Skip to content

Commit 32862bc

Browse files
lpettyjolpettyjo
authored
Merge pull request #92108 from lpettyjo/OSDOCS-13459
OSDOCS-13459#Add cross-subscription support for Azure File
2 parents 0235583 + 217e110 commit 32862bc

4 files changed

+243
-1
lines changed

‎modules/persistent-storage-csi-azure-file-cross-sub-dynamic-pre-provisioning-pv-pvc-procedure.adoc

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * storage/container_storage_interface/persistent_storage-csi-azure-file.adoc
4+
//
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="persistent-storage-csi-azure-file-cross-sub-dynamic-pre-provisioning-pv-pvc-procedure_{context}"]
7+
= Static provisioning across subscriptions for Azure File by creating a PV and PVC:
8+
9+
.Prerequisites
10+
* Installed {product-title} cluster on Azure with the service principal or managed identity as an Azure identity in one subscription (call it Subscription A)
11+
12+
* Access to another subscription (call it Subscription B) with the storage that is in the same tenant as the cluster
13+
14+
* Logged in to the Azure CLI
15+
16+
.Procedure
17+
. For your Azure File share, record the resource group, storage account, storage account key, and Azure File name. These values are used for the next steps.
18+
19+
. Create a secret for the persistent volume parameter `spec.csi.nodeStageSecretRef.name` by running the following command:
20+
+
21+
[source, terminal]
22+
----
23+
$ oc create secret generic azure-storage-account-<storageaccount-name>-secret --from-literal=azurestorageaccountname="<azure-storage-account-name>" --from-literal azurestorageaccountkey="<azure-storage-account-key>" --type=Opaque
24+
----
25+
+
26+
Where:
27+
`<azure-storage-account-name>` and `<azure-storage-account-key>` are the Azure storage account name and key respectively that you recorded in Step 1.
28+
29+
. Create a persistent volume (PV) by using a similar configuration to the following example file:
30+
+
31+
.Example PV YAML file
32+
[source,terminal]
33+
----
34+
apiVersion: v1
35+
kind: PersistentVolume
36+
metadata:
37+
annotations:
38+
pv.kubernetes.io/provisioned-by: file.csi.azure.com
39+
name: <pv-name> <1>
40+
spec:
41+
capacity:
42+
storage: 10Gi <2>
43+
accessModes:
44+
- ReadWriteMany
45+
persistentVolumeReclaimPolicy: Retain
46+
storageClassName: <sc-name> <3>
47+
mountOptions:
48+
- cache=strict
49+
- nosharesock
50+
- actimeo=30
51+
- nobrl
52+
csi:
53+
driver: file.csi.azure.com
54+
volumeHandle: "{resource-group-name}#{storage-account-name}#{file-share-name}" <4>
55+
volumeAttributes:
56+
shareName: <existing-file-share-name> <5>
57+
nodeStageSecretRef:
58+
name: <secret-name> <6>
59+
namespace: <secret-namespace> <7>
60+
----
61+
<1> The name of the PV.
62+
<2> The size of the PV.
63+
<3> The storage class name.
64+
<4> Ensure that `volumeHandle` is unique for every identical share in the cluster.
65+
<5> For `<existing-file-share-name>, use only the file share name and not the full path.
66+
<6> The secret name created in the previous step.
67+
<7> The namespace where the secret resides.
68+
69+
. Create a persistent value claim (PVC) specifying the existing Azure File share referenced in Step 1 using a similar configuration to the following:
70+
+
71+
.Example PVC YAML file
72+
[source,yaml]
73+
----
74+
apiVersion: v1
75+
kind: PersistentVolumeClaim
76+
metadata:
77+
name: <pvc-name> <1>
78+
spec:
79+
storageClassName: <sc-name> <2>
80+
accessModes:
81+
- ReadWriteMany
82+
resources:
83+
requests:
84+
storage: 5Gi
85+
----
86+
<1> The name of the PVC.
87+
<2> The name of the storage class that you specified for the PV in the previous step.
88+
89+
.Recommendation to use a storage class
90+
In the preceding example of static provisioning across subscriptions, the storage class referenced in the PV and PVC is not strictly necessary, as storage classes are not required to accomplish static provisioning. However, it is advisable to use a storage class to avoid cases where a manually created PVC accidentally does not match a manually created PV, and thus potentially triggers dynamic provisioning of a new PV. Other ways to avoid this issue would be to create a storage class with `provisioner: kubernetes.io/no-provisioner` or reference a non-existing storage class, which in both cases ensures that dynamic provisioning does not occur. When using either of these strategies, if a mis-matched PV and PVC occurs, the PVC stays in a pending state, and you can correct the error.

