Mount OSS buckets using ossfs 1.0 dynamic volumes

1. Create a StorageClass

1. Create a Secret in the same namespace as your application.

   Replace akId and akSecret with your AccessKey ID and AccessKey Secret.

   kubectl create secret generic oss-secret --from-literal='akId=<yourAccessKey ID>' --from-literal='akSecret=<yourAccessKey Secret>'

2. Create the StorageClass.

   1. Create a file named sc-oss.yaml.

      apiVersion: storage.k8s.io/v1
      kind: StorageClass
      metadata:
        name: sc-oss
      parameters:
        # Replace with the name of your OSS bucket.
        bucket: bucket
        # The mount path relative to the bucket's root directory. You can specify a subdirectory.
        path: /
        # The endpoint of the region where the bucket is located.
        url: "http://oss-cn-hangzhou-internal.aliyuncs.com" 
        # The name of the Secret that stores the AccessKey information.
        csi.storage.k8s.io/node-publish-secret-name: oss-secret
        # The namespace where the Secret that stores the AccessKey information is located.
        csi.storage.k8s.io/node-publish-secret-namespace: default
        # Custom parameters.
        otherOpts: "-o umask=022 -o max_stat_cache_size=100000 -o allow_other"
      # Fixed value for the Alibaba Cloud OSS CSI plug-in.
      provisioner: ossplugin.csi.alibabacloud.com
      # The reclaim policy for the dynamically provisioned persistent volume.
      reclaimPolicy: Retain
      # The volume binding mode.
      volumeBindingMode: Immediate
      

      Parameter	Description
      name	The name of the StorageClass.
      bucket	The OSS bucket to mount.
      path	The version of the CSI component must be v1.14.8.32-c77e277b-aliyun or later. The mount path relative to the root directory of the bucket. The default value is /, which mounts the entire bucket. If the ossfs version is earlier than 1.91, the specified path must exist in the OSS bucket. For more information, see New features in ossfs 1.91 and later.
      url	The endpoint of the OSS Bucket to mount. Use an internal endpoint if the mount node and the bucket are in the same region, or if a VPC connection is established. Use a public endpoint if the mount node and the bucket are in different regions. The following are common formats for different access ports: Internal network format: http://oss-{{regionName}}-internal.aliyuncs.com or https://oss-{{regionName}}-internal.aliyuncs.com. The internal endpoint format vpc100-oss-{{regionName}}.aliyuncs.com is deprecated. Switch to the new format promptly. Public network format: http://oss-{{regionName}}.aliyuncs.com or https://oss-{{regionName}}.aliyuncs.com.
      csi.storage.k8s.io/node-publish-secret-name	The name of the Secret that stores the AccessKey information.
      csi.storage.k8s.io/node-publish-secret-namespace	The namespace where the Secret that stores the AccessKey information is located.
      otherOpts	Custom parameters for the OSS persistent volume, in the format of -o *** -o ***. For example: -o umask=022 -o max_stat_cache_size=100000 -o allow_other. Expand for details umask: Sets the permission mask for files and directories. For example, umask=022 changes the file permissions to 755. This resolves the permission issue for files that are uploaded by using other methods, such as SDKs or the OSS console, which have a default permission of 640. We recommend that you configure this parameter for read/write splitting or multi-user access. max_stat_cache_size: Sets the upper limit of metadata cache entries, for example, 100000. Metadata is cached in memory to improve the performance of operations such as ls and stat. However, this cache cannot immediately detect file modifications made through the OSS console, SDKs, or ossutil. This may cause applications to read inconsistent data. If you have strict data consistency requirements, set this parameter to 0 to disable the cache, or reduce the cache expiration time by using the stat_cache_expire parameter. This, however, may reduce read performance. allow_other: Allows users other than the user who mounted the volume to access files and directories in the mount path. This is suitable for multi-user shared environments where non-mounting users also need to access data. For more information about optional parameters, see Mount options and Best practices for configuring ossfs 1.0.
      provisioner	The driver type. This value is fixed at ossplugin.csi.alibabacloud.com when using the Alibaba Cloud OSS CSI plug-in.
      reclaimPolicy	The reclaim policy for dynamically provisioned persistent volumes. OSS persistent volumes support only Retain, which means that when you delete a PVC, the corresponding persistent volume and the data in the OSS bucket are not deleted.
      volumeBindingMode	The volume binding mode. OSS persistent volumes do not require availability zone-based node affinity. You can use the default value Immediate.
      volumeAs	The volume access mode. The default value is sharepath. Valid values: sharepath: All persistent volumes share the same mount path. Data is stored at <bucket>:<path>/. subpath: Creates a dedicated subdirectory for each persistent volume to isolate data. The data is stored at <bucket>:<path>/<pv-name>/. This parameter takes effect only when the CSI component version is 1.31.3 or later.
      sigVersion	The signature version for requests sent to the OSS server. "v1" (Default): Uses OSS Signature Version 1. "v4" (Recommended): Uses OSS Signature Version 4.

