doc: add blobfuse mount with managed identity doc #1464

umagnus · 2024-07-10T07:47:51Z

What type of PR is this?

/kind documentation

What this PR does / why we need it:

doc: add mount azure blob storage doc
referring to https://github.com/qxsch/Azure-Aks/tree/master/aks-blobfuse-mi

Which issue(s) this PR fixes:

Fixes #

Requirements:

uses conventional commit messages
includes documentation
adds unit tests
tested upgrade from previous version

Special notes for your reviewer:

Release note:

none

k8s-ci-robot · 2024-07-10T07:48:01Z

Hi @umagnus. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

deploy/example/mountstorage/README.md

andyzhangx · 2024-07-10T07:55:25Z

deploy/example/mountstorage/README.md

+    az identity list -g "$resourcegroup" --query "[?name == 'aks-fuseblob-mi-agentpool'].clientId" -o tsv
+    ```
+
+## Using a dedicated user-assigned managed indentity


andyzhangx · 2024-07-10T07:56:45Z

deploy/example/mountstorage/README.md

+    az storage blob upload \
+        --account-name myaksblob \
+        --container-name mycontainer \
+        --name test.htm \


let's remove this application example, make it simple

andyzhangx · 2024-07-10T07:56:57Z

deploy/example/mountstorage/README.md

+    ---
+
+    apiVersion: v1
+    kind: Service


let's remove this example, make it simple

andyzhangx · 2024-07-10T07:57:28Z

deploy/example/mountstorage/README.md

+
+1. Now you can use the persistent volume claim ``pv-blob2`` in another deployment.
+
+# Security consideration


let's remove this , make it simple

andyzhangx

/ok-to-test

andyzhangx

mountstorage --> blobfuse-mi

and pls also add dynamic provisioning example

andyzhangx · 2024-07-11T01:47:28Z

deploy/example/mountstorage/deployment.yaml

+
+---
+
+apiVersion: v1


remove service

andyzhangx · 2024-07-11T01:50:50Z

deploy/example/mountstorage/README.md

+        volumeHandle: pv-blob1
+        volumeAttributes:
+          protocol: fuse
+          resourceGroup: aks-fuseblob-mi


rename as blobfuse-mi

andyzhangx · 2024-07-11T01:51:59Z

deploy/example/mountstorage/volume.yaml

+    volumeHandle: pv-blob1
+    volumeAttributes:
+      protocol: fuse
+      resourceGroup: aks-fuseblob-mi


blobfuse-mi

andyzhangx · 2024-07-11T01:52:06Z

deploy/example/mountstorage/README.md

+
+- Create a storage account container, e.g.
+    ```bash
+    resourcegroup="aks-fuseblob-mi"


blobfuse-mi

andyzhangx · 2024-07-11T01:52:58Z

deploy/example/mountstorage/README.md

+            app: nginx-app1
+        spec:
+          containers:
+          - image: mcr.microsoft.com/oss/nginx/nginx:1.19.5


use this example config:

blob-csi-driver/deploy/example/deployment.yaml

Lines 35 to 39 in 12d5f64

image: mcr.microsoft.com/oss/nginx/nginx:1.17.3-alpine

command:

- "/bin/sh"

- "-c"

- while true; do echo $(date) >> /mnt/blob/outfile; sleep 1; done

umagnus · 2024-07-11T02:41:59Z

mountstorage --> blobfuse-mi

and pls also add dynamic provisioning example

added dynamic provisioning example

andyzhangx · 2024-07-11T06:41:42Z

deploy/example/mountstorage/storageclass-blobfuse-resourcegroup.yaml

+  storageAccount: EXISTING_STORAGE_ACCOUNT_NAME # optional, if use existing storage account
+  containerName: EXISTING_CONTAINER_NAME # optional, if use existing container
+  AzureStorageAuthType: MSI
+  AzureStorageIdentityClientID: "92926dfd-e61b-4730-85ab-5be73b374e82"


