-
Notifications
You must be signed in to change notification settings - Fork 145
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
commit 15c7f99 Merge: 8388a01 7fe3ebc Author: weizhichen <weizhichen@microsoft.com> Date: Wed Dec 27 09:37:50 2023 +0000 Merge branch 'master' of https://github.com/kubernetes-sigs/azurefile-csi-driver into workload-identity commit 8388a01 Author: weizhichen <weizhichen@microsoft.com> Date: Wed Dec 27 09:33:51 2023 +0000 fix commit 44c4812 Author: weizhichen <weizhichen@microsoft.com> Date: Wed Dec 27 06:15:20 2023 +0000 fix commit 09e5b67 Author: weizhichen <weizhichen@microsoft.com> Date: Wed Dec 27 04:00:47 2023 +0000 fix commit 354f4d7 Author: weizhichen <weizhichen@microsoft.com> Date: Tue Dec 26 08:29:07 2023 +0000 helm commit 960912d Merge: 0c58154 5dd86f5 Author: weizhichen <weizhichen@microsoft.com> Date: Tue Dec 26 08:00:51 2023 +0000 Merge branch 'master' of https://github.com/kubernetes-sigs/azurefile-csi-driver into workload-identity commit 0c58154 Merge: e3adfa4 d519073 Author: weizhichen <weizhichen@microsoft.com> Date: Mon Dec 18 02:18:53 2023 +0000 Merge branch 'master' of https://github.com/kubernetes-sigs/azurefile-csi-driver into workload-identity commit e3adfa4 Author: weizhichen <weizhichen@microsoft.com> Date: Thu Dec 14 03:17:25 2023 +0000 spell commit 78c82b5 Author: weizhichen <weizhichen@microsoft.com> Date: Thu Dec 14 03:09:16 2023 +0000 doc commit 7bb959f Author: weizhichen <weizhichen@microsoft.com> Date: Thu Dec 14 03:05:08 2023 +0000 doc commit 2dde59d Author: weizhichen <weizhichen@microsoft.com> Date: Wed Dec 13 14:45:37 2023 +0000 doc commit e774ff5 Author: weizhichen <weizhichen@microsoft.com> Date: Wed Dec 13 13:46:37 2023 +0000 update go mod commit 2e79ca3 Merge: 7846026 6cfe218 Author: weizhichen <weizhichen@microsoft.com> Date: Wed Dec 13 13:19:41 2023 +0000 Merge branch 'master' of https://github.com/kubernetes-sigs/azurefile-csi-driver into workload-identity commit 7846026 Author: weizhichen <weizhichen@microsoft.com> Date: Wed Dec 13 13:07:48 2023 +0000 update go mod commit 0446a46 Author: weizhichen <weizhichen@microsoft.com> Date: Fri Nov 24 08:52:03 2023 +0000 update cloud-provider-azure commit ff2aeb4 Author: weizhichen <weizhichen@microsoft.com> Date: Tue Nov 14 12:29:14 2023 +0000 doc commit 633641b Author: weizhichen <weizhichen@microsoft.com> Date: Tue Nov 14 12:01:02 2023 +0000 add docs commit afcb818 Author: weizhichen <weizhichen@microsoft.com> Date: Tue Nov 14 11:20:40 2023 +0000 feat: support workload identity setting in static PV mount on AKS
- Loading branch information
Showing
30 changed files
with
404 additions
and
52 deletions.
