Skip to content

Commit f0a2ddd

Browse files
authored
Update workload-identity-static-pv-mount.md
1 parent f9619e6 commit f0a2ddd

File tree

1 file changed

+1
-78
lines changed

1 file changed

+1
-78
lines changed

docs/workload-identity-static-pv-mount.md

Lines changed: 1 addition & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -59,84 +59,7 @@ az identity federated-credential create --name $FEDERATED_IDENTITY_NAME \
5959
--issuer $AKS_OIDC_ISSUER \
6060
--subject system:serviceaccount:${SERVICE_ACCOUNT_NAMESPACE}:${SERVICE_ACCOUNT_NAME}
6161
```
62-
## option#1: static provision with PV
63-
```
64-
cat <<EOF | kubectl apply -f -
65-
apiVersion: v1
66-
kind: PersistentVolume
67-
metadata:
68-
annotations:
69-
pv.kubernetes.io/provisioned-by: blob.csi.azure.com
70-
name: pv-blob
71-
spec:
72-
capacity:
73-
storage: 10Gi
74-
accessModes:
75-
- ReadWriteMany
76-
persistentVolumeReclaimPolicy: Retain
77-
storageClassName: blob-fuse
78-
mountOptions:
79-
- -o allow_other
80-
- --file-cache-timeout-in-seconds=120
81-
csi:
82-
driver: blob.csi.azure.com
83-
# make sure volumeid is unique for every storage blob container in the cluster
84-
# the # character is reserved for internal use, the / character is not allowed
85-
volumeHandle: unique_volume_id
86-
volumeAttributes:
87-
storageaccount: $ACCOUNT # required
88-
containerName: $CONTAINER # required
89-
clientID: $USER_ASSIGNED_CLIENT_ID # required
90-
resourcegroup: $STORAGE_RESOURCE_GROUP # optional, specified when the storage account is not under AKS node resource group(which is prefixed with "MC_")
91-
# tenantID: $IDENTITY_TENANT #optional, only specified when workload identity and AKS cluster are in different tenant
92-
# subscriptionid: $SUBSCRIPTION #optional, only specified when workload identity and AKS cluster are in different subscription
93-
---
94-
apiVersion: apps/v1
95-
kind: StatefulSet
96-
metadata:
97-
name: statefulset-blob
98-
labels:
99-
app: nginx
100-
spec:
101-
serviceName: statefulset-blob
102-
replicas: 1
103-
template:
104-
metadata:
105-
labels:
106-
app: nginx
107-
spec:
108-
serviceAccountName: $SERVICE_ACCOUNT_NAME #required, Pod does not use this service account has no permission to mount the volume
109-
nodeSelector:
110-
"kubernetes.io/os": linux
111-
containers:
112-
- name: statefulset-blob
113-
image: mcr.microsoft.com/oss/nginx/nginx:1.19.5
114-
command:
115-
- "/bin/bash"
116-
- "-c"
117-
- set -euo pipefail; while true; do echo $(date) >> /mnt/blob/outfile; sleep 1; done
118-
volumeMounts:
119-
- name: persistent-storage
120-
mountPath: /mnt/blob
121-
readOnly: false
122-
updateStrategy:
123-
type: RollingUpdate
124-
selector:
125-
matchLabels:
126-
app: nginx
127-
volumeClaimTemplates:
128-
- metadata:
129-
name: persistent-storage
130-
spec:
131-
storageClassName: blob-fuse
132-
accessModes: ["ReadWriteMany"]
133-
resources:
134-
requests:
135-
storage: 10Gi
136-
EOF
137-
```
138-
139-
## option#2: Pod with ephemeral inline volume
62+
## Pod with ephemeral inline volume
14063
```
14164
cat <<EOF | kubectl apply -f -
14265
kind: Pod

0 commit comments

Comments
 (0)