|
4 | 4 |
|
5 | 5 | ## Prepare Key Vault
|
6 | 6 |
|
7 |
| -1. Create a Key Vault in the [portal](https://ms.portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.KeyVault%2Fvaults). |
| 7 | +1. Create an Azure Key Vault |
8 | 8 |
|
9 |
| -2. Store `storage account key` or `SAS token` in Key Vault's Secret. |
| 9 | +2. Store `storage account key` or `SAS token` as `secret` in Azure Key Vault. |
10 | 10 |
|
11 |
| -3. Ensure the service principal has all the required permissions to access content in your Azure key vault instance. If not, you can run the following using the Azure CLI: |
| 11 | +3. Ensure service principal in cluster has all the required permissions to access content in your Azure key vault instance. If not, run the following commands: |
12 | 12 |
|
13 | 13 | ```console
|
14 | 14 | # Assign Reader Role to the service principal for your keyvault
|
15 |
| - az role assignment create --role Reader --assignee <aadClientId> --scope /subscriptions/<subscriptionid>/resourcegroups/<resourcegroup>/providers/Microsoft.KeyVault/vaults/<keyvaultname> |
| 15 | + az role assignment create --role Reader --assignee <YOUR SPN CLIENT ID> --scope /subscriptions/<subscriptionid>/resourcegroups/<resourcegroup>/providers/Microsoft.KeyVault/vaults/$keyvaultname |
16 | 16 |
|
17 |
| - az keyvault set-policy -n $KV_NAME --key-permissions get --spn <YOUR SPN CLIENT ID> |
18 |
| - az keyvault set-policy -n $KV_NAME --secret-permissions get --spn <YOUR SPN CLIENT ID> |
19 |
| - az keyvault set-policy -n $KV_NAME --certificate-permissions get --spn <YOUR CLIENT ID> |
| 17 | + az keyvault set-policy -n $keyvaultname --key-permissions get --spn <YOUR SPN CLIENT ID> |
| 18 | + az keyvault set-policy -n $keyvaultname --secret-permissions get --spn <YOUR SPN CLIENT ID> |
| 19 | + az keyvault set-policy -n $keyvaultname --certificate-permissions get --spn <YOUR CLIENT ID> |
20 | 20 | ```
|
21 | 21 |
|
22 |
| -## Install Blobfuse CSI Driver |
| 22 | +## Install blobfuse CSI driver on a kubernetes cluster |
| 23 | +Please refer to [install blobfuse csi driver](https://github.com/csi-driver/blobfuse-csi-driver/blob/master/docs/install-blobfuse-csi-driver.md) |
23 | 24 |
|
24 |
| -### Option #1 |
25 |
| - |
26 |
| -Use the [script](https://github.com/csi-driver/blobfuse-csi-driver/blob/master/deploy/install-driver.sh) to install. |
27 |
| - |
28 |
| -### Option #2 |
29 |
| - |
30 |
| -Use [helm](https://github.com/csi-driver/blobfuse-csi-driver/blob/master/charts/README.md) to install. |
| 25 | +## Create PV |
| 26 | +1. Download a `pv-blobfuse-csi-keyvault.yaml`, edit `keyVaultURL`, `keyVaultSecretName`, `containerName` in PV |
| 27 | +> `keyVaultSecretVersion` is the optional parameter. If not specified, it will be *current versoin*. |
| 28 | +``` |
| 29 | +wget https://raw.githubusercontent.com/csi-driver/blobfuse-csi-driver/master/deploy/example/keyvault/pv-blobfuse-csi-keyvault.yaml |
| 30 | +vi pv-blobfuse-csi-keyvault.yaml |
| 31 | +kubectl apply -f pv-blobfuse-csi-keyvault.yaml |
| 32 | +``` |
31 | 33 |
|
32 | 34 | ## Create PVC
|
33 | 35 |
|
34 |
| -Use default pvc file to create. |
35 |
| - |
36 | 36 | ```console
|
37 |
| -kubectl apply -f pvc-blobfuse-csi-static-keyvault.yaml |
| 37 | +kubectl apply -f https://raw.githubusercontent.com/csi-driver/blobfuse-csi-driver/master/deploy/example/keyvault/pvc-blobfuse-csi-static-keyvault.yaml |
38 | 38 | ```
|
39 | 39 |
|
40 |
| -## Create PV |
41 |
| - |
42 |
| -1. Replace your Key Vault infomation in the yaml. |
43 |
| - |
44 |
| - `keyVaultURL` and `keyVaultSecretName` are the required parameters. |
45 |
| - |
46 |
| - `keyVaultSecretVersion` is the optional parameter. If not specified, it will be *current versoin*. |
47 |
| -2. Create pv |
48 | 40 |
|
49 |
| - ```console |
50 |
| - kubectl apply -f pv-blobfuse-csi-static-keyvault.yaml |
51 |
| - ``` |
0 commit comments