores objects in OBS. All objects in a bucket are at the same logical level.
      OBS Class	You can select the following object bucket types: Standard: Applicable when a large number of hotspot files or small-sized files need to be accessed frequently (multiple times per month on average) and require fast access response. Infrequent access: Applicable when data is not frequently accessed (fewer than 12 times per year on average) but requires fast access response.
      Access Mode	OBS volumes support only ReadWriteMany, indicating that a storage volume can be mounted to multiple nodes in read/write mode. For details, see Volume Access Modes.
      Secret	Custom: Customize a secret if you want to assign different user permissions to different OBS storage devices. For details, see Using a Custom Access Key (AK/SK) to Mount an OBS Volume. Only secrets with the secret.kubernetes.io/used-by = csi label can be selected. The secret type is cfe/secure-opaque. If no secret is available, click Create Secret to create one. Name: Enter a secret name. Namespace: Select the namespace where the secret is. Access Key (AK/SK): Upload a key file in .csv format. For details, see Obtaining an Access Key.
      Enterprise Project	Supported enterprise projects: default, the one to which the cluster belongs, or the one specified by the storage class.

   2. Click Create to create a PVC and a PV.

      You can choose Storage in the navigation pane and view the created PVC and PV on the PersistentVolumeClaims (PVCs) and PersistentVolumes (PVs) tab pages, respectively.

3. Create an application.
   1. In the navigation pane on the left, click Workloads. In the right pane, click the Deployments tab.
   2. Click Create Workload in the upper right corner. On the displayed page, click Data Storage in the Container Settings area and click Add Volume to select PVC.
      Mount and use storage volumes, as shown in Table 1. For details about other parameters, see Workloads.

      Table 1 Mounting a storage volume

      Parameter	Description
      PVC	Select an existing object storage volume.
      Mount Path	Enter a mount path, for example, /tmp. This parameter indicates the container path to which a data volume will be mounted. Do not mount the volume to a system directory such as / or /var/run. Otherwise, containers will be malfunctional. Mount the volume to an empty directory. If the directory is not empty, ensure that there are no files that affect container startup. Otherwise, the files will be replaced, causing container startup failures or workload creation failures. NOTICE: If a volume is mounted to a high-risk directory, use an account with minimum permissions to start the container. Otherwise, high-risk files on the host machine may be damaged.
      Subpath	Enter the subpath of the storage volume and mount a path in the storage volume to the container. In this way, different folders of the same storage volume can be used in a single pod. tmp, for example, indicates that data in the mount path of the container is stored in the tmp folder of the storage volume. If this parameter is left blank, the root path is used by default.
      Permission	Read-only: You can only read the data in the mounted volumes. Read/Write: You can modify the data volumes mounted to the path. Newly written data will not be migrated if the container is migrated, which may cause data loss.

      In this example, the disk is mounted to the /data path of the container. The container data generated in this path is stored in the OBS volume.

   3. After the configuration, click Create Workload.

      After the workload is created, the data in the container mount directory will be persistently stored. Verify the storage by referring to PV Reclaim Policy.

(kubectl) Automatically Creating an OBS Volume

1. Use kubectl to connect to the cluster.
2. Use StorageClass to dynamically create a PVC and PV.
   1. Create the pvc-obs-auto.yaml file.

      apiVersion: v1
      kind: PersistentVolumeClaim
      metadata:
        name: pvc-obs-auto
        namespace: default
        annotations:
          everest.io/obs-volume-type: STANDARD    # Object storage type.
          csi.storage.k8s.io/fstype: obsfs        # Instance type.
          csi.storage.k8s.io/node-publish-secret-name: <your_secret_name>       # Custom secret name.
          csi.storage.k8s.io/node-publish-secret-namespace: <your_namespace>    # Namespace of the custom secret.
          everest.io/enterprise-project-id: <your_project_id>     # (Optional) Enterprise project ID. If an enterprise project is specified, use the same enterprise project when creating a PVC. Otherwise, the PVC cannot be bound to a PV.
      spec:
        accessModes:
          - ReadWriteMany             # The value must be ReadWriteMany for object storage.
        resources:
          requests:
            storage: 1Gi               # OBS volume capacity.
        storageClassName: csi-obs    # The storage class type is OBS.