   2. Create the StorageClass.

      kubectl apply -f sc-oss.yaml

1. Store the AccessKey from Step 1 as a Secret for the persistent volume.

   1. On the ACK Clusters page, click the name of your cluster. In the left navigation pane, click Configurations > Secrets.

   2. Click Create from YAML and follow the on-screen instructions to create the Secret.

      apiVersion: v1
      kind: Secret
      metadata:
        name: oss-secret
        # Must match the namespace of the application.
        namespace: default
      stringData:
        # Replace with your AccessKey ID.
        akId: <your AccessKey ID>
        # Replace with your AccessKey secret.
        akSecret: <your AccessKey Secret>

2. On the Clusters page, click the name of your cluster. In the left navigation pane, click Volumes > StorageClasses.

3. On the StorageClasses page, click Create, set PV Type to OSS, and follow the on-screen instructions to configure the StorageClass.

   Parameter	Description
   Access certificate	The Secret used to access OSS, which contains the AccessKey ID and AccessKey Secret.
   Bucket ID:	The OSS bucket to use. The console displays only the buckets that the configured AccessKey can access.
   OSS path	The version of the CSI component must be v1.14.8.32-c77e277b-aliyun or later. The mount path relative to the root directory of the bucket. The default value is /, which mounts the entire bucket. If the ossfs version is earlier than 1.91, the specified path must exist in the OSS bucket. For more information, see New features in ossfs 1.91 and later.
   Volume Mode	The volume access mode. The default is Shared Directory. Valid values: The Subdirectory mode takes effect only when the CSI component version is 1.31.3 or later. Otherwise, the Shared Directory mode is used. Shared Directory (sharepath): All persistent volumes share the same mount path. Data is stored at <bucket>:<path>/. Subdirectory (subpath): Creates a dedicated subdirectory for each persistent volume to isolate data. Data is stored at <bucket>:<path>/<pv-name>/.
   Endpoint	The endpoint of the OSS Bucket to mount. Use an internal endpoint if the mount node and the bucket are in the same region, or if a VPC connection is established. Use a public endpoint if the mount node and the bucket are in different regions. The following are common formats for different access ports: Internal network format: http://oss-{{regionName}}-internal.aliyuncs.com or https://oss-{{regionName}}-internal.aliyuncs.com. The internal endpoint format vpc100-oss-{{regionName}}.aliyuncs.com is deprecated. Switch to the new format promptly. Public network format: http://oss-{{regionName}}.aliyuncs.com or https://oss-{{regionName}}.aliyuncs.com. By default, the console uses HTTP to access OSS over an internal network. To use HTTPS, you must create the PV by using kubectl.
   Reclaim policy	The reclaim policy for dynamically provisioned persistent volumes. OSS persistent volumes support only Retain, which means that when you delete a PVC, the corresponding persistent volume and the data in the OSS bucket are not deleted.
   Optional Parameters:	Custom parameters for the OSS persistent volume, in the format of -o *** -o ***. For example: -o umask=022 -o max_stat_cache_size=100000 -o allow_other. Expand for details umask: Sets the permission mask for files and directories. For example, umask=022 changes the file permissions to 755. This resolves the permission issue for files that are uploaded by using other methods, such as SDKs or the OSS console, which have a default permission of 640. We recommend that you configure this parameter for read/write splitting or multi-user access. max_stat_cache_size: Sets the upper limit of metadata cache entries, for example, 100000. Metadata is cached in memory to improve the performance of operations such as ls and stat. However, this cache cannot immediately detect file modifications made through the OSS console, SDKs, or ossutil. This may cause applications to read inconsistent data. If you have strict data consistency requirements, set this parameter to 0 to disable the cache, or reduce the cache expiration time by using the stat_cache_expire parameter. This, however, may reduce read performance. allow_other: Allows users other than the user who mounted the volume to access files and directories in the mount path. This is suitable for multi-user shared environments where non-mounting users also need to access data. For more information about optional parameters, see Mount options and Best practices for configuring ossfs 1.0.