‎modules/persistent-storage-csi-azure-file-cross-sub-dynamic-provisioning-procedure.adoc

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * storage/container_storage_interface/persistent_storage-csi-azure-file.adoc
4+
//
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="persistent-storage-csi-azure-file-cross-sub-dynamic-provisioning-procedure_{context}"]
7+
= Dynamic provisioning across subscriptions for Azure File
8+
9+
.Prerequisites
10+
* Installed {product-title} cluster on Azure with the service principal or managed identity as an Azure identity in one subscription (call it Subscription A)
11+
12+
* Access to another subscription (call it Subscription B) with the storage that is in the same tenant as the cluster
13+
14+
* Logged in to the Azure CLI
15+
16+
.Procedure
17+
To use Azure File dynamic provisioning across subscriptions:
18+
19+
. Record the Azure identity (service principal or managed identity) by running the following applicable commands. The Azure identity is needed in a later step:
20+
+
21+
* If using the _service principal_ as the Azure identity when installing the cluster:
22+
+
23+
[source,terminal]
24+
----
25+
$ sp_id=$(oc -n openshift-cluster-csi-drivers get secret azure-file-credentials -o jsonpath='{.data.azure_client_id}' | base64 --decode)
26+
27+
$ az ad sp show --id ${sp_id} --query displayName --output tsv
28+
----
29+
+
30+
* If using the _managed identity_ as the Azure identity when installing the cluster:
31+
+
32+
[source,terminal]
33+
----
34+
$ mi_id=$(oc -n openshift-cluster-csi-drivers get secret azure-file-credentials -o jsonpath='{.data.azure_client_id}' | base64 --decode)
35+
36+
$ az identity list --query "[?clientId=='${mi_id}'].{Name:name}" --output tsv
37+
----
38+
39+
. Grant the Azure identity (service principal or managed identity) permission to access the resource group in another Subscription B where you want to provision the Azure File share by doing one of the following:
40+
41+
* Run the following Azure CLI command:
42+
+
43+
[source,terminal]
44+
----
45+
az role assignment create \
46+
--assignee <object-id-or-app-id> \
47+
--role <role-name> \
48+
--scope /subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.Storage/storageAccounts/<storage-account-name>
49+
----
50+
+
51+
Where:
52+
+
53+
`<object-id-or-app-id>`: The service principal or managed identity that you obtained from the previous step, such as `sp_id` or `mi_id`.
54+
+
55+
`<role-name>`: Role name. Contributor or your own role with required permissions.
56+
+
57+
`<subscription-id>`: Subscription B ID.
58+
+
59+
`<resource-group-name>`: Subscription B resource group name.
60+
+
61+
Or
62+
+
63+
* Log in to the Azure portal and on the left menu, click *Resource groups*:
64+
65+
.. Choose the resource group in Subscription B to which you want to assign a role by clicking *resource group* -> *Access control (IAM)* -> *Role assignments* tab to view current assignments, and then click *Add* > *Add role assignment*.
66+
67+
.. On the *Role* tab, choose the contributor role to assign, and then click *Next*. You can also create and choose your own role with required permission.
68+
69+
.. On the *Members* tab:
70+
... Choose an assignee by selecting the type of assignee: user, group, or service principal (or managed identity).
71+
... Click *Select members*.
72+
... Search for, and then select the desired service principal or managed identity recorded in the previous step.
73+
... Click *Select* to confirm.
74+
.. On the *Review + assign* tab, review the settings.
75+
76+
.. To finish the role assignment, click *Review + assign*.
77+
+
78+
[NOTE]
79+
====
80+
If you only want to use a specific storage account to provision the Azure File share, you can also obtain the Azure identity (service principal or managed identity) permission to access the storage account by using similar steps.
81+
====
82+
83+
. Create an Azure File storage class by using a similar configuration to the following:
84+
+
85+
.Example Azure File storage class YAML file
86+
[source, yaml]
87+
----
88+
allowVolumeExpansion: true
89+
apiVersion: storage.k8s.io/v1
90+
kind: StorageClass
91+
metadata:
92+
name: <sc-name> <1>
93+
mount options:
94+
- mfsymlinks
95+
- cache=strict
96+
- nosharesock
97+
- actimeo=30
98+
parameters:
99+
subscriptionID: <xxxx-xxxx-xxxx-xxxx-xxxx> <2>
100+
resourceGroup: <resource group name> <3>
101+
storageAccount: <storage account> <4>
102+
skuName: <skuName> <5>
103+
provisioner: file.csi.azure.com
104+
reclaimPolicy: Delete
105+
volumeBindingMode: Immediate
106+
----
107+
<1> The name of the storage class
108+
<2> The subscription B ID
109+
<3> The Subscription B resource group name
110+
<4> The storage account name, if you want to specify your own
111+
<5> The name of the SKU type
112+
113+
. Create a persistent volume claim (PVC) that specifies the Azure File storage class that you created in the previous step by using a similar configuration to the following:
114+
+
115+
.Example PVC YAML file
116+
[source, yaml]
117+
----
118+
apiVersion: v1
119+
kind: PersistentVolumeClaim
120+
metadata:
121+
name: <pvc-name> <1>
122+
spec:
123+
storageClassName: <sc-name-cross-sub> <2>
124+
accessModes:
125+
- ReadWriteMany
126+
resources:
127+
requests:
128+
storage: 5Gi
129+
----
130+
<1> The name of the PVC.
131+
<2> The name of the storage class that you created in the previous step.

