Getting Hetzner Storage Box to work on kube-hetzner

[WebSpider]

I have a small cluster but expecting some growth, and have a half-filled storage-box around, so I thought I'd enable the SMB CSI, and setup a StorageClass.

This turned out to be easier said than done. I know the StorageBox config works, since I can mount it from my Ubuntu 22 laptop just fine ... but using the same credentials, the control plane VM only complains about:

cluster1-cp-hel1-xve:/tmp # mount -t cifs --verbose //my.your-storagebox.de/uSNIP-sub2 /tmp/test -o vers=3.0,workgroup=WORKGROUP,username=uSNIP-sub2,password=s3cr3t,dir_mode=0777,file_mode=0777,cache=strict,actimeo=30
mount.cifs kernel mount options: ip=x.y.z,unc=\\my.your-storagebox.de\uSNIP-sub2,vers=3.0,dir_mode=0777,file_mode=0777,cache=strict,actimeo=30,user=uSNIP-sub2,domain=WORKGROUP,pass=********
mount error(115): Operation now in progress
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and kernel log messages (dmesg)

Has anyone managed to get this to work?

[Katatafjsh]

I've used this for for a minio deployment

# https://github.com/kubernetes-csi/csi-driver-smb/blob/master/docs/driver-parameters.md 
# https://github.com/kubernetes-csi/csi-driver-smb/blob/master/deploy/example/e2e_usage.md
---
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: hz-box-smb-minio
provisioner: smb.csi.k8s.io
parameters:
  source: //uxxxxxx.your-storagebox.de/backup
  subdir: minio
  onDelete: retain      # Managed by smb-csi driver

  # If csi.storage.k8s.io/provisioner-secret is provided, will create a sub directory with PV name under source

  csi.storage.k8s.io/provisioner-secret-name: hz-box-smb-creds
  csi.storage.k8s.io/provisioner-secret-namespace: default
  csi.storage.k8s.io/node-stage-secret-name: hz-box-smb-creds
  csi.storage.k8s.io/node-stage-secret-namespace: default

reclaimPolicy: Retain   # Only retain is supported
volumeBindingMode: Immediate
mountOptions:
  - dir_mode=0777
  - file_mode=0777
  - uid=1001            # Important! This is mapped for minio.
  - gid=1001            # Important! This is mapped for minio. 
  - noperm
  - mfsymlinks          # Minimal symlinks, which means they don't have permissions or ownership
  - cache=strict        # No permission checks on the mounted share
  - noserverino         # Disables the use of server-side inode numbers, can help to prevent data corruption
  - vers=3              # TODO: recent issue - https://www.reddit.com/r/hetzner/comments/1cqwzs5/mounted_storagebox_with_error_host_is_down/

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
 name: hz-box-smb-minio-sc-test
spec:
 accessModes:
   - ReadWriteMany
 resources:
   requests:
     storage: 1Gi
 storageClassName: hz-box-smb-minio 
---
apiVersion: v1
kind: Pod
metadata:
 name: test-storage-hz-box-smb-minio
spec:
 containers:
 - name: test-storage
   image: nicolaka/netshoot
   command: ["tail", "-f", "/dev/null"]
   volumeMounts:
     - name: test-volume
       mountPath: /mnt/testvolume
 volumes:
   - name: test-volume
     persistentVolumeClaim:
       claimName: hz-box-smb-minio-sc-test

[Taronyuu]

I've also done this, I'll share my configs too.

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: smb-u390000
provisioner: smb.csi.k8s.io
parameters:
  source: "//u390000.your-storagebox.de/backup"
reclaimPolicy: Retain
volumeBindingMode: Immediate

apiVersion: v1
kind: PersistentVolume
metadata:
  name: smb-pv
  namespace: mediaserver-prod
spec:
  capacity:
    storage: 980Gi
  volumeMode: Filesystem
  accessModes:
    - ReadWriteMany
  persistentVolumeReclaimPolicy: Retain
  storageClassName: smb-u390000
  csi:
    driver: smb.csi.k8s.io
    readOnly: false
    volumeHandle: smb-pv
    volumeAttributes:
      source: "//u390000.your-storagebox.de/backup"
    nodeStageSecretRef:
      name: smb-creds
      namespace: mediaserver-prod

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: smb-pvc
  namespace: mediaserver-prod
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 980Gi
  storageClassName: smb-u390000
  volumeName: smb-pv

And then on your deployment:

        - name: media
          persistentVolumeClaim:
            claimName: smb-pvc

The secret smb-creds is just a Secret kind with the fields username and password.

Hope this helps!