There are no files selected for viewing
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,179 @@ | ||
| # Example of static PV mount with workload identity | ||
|
|
||
| > Note: | ||
| > - Available kubernetes version >= v1.20 | ||
| ## prerequisite | ||
|
|
||
|
|
||
| ### 1. Create a cluster with oidc-issuer enabled and get the credential | ||
|
|
||
| Following the [documentation](https://learn.microsoft.com/en-us/azure/aks/use-oidc-issuer#create-an-aks-cluster-with-oidc-issuer) to create an AKS cluster with the `--enable-oidc-issuer` parameter and get the AKS credentials. And export following environment variables: | ||
| ``` | ||
| export RESOURCE_GROUP=<your resource group name> | ||
| export CLUSTER_NAME=<your cluster name> | ||
| export REGION=<your region> | ||
| ``` | ||
|
|
||
|
|
||
| ### 2. Create a new storage account and fileshare | ||
|
|
||
| Following the [documentation](https://learn.microsoft.com/en-us/azure/storage/files/storage-how-to-use-files-portal?tabs=azure-cli) to create a new storage account and fileshare or use your own. And export following environment variables: | ||
| ``` | ||
| export ACCOUNT=<your storage account name> | ||
| export SHARE=<your fileshare name> | ||
| ``` | ||
|
|
||
| ### 3. Create managed identity and role assignment | ||
| ``` | ||
| export UAMI=<your managed identity name> | ||
| az identity create --name $UAMI --resource-group $RESOURCE_GROUP | ||
| export USER_ASSIGNED_CLIENT_ID="$(az identity show -g $RESOURCE_GROUP --name $UAMI --query 'clientId' -o tsv)" | ||
| export IDENTITY_TENANT=$(az aks show --name $CLUSTER_NAME --resource-group $RESOURCE_GROUP --query identity.tenantId -o tsv) | ||
| export ACCOUNT_SCOPE=$(az storage account show --name $ACCOUNT --query id -o tsv) | ||
| az role assignment create --role "Storage Account Contributor" --assignee $USER_ASSIGNED_CLIENT_ID --scope $ACCOUNT_SCOPE | ||
| ``` | ||
|
|
||
| ### 4. Create service account on AKS | ||
| ``` | ||
| export SERVICE_ACCOUNT_NAME=<your sa name> | ||
| export SERVICE_ACCOUNT_NAMESPACE=<your sa namespace> | ||
| cat <<EOF | kubectl apply -f - | ||
| apiVersion: v1 | ||
| kind: ServiceAccount | ||
| metadata: | ||
| name: ${SERVICE_ACCOUNT_NAME} | ||
| namespace: ${SERVICE_ACCOUNT_NAMESPACE} | ||
| EOF | ||
| ``` | ||
|
|
||
| ### 5. Create the federated identity credential between the managed identity, service account issuer, and subject using the `az identity federated-credential create` command. | ||
| ``` | ||
| export FEDERATED_IDENTITY_NAME=<your federated identity name> | ||
| export AKS_OIDC_ISSUER="$(az aks show --resource-group $RESOURCE_GROUP --name $CLUSTER_NAME --query "oidcIssuerProfile.issuerUrl" -o tsv)" | ||
| az identity federated-credential create --name $FEDERATED_IDENTITY_NAME \ | ||
| --identity-name $UAMI \ | ||
| --resource-group $RESOURCE_GROUP \ | ||
| --issuer $AKS_OIDC_ISSUER \ | ||
| --subject system:serviceaccount:${SERVICE_ACCOUNT_NAMESPACE}:${SERVICE_ACCOUNT_NAME} | ||
| ``` | ||
|
|
||
| ## option#1: static provision with PV | ||
| ``` | ||
| cat <<EOF | kubectl apply -f - | ||
| apiVersion: v1 | ||
| kind: PersistentVolume | ||
| metadata: | ||
| annotations: | ||
| pv.kubernetes.io/provisioned-by: file.csi.azure.com | ||
| name: pv-azurefile | ||
| spec: | ||
| capacity: | ||
| storage: 10Gi | ||
| accessModes: | ||
| - ReadWriteMany | ||
| persistentVolumeReclaimPolicy: Retain | ||
| storageClassName: azurefile-csi | ||
| mountOptions: | ||
| - dir_mode=0777 | ||
| - file_mode=0777 | ||
| - uid=0 | ||
| - gid=0 | ||