‎modules/persistent-storage-csi-azure-file-cross-sub-overview.adoc

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * storage/container_storage_interface/persistent_storage-csi-azure-file.adoc
4+
//
5+
6+
:_mod-docs-content-type: CONCEPT
7+
[id="persistent-storage-csi-azure-file-cross-sub-overview_{context}"]
8+
= Azure File cross-subscription support
9+
10+
Cross-subscription support allows you to have an {product-title} cluster in one Azure subscription and mount your Azure file share in another Azure subscription by using the Azure File Container Storage Interface (CSI) driver.
11+
12+
[IMPORTANT]
13+
====
14+
Both the {product-title} cluster and the Azure File share (pre-provisioning or to be provisioned) should be inside the same tenant.
15+
====

‎storage/container_storage_interface/persistent-storage-csi-azure-file.adoc

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,9 +25,15 @@ Azure File CSI Driver Operator does _not_ support:
2525

2626
For more information about supported features, see xref:../../storage/container_storage_interface/persistent-storage-csi.adoc#csi-drivers-supported_persistent-storage-csi[Supported CSI drivers and features].
2727

28+
include::modules/persistent-storage-csi-about.adoc[leveloffset=+1]
29+
2830
include::modules/persistent-storage-csi-azure-file-nfs.adoc[leveloffset=+1]
2931

30-
include::modules/persistent-storage-csi-about.adoc[leveloffset=+1]
32+
include::modules/persistent-storage-csi-azure-file-cross-sub-overview.adoc[leveloffset=+1]
33+
34+
include::modules/persistent-storage-csi-azure-file-cross-sub-dynamic-provisioning-procedure.adoc[leveloffset=+2]
35+
36+
include::modules/persistent-storage-csi-azure-file-cross-sub-dynamic-pre-provisioning-pv-pvc-procedure.adoc[leveloffset=+2]
3137

3238
[role="_additional-resources"]
3339
.Additional resources

0 commit comments

Comments
 (0)