144. 如何在 K3s 上部署 AWS EBS CSI 驱动
Task 任务
This knowledge base article will provide the directions for deploying and testing the AWS EBS CSI driver and storage class on K3s.
本知识库文章将提供如何在 K3s 上部署和测试 AWS EBS CSI 驱动及存储类的指导。
Requirements 要求
- K3s 1.18+ (may apply to other versions)
K3s 1.18+（可能适用于其他版本） - Amazon Web Services (AWS) account with privileges to launch EC2 instances and create IAM policies.
拥有启动 EC2 实例和创建 IAM 策略的权限的亚马逊网络服务（AWS）账户。
Background 背景
K3s has all in-tree storage providers removed since Kubernetes is shifting to out of tree providers for Container Storage Interface (CSI) and Cloud Provider Interface (CPI). While in-tree providers are convenient, they add a lot of bloat to Kubernetes and will eventually be removed from upstream Kubernetes, possibly in 2021.
K3s 移除了所有树内存储提供商，因为 Kubernetes 正在转向树外的容器存储接口（CSI）和云服务提供商接口（CPI）。虽然树内提供者很方便，但它们会给 Kubernetes 带来大量臃肿，最终可能会在 2021 年从上游 Kubernetes 中移除。
This how-to guide will instruct you on installing and configuring the AWS EBS CSI driver and storage class. This will allow you to dynamically provision and attach an EBS volume to your pod without having to manually create a persistent volume (PV) and EBS volume in advance. In the event that your node crashes and your pod is re-launched on another node, your pod will be reattached to the volume assuming that node is running in the same availability zone used by the defunct node.
本指南将指导你如何安装和配置 AWS EBS CSI 驱动及存储类。这将使你能够动态配置并附加 EBS 卷到你的 Pod 上，而无需提前手动创建持久卷（PV）和 EBS 卷。如果你的节点崩溃，且你的 Pod 在另一个节点上重新启动，假设该节点运行在已停用节点使用的同一可用区，你的 Pod 会重新连接到该卷。
Solution 解决方案
Assuming you want the CSI and storage class automatically deployed by K3s, copy the following YAML to a file in your manifests folder on one or all of your K3s servers. For example, /var/lib/rancher/k3s/server/manifests/aws-ebs-csi.yaml:
假设你希望 K3s 自动部署 CSI 和存储类，将以下 YAML 复制到你 K3s 服务器上 manifests 文件夹中的文件。例如 /var/lib/rancher/k3s/server/manifests/aws-ebs-csi.yaml：
<span style="color:#000000"><span style="background-color:#ffffff"><code class="language-yaml">apiVersion: <a data-cke-saved-href="http://helm.cattle.io/v1" href="http://helm.cattle.io/v1">helm.cattle.io/v1</a>
kind: HelmChart
metadata:
name: aws-ebs-csi-driver
namespace: kube-system
spec:
chart: <a data-cke-saved-href="https://github.com/kubernetes-sigs/aws-ebs-csi-driver/releases/download/v0.5.0/helm-chart.tgz" href="https://github.com/kubernetes-sigs/aws-ebs-csi-driver/releases/download/v0.5.0/helm-chart.tgz">https://github.com/kubernetes-sigs/aws-ebs-csi-driver/releases/download/v0.5.0/helm-chart.tgz</a>
version: v0.5.0
targetNamespace: kube-system
valuesContent: |-
enableVolumeScheduling: true
enableVolumeResizing: true
enableVolumeSnapshot: true
extraVolumeTags:
Name: k3s-ebs
anothertag: anothervalue
---
kind: StorageClass
apiVersion: <a data-cke-saved-href="http://storage.k8s.io/v1" href="http://storage.k8s.io/v1">storage.k8s.io/v1</a>
metadata:
name: ebs-storageclass
provisioner: <a data-cke-saved-href="http://ebs.csi.aws.com/" href="http://ebs.csi.aws.com/">ebs.csi.aws.com</a>
volumeBindingMode: WaitForFirstConsumer</code></span></span>enableVolumeScheduling, enableVolumeResizing, enableVolumeSnaphost, and extraVolumeTags based on your needs. These parameters and others are documented in the Helm chart.首先，撰写本文时，v0.5.0 是驱动的最新版本。如果有更新版本，可以在图表和版本标签中替换该版本。请参阅 AWS EBS CSI 说明文件 ，了解当前可用版本的文档。其次，你可以根据需求自定义
enableVolumeScheduling、enableVolumeResizing、enableVolumeSnaphost 和 extraVolumeTags。这些参数及其他参数均有记录在 Helm 图表中。
Next, you need to give the driver IAM permissions to manage EBS volumes. This can be done one of two ways. You can either feed your AWS access key and secret key as a Kubernetes secret, or use an AWS instance profile. Since the first option involves passing sensitive keys in clear text and storing them directly in Kubernetes, the second option is usually preferred. I will go over both options. For either option, make sure your access keys or instance profile has the following permissions set in IAM:
接下来，你需要赋予驱动 IAM 权限来管理 EBS 卷。这有两种方式。你可以将 AWS 访问密钥和秘密密钥作为 Kubernetes 秘密输入，或者使用 AWS 实例配置文件。由于第一种方式是通过明文传递敏感密钥并直接存储在 Kubernetes 中，第二种通常更为推荐。我会介绍这两种选项。无论哪种方式，确保你的访问密钥或实例配置文件在 IAM 中设置了以下权限：
<span style="color:#000000"><span style="background-color:#ffffff"><code class="language-json">{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:AttachVolume",
"ec2:CreateSnapshot",
"ec2:CreateTags",
"ec2:CreateVolume",
"ec2:DeleteSnapshot",
"ec2:DeleteTags",
"ec2:DeleteVolume",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeInstances",
"ec2:DescribeSnapshots",
"ec2:DescribeTags",
"ec2:DescribeVolumes",
"ec2:DescribeVolumesModifications",
"ec2:DetachVolume",
"ec2:ModifyVolume"
],
"Resource": "*"
}
]
}</code></span></span>参考资料：https://github.com/kubernetes-sigs/aws-ebs-csi-driver/blob/master/docs/example-iam-policy.json
Option 1: Kubernetes Secret
选项 1：Kubernetes Secret
You can place your AWS access key and secret key into a Kubernetes secret. Create a YAML file with the following contents and run a kubectl apply. You can also place this inside your /var/lib/rancher/k3s/server/manifests/aws-ebs-csi.yaml file. Keep in mind this is not a terribly secure option and anyone with access to these files or secrets in the kube-system namespace will be able to obtain your AWS access keys.