| - mfsymlinks | ||
| - cache=strict | ||
| - nosharesock | ||
| csi: | ||
| driver: file.csi.azure.com | ||
| # make sure volumeid is unique for every identical share in the cluster | ||
| # the # character is reserved for internal use | ||
| volumeHandle: unique_volume_id | ||
| volumeAttributes: | ||
| storageaccount: $ACCOUNT # required | ||
| shareName: $SHARE # required | ||
| clientID: $USER_ASSIGNED_CLIENT_ID # required | ||
| resourcegroup: $RESOURCE_GROUP # required, please make sure your account is NOT created under AKS node resource group(prefix with `MC_`) | ||
| # tenantID: $IDENTITY_TENANT #optional, only specified when workload identity and AKS cluster are in different tenant | ||
| # subscriptionid: $SUBSCRIPTION #optional, only specified when workload identity and AKS cluster are in different subscription | ||
| --- | ||
| apiVersion: apps/v1 | ||
| kind: StatefulSet | ||
| metadata: | ||
| name: statefulset-azurefile | ||
| labels: | ||
| app: nginx | ||
| spec: | ||
| podManagementPolicy: Parallel | ||
| serviceName: statefulset-azurefile | ||
| replicas: 1 | ||
| template: | ||
| metadata: | ||
| labels: | ||
| app: nginx | ||
| spec: | ||
| serviceAccountName: $SERVICE_ACCOUNT_NAME #required, Pod does not use this service account has no permission to mount the volume | ||
| nodeSelector: | ||
| "kubernetes.io/os": linux | ||
| containers: | ||
| - name: statefulset-azurefile | ||
| image: mcr.microsoft.com/oss/nginx/nginx:1.19.5 | ||
| command: | ||
| - "/bin/bash" | ||
| - "-c" | ||
| - set -euo pipefail; while true; do echo $(date) >> /mnt/azurefile/outfile; sleep 1; done | ||
| volumeMounts: | ||
| - name: persistent-storage | ||
| mountPath: /mnt/azurefile | ||
| updateStrategy: | ||
| type: RollingUpdate | ||
| selector: | ||
| matchLabels: | ||
| app: nginx | ||
| volumeClaimTemplates: | ||
| - metadata: | ||
| name: persistent-storage | ||
| spec: | ||
| storageClassName: azurefile-csi | ||
| accessModes: ["ReadWriteMany"] | ||
| resources: | ||
| requests: | ||
| storage: 10Gi | ||
| EOF | ||
| ``` | ||
|
|
||
| ## option#2: Pod with ephemeral inline volume | ||
| ``` | ||
| cat <<EOF | kubectl apply -f - | ||
| kind: Pod | ||
| apiVersion: v1 | ||
| metadata: | ||
| name: nginx-azurefile-inline-volume | ||
| spec: | ||
| serviceAccountName: $SERVICE_ACCOUNT_NAME #required, Pod does not use this service account has no permission to mount the volume | ||
| nodeSelector: | ||
| "kubernetes.io/os": linux | ||
| containers: | ||
| - image: mcr.microsoft.com/oss/nginx/nginx:1.19.5 | ||
| name: nginx-azurefile | ||
| command: | ||
| - "/bin/bash" | ||
| - "-c" | ||
| - set -euo pipefail; while true; do echo $(date) >> /mnt/azurefile/outfile; sleep 1; done | ||
| volumeMounts: | ||
| - name: persistent-storage | ||
| mountPath: "/mnt/azurefile" | ||
| volumes: | ||
| - name: persistent-storage | ||
| csi: | ||
| driver: file.csi.azure.com | ||
| volumeAttributes: | ||
| storageaccount: $ACCOUNT # required | ||
| shareName: $SHARE # required | ||
| clientID: $USER_ASSIGNED_CLIENT_ID # required | ||
| resourcegroup: $RESOURCE_GROUP # optional, specified when the storage account is not under AKS node resource group(which is prefixed with `MC_`) | ||
| # tenantID: $IDENTITY_TENANT # optional, only specified when workload identity and AKS cluster are in different tenant | ||
| # subscriptionid: $SUBSCRIPTION # optional, only specified when workload identity and AKS cluster are in different subscription | ||
| EOF | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.