Help Center/ Cloud Container Engine_Autopilot/ User Guide/ Storage/ Object Storage Service/ Using a Custom Access Key (AK/SK) to Mount an OBS Volume
Updated on 2024-09-30 GMT+08:00

Using a Custom Access Key (AK/SK) to Mount an OBS Volume

Scenario

CCE supports custom access keys so IAM users can use their own custom access keys to mount an OBS volume. For details, see How Can I Control Access to OBS?

Constraints

When an OBS volume is mounted using a custom access key (AK/SK), the access key cannot be deleted or disabled. Otherwise, the service container cannot access the mounted OBS volume.

Obtaining an Access Key

  1. Log in to the management console.
  2. Hover the cursor over the username in the upper right corner and choose My Credentials from the drop-down list.
  3. In the navigation pane, choose Access Keys.
  4. Click Create Access Key. The Create Access Key dialog box is displayed.
  5. Click OK to download the access key.

Creating a Secret Using an Access Key

  1. Obtain an access key.
  2. Encode the keys using Base64. (Assume that the AK is xxx and the SK is yyy.)

    echo -n xxx|base64

    echo -n yyy|base64

    Record the encoded AK and SK.

  3. Create a YAML file for the secret, for example, test-user.yaml.

    apiVersion: v1
    data:
      access.key: WE5WWVhVNU*****
      secret.key: Nnk4emJyZ0*****
    kind: Secret
    metadata:
      name: test-user
      namespace: default
      labels:
        secret.kubernetes.io/used-by: csi
    type: cfe/secure-opaque

    Specifically:

    Parameter

    Description

    access.key

    Base64-encoded AK.

    secret.key

    Base64-encoded SK.

    name

    Secret name.

    namespace

    Namespace of the secret.

    secret.kubernetes.io/used-by: csi

    Add this label in the YAML file if you want to make it available on the CCE console when you create an OBS PV/PVC.

    type

    Secret type. The value must be cfe/secure-opaque.

    When this type is used, the data entered by users is automatically encrypted.

  4. Create the secret.

    kubectl create -f test-user.yaml

Mounting a Secret When Statically Creating an OBS Volume

After a secret is created using the AK/SK, you can associate the secret with the PV to be created and then use the AK/SK in the secret to mount an OBS volume.

  1. Log in to the OBS console, create an OBS bucket, and record the bucket name and storage class. The parallel file system is used as an example.
  2. Create a YAML file for the PV, for example, pv-example.yaml.

    apiVersion: v1
    kind: PersistentVolume
    metadata:
      name: pv-obs-example
      annotations:
        pv.kubernetes.io/provisioned-by: everest-csi-provisioner
    spec:
      accessModes:
      - ReadWriteMany
      capacity:
        storage: 1Gi
      csi:
        nodePublishSecretRef:
          name: test-user
          namespace: default
        driver: obs.csi.everest.io
        fsType: obsfs
        volumeAttributes:
          everest.io/obs-volume-type: STANDARD
          everest.io/region: ap-southeast-1
          storage.kubernetes.io/csiProvisionerIdentity: everest-csi-provisioner
        volumeHandle: obs-normal-static-pv
      persistentVolumeReclaimPolicy: Delete
      storageClassName: csi-obs

    Parameter

    Description

    nodePublishSecretRef

    Secret specified during the mounting.

    • name: name of the secret
    • namespace: namespace of the secret

    fsType

    File type. The value can be obsfs or s3fs. If the value is s3fs, an OBS bucket is created and mounted. If the value is obsfs, an OBS parallel file system is created and mounted.

    volumeHandle

    OBS bucket name.

  3. Create a PV.

    kubectl create -f pv-example.yaml

    After a PV is created, you can create a PVC and associate it with the PV.

  4. Create a YAML file for the PVC, for example, pvc-example.yaml.

    Example YAML file for the PVC:

    apiVersion: v1
    kind: PersistentVolumeClaim
    metadata:
      annotations:
        csi.storage.k8s.io/node-publish-secret-name: test-user
        csi.storage.k8s.io/node-publish-secret-namespace: default
        volume.beta.kubernetes.io/storage-provisioner: everest-csi-provisioner
        everest.io/obs-volume-type: STANDARD
        csi.storage.k8s.io/fstype: obsfs
      name: obs-secret
      namespace: default
    spec:
      accessModes:
      - ReadWriteMany
      resources:
        requests:
          storage: 1Gi
      storageClassName: csi-obs
      volumeName: pv-obs-example

    Parameter

    Description

    csi.storage.k8s.io/node-publish-secret-name

    Name of the secret

    csi.storage.k8s.io/node-publish-secret-namespace

    Namespace of the secret

  5. Create a PVC.

    kubectl create -f pvc-example.yaml

    After the PVC is created, you can create a workload and associate it with the PVC to create volumes.

Mounting a Secret When Dynamically Creating an OBS Volume

When dynamically creating an OBS volume, you can use the following method to specify a secret:

  1. Create a YAML file for the PVC, for example, pvc-example.yaml.

    apiVersion: v1
    kind: PersistentVolumeClaim
    metadata:
      annotations:
        csi.storage.k8s.io/node-publish-secret-name: test-user
        csi.storage.k8s.io/node-publish-secret-namespace: default
        everest.io/obs-volume-type: STANDARD
        csi.storage.k8s.io/fstype: obsfs
      name: obs-secret
      namespace: default
    spec:
      accessModes:
      - ReadWriteMany
      resources:
        requests:
          storage: 1Gi
      storageClassName: csi-obs

    Parameter

    Description

    csi.storage.k8s.io/node-publish-secret-name

    Name of the secret

    csi.storage.k8s.io/node-publish-secret-namespace

    Namespace of the secret

  2. Create a PVC.

    kubectl create -f pvc-example.yaml

    After the PVC is created, you can create a workload and associate it with the PVC to create volumes.

Verification

You can use a secret of an IAM user to mount an OBS volume. Assume that a workload named obs-secret is created, the mount path in the container is /temp, and the IAM user has the CCE ReadOnlyAccess and Tenant Guest permissions.
  1. Query the name of the workload pod.

    kubectl get po | grep obs-secret

    Expected outputs:

    obs-secret-5cd558f76f-vxslv          1/1     Running   0          3m22s
  2. Query the objects in the mount path. In this example, the query is successful.

    kubectl exec obs-secret-5cd558f76f-vxslv -- ls -l /temp/

  3. Write data into the mount path. In this example, the write operation failed.

    kubectl exec obs-secret-5cd558f76f-vxslv -- touch /temp/test

    Expected outputs:

    touch: setting times of '/temp/test': No such file or directory
    command terminated with exit code 1
  4. Set the read/write permissions for the IAM user who mounted the OBS volume by referring to the bucket policy configuration.

  5. Write data into the mount path again. In this example, the write operation succeeded.

    kubectl exec obs-secret-5cd558f76f-vxslv -- touch /temp/test

  6. Check the mount path in the container to see whether the data is successfully written.

    kubectl exec obs-secret-5cd558f76f-vxslv -- ls -l /temp/

    Expected outputs:

    -rwxrwxrwx 1 root root 0 Jun  7 01:52 test