你可以把 AWS 访问密钥和秘密密钥放进 Kubernetes 密钥里。创建一个包含以下内容的 YAML 文件，运行 kubectl 应用。你也可以把它放在 /var/lib/rancher/k3s/server/manifests/aws-ebs-csi.yaml 文件里。请记住，这并不是一个很安全的选项，任何在 kube 系统命名空间中访问这些文件或秘密的人都能获得你的 AWS 访问密钥。
<span style="color:#000000"><span style="background-color:#ffffff"><code class="language-yaml">apiVersion: v1
kind: Secret
metadata:
name: aws-secret
namespace: kube-system
stringData:
key_id: "AKI**********"
access_key: "**********"</code></span></span>Option 2: Instance Profile
选项2：实例配置文件
This option to more secure and should not expose your keys in clear text or in a Kubernetes secret object. You'll need to make sure when your EC2 instances are launched, you've attached an instance profile that has the permissions defined above in the JSON block.
这个选项更安全，不应该以明文或 Kubernetes 秘密对象的形式暴露你的密钥。你需要确保在 EC2 实例启动时，附加了一个实例配置文件 ，里面有上述 JSON 模块中定义的权限。
Verifying and Testing 验证与测试
You can now check your pods to see if the CSI pods are running. You should see something like this:
你现在可以检查你的播客，看看 CSI 播客是否在运行。你应该会看到类似这样的内容：
<span style="color:#000000"><span style="background-color:#ffffff"><code># kubectl get pods -n kube-system | grep ebs
ebs-snapshot-controller-0 1/1 Running 0 15m
ebs-csi-node-k2gh5 3/3 Running 0 15m
ebs-csi-node-xdcvn 3/3 Running 0 15m
ebs-csi-controller-6f799b5548-46jqr 6/6 Running 0 15m
ebs-csi-controller-6f799b5548-h4nbb 6/6 Running 0 15m</code></span></span>Time to test things out. The following command can be run that should provision a 1GB EBS and attach it to your pod:
是时候测试一下了。可以执行以下命令，应该能配置一个 1GB 的 EBS，并将其连接到你的 Pod 上：
<span style="color:#000000"><span style="background-color:#ffffff"><code class="language-yaml">cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: myclaim
spec:
accessModes:
- ReadWriteOnce
storageClassName: ebs-storageclass
resources:
requests:
storage: 1Gi
---
apiVersion: v1
kind: Pod
metadata:
name: storage-test
spec:
containers:
- name: "storage-test"
image: "ubuntu:latest"
command: ["/bin/sleep"]
args: ["infinity"]
volumeMounts:
- name: myebs
mountPath: /mnt/test
volumes:
- name: myebs
persistentVolumeClaim:
claimName: myclaim
EOF</code></span></span>In your AWS console, you should see a new EBS volume has been created. After about a minute, you should be able to exec into your pod and see the volume mounted in your pod:
在你的 AWS 控制台中，你应该会看到一个新的 EBS 卷被创建。大约一分钟后，你应该能执行进入你的 Pod，看到 pod 上挂载的卷：
<span style="color:#000000"><span style="background-color:#ffffff"><code># kubectl exec storage-test -- df -h
Filesystem Size Used Avail Use% Mounted on
overlay 31G 6.2G 25G 20% /
tmpfs 64M 0 64M 0% /dev
tmpfs 3.8G 0 3.8G 0% /sys/fs/cgroup
/dev/nvme2n1 976M 2.6M 958M 1% /mnt/test
/dev/root 31G 6.2G 25G 20% /etc/hosts
shm 64M 0 64M 0% /dev/shm
tmpfs 3.8G 12K 3.8G 1% /run/secrets/<a data-cke-saved-href="http://kubernetes.io/serviceaccount" href="http://kubernetes.io/serviceaccount">kubernetes.io/serviceaccount</a>
tmpfs 3.8G 0 3.8G 0% /proc/acpi
tmpfs 3.8G 0 3.8G 0% /proc/scsi
tmpfs 3.8G 0 3.8G 0% /sys/firmware</code></span></span>Cleaning Up 清理
Remove the test pod by running the following:
通过以下操作拆卸测试舱：
<span style="color:#000000"><span style="background-color:#ffffff"><code class="language-bash">kubectl delete pod storage-test</code></span></span>通过以下方式去除 PVC：
<span style="color:#000000"><span style="background-color:#ffffff"><code class="language-bash">kubectl delete pvc myclaim</code></span></span>查看 AWS 控制台，你应该会看到你的 EBS 卷已被 AWS EBS CSI 驱动自动移除。
Reference 参考文献
访问Rancher-K8S解决方案博主，企业合作伙伴 ：
https://blog.csdn.net/lidw2009
汇聚全球AI编程工具，助力开发者即刻编程。
更多推荐
0
0- 0
已为社区贡献32条内容
所有评论(0)