      Table 2 Key parameters

      Parameter	Mandatory	Description
      everest.io/obs-volume-type	Yes	OBS storage class. If fsType is set to s3fs, STANDARD (standard bucket) and WARM (infrequent access bucket) are supported. This parameter is invalid when fsType is set to obsfs.
      csi.storage.k8s.io/fstype	Yes	Instance type. The value can be obsfs or s3fs. obsfs: Parallel file system, which is mounted using obsfs (recommended). s3fs: Object bucket, which is mounted using s3fs.
      csi.storage.k8s.io/node-publish-secret-name	No	Custom secret name. (Recommended) Select this option if you want to assign different user permissions to different OBS storage devices. For details, see Using a Custom Access Key (AK/SK) to Mount an OBS Volume.
      csi.storage.k8s.io/node-publish-secret-namespace	No	Namespace of a custom secret.
      everest.io/enterprise-project-id	No	Project ID of OBS. To obtain an enterprise project ID, log in to the EPS console, click the name of the target enterprise project, and copy the enterprise project ID.
      storage	Yes	Requested capacity in the PVC, in Gi. For OBS buckets, this field is used only for verification (cannot be empty or 0). Its value is fixed at 1, and any value you set does not take effect for OBS buckets.
      storageClassName	Yes	Storage class name. The storage class name of OBS volumes is csi-obs.

   2. Run the following command to create a PVC:

      kubectl apply -f pvc-obs-auto.yaml

3. Create an application.
   1. Create a file named web-demo.yaml. In this example, the OBS volume is mounted to the /data path.

      apiVersion: apps/v1
      kind: Deployment
      metadata:
        name: web-demo
        namespace: default
      spec:
        replicas: 2
        selector:
          matchLabels:
            app: web-demo
        template:
          metadata:
            labels:
              app: web-demo
          spec:
            containers:
            - name: container-1
              image: nginx:latest
              volumeMounts:
              - name: pvc-obs-volume    #Volume name, which must be the same as the volume name in the volumes field.
                mountPath: /data  #Location where the storage volume is mounted.
            imagePullSecrets:
              - name: default-secret
            volumes:
              - name: pvc-obs-volume    #Volume name, which can be customized.
                persistentVolumeClaim:
                  claimName: pvc-obs-auto    #Name of the created PVC.

   2. Run the following command to create a workload to which the OBS volume is mounted:

      kubectl apply -f web-demo.yaml

      After the workload is created, you can try Verifying Data Persistence and Sharing.

Verifying Data Persistence and Sharing

1. View the deployed application and files.
   1. Run the following command to view the created pod:

      kubectl get pod | grep web-demo

      Expected output:

      web-demo-846b489584-mjhm9   1/1     Running   0             46s
      web-demo-846b489584-wvv5s   1/1     Running   0             46s

   2. Run the following commands in sequence to view the files in the /data path of the pods:

      kubectl exec web-demo-846b489584-mjhm9 -- ls /data
      kubectl exec web-demo-846b489584-wvv5s -- ls /data

      If no result is returned for both pods, no file exists in the /data path.

2. Run the following command to create a file named static in the /data path:

   kubectl exec web-demo-846b489584-mjhm9 --  touch /data/static

3. Run the following command to view the files in the /data path:

   kubectl exec web-demo-846b489584-mjhm9 -- ls /data

   Expected output:

   static

4. Verify data persistence.
   1. Run the following command to delete the pod named web-demo-846b489584-mjhm9:

      kubectl delete pod web-demo-846b489584-mjhm9

      Expected output:

      pod "web-demo-846b489584-mjhm9" deleted

      After the deletion, the Deployment controller automatically creates a replica.

   2. Run the following command to view the created pod:

      kubectl get pod | grep web-demo

      The expected output is as follows, in which web-demo-846b489584-d4d4j is the newly created pod:

      web-demo-846b489584-d4d4j   1/1     Running   0             110s
      web-demo-846b489584-wvv5s    1/1     Running   0             7m50s

   3. Run the following command to check whether the files in the /data path of the new pod have been modified:

      kubectl exec web-demo-846b489584-d4d4j -- ls /data

      Expected output:

      static

      If the static file still exists, the data can be stored persistently.

5. Verify data sharing.
   1. Run the following command to view the created pod:

      kubectl get pod | grep web-demo

      Expected output:

      web-demo-846b489584-d4d4j   1/1     Running   0             7m
      web-demo-846b489584-wvv5s   1/1     Running   0             13m

   2. Run the following command to create a file named share in the /data path of either pod: In this example, select the pod named web-demo-846b489584-d4d4j.

      kubectl exec web-demo-846b489584-d4d4j --  touch /data/share

      Check the files in the /data path of the pod.

      kubectl exec web-demo-846b489584-d4d4j -- ls /data

      Expected output:

      share
      static

   3. Check whether the share file exists in the /data path of another pod (web-demo-846b489584-wvv5s) as well to verify data sharing.

      kubectl exec web-demo-846b489584-wvv5s -- ls /data

      Expected output:

      share
      static

      After you create a file in the /data path of a pod, if the file is also created in the /data path of the other pod, the two pods share the same volume.

Related Operations