use `xxx-xx ..' for this

andyzhangx · 2024-07-11T06:42:28Z

deploy/example/mountstorage/pv-blobfuse-csi-mount.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1


rename as deploy/example/blobfuse-mi/pv-blobfuse-mi.yaml

andyzhangx · 2024-07-11T06:43:07Z

deploy/example/mountstorage/README.md

+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    metadata:
+      name: pvc-blob2


don't need this, just use existing pvc-blob-csi-static.yaml under example dir

andyzhangx · 2024-07-11T06:49:13Z

deploy/example/mountstorage/README.md

+    apiVersion: v1
+    kind: PersistentVolume
+    metadata:
+      name: pv-blob2


just use pv-blobfuse-csi, then you could reuse existing pvc-blob-csi-static.yaml

andyzhangx · 2024-07-12T02:16:27Z

deploy/example/blobfuse-mi/README.md

+      storageAccount: EXISTING_STORAGE_ACCOUNT_NAME # optional, if use existing storage account
+      containerName: EXISTING_CONTAINER_NAME # optional, if use existing container
+      AzureStorageAuthType: MSI
+      AzureStorageIdentityClientID: "xxxxx-xxxx-xxx-xxx-xxxxxxx"


how is this AzureStorageIdentityClientID generated? I think you need to add get ClientID into Before you begin section?

k8s-ci-robot · 2024-07-12T03:47:50Z

@umagnus: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-blob-csi-driver-e2e	`9fd13fe`	link	true	`/test pull-blob-csi-driver-e2e`
pull-blob-csi-driver-e2e-proxy	`9fd13fe`	link	true	`/test pull-blob-csi-driver-e2e-proxy`
pull-blob-csi-driver-external-e2e-nfs	`9fd13fe`	link	true	`/test pull-blob-csi-driver-external-e2e-nfs`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

umagnus · 2024-07-12T06:50:31Z

/retest

andyzhangx

/lgtm

k8s-ci-robot · 2024-07-12T07:05:41Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: andyzhangx, umagnus

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [andyzhangx]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added kind/documentation Categorizes issue or PR as related to documentation. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jul 10, 2024

k8s-ci-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Jul 10, 2024

k8s-ci-robot requested review from andyzhangx and cvvz July 10, 2024 07:48

umagnus force-pushed the mount_blob_mi branch from 789cd55 to d44ea2e Compare July 10, 2024 07:56

andyzhangx reviewed Jul 10, 2024

View reviewed changes

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jul 10, 2024

andyzhangx reviewed Jul 11, 2024

View reviewed changes

umagnus force-pushed the mount_blob_mi branch from 77ae8c5 to 2e2b040 Compare July 11, 2024 02:40

andyzhangx reviewed Jul 11, 2024

View reviewed changes

umagnus force-pushed the mount_blob_mi branch from 7b67d1b to 420069e Compare July 11, 2024 08:00

andyzhangx changed the title ~~doc: add mount azure blob storage doc~~ doc: add blobfuse mount with managed identity doc Jul 11, 2024

andyzhangx reviewed Jul 12, 2024

View reviewed changes

add mount storage doc

9fd13fe

umagnus force-pushed the mount_blob_mi branch from 420069e to 9fd13fe Compare July 12, 2024 03:04

andyzhangx approved these changes Jul 12, 2024

View reviewed changes

k8s-ci-robot assigned andyzhangx Jul 12, 2024

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 12, 2024

andyzhangx merged commit b328703 into kubernetes-sigs:master Jul 12, 2024
18 of 22 checks passed

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 12, 2024


		1. Now you can use the persistent volume claim ``pv-blob2`` in another deployment.

		# Security consideration

	image: mcr.microsoft.com/oss/nginx/nginx:1.17.3-alpine
	command:
	- "/bin/sh"
	- "-c"
	- while true; do echo $(date) >> /mnt/blob/outfile; sleep 1; done

doc: add blobfuse mount with managed identity doc #1464

doc: add blobfuse mount with managed identity doc #1464

Uh oh!

Conversation

umagnus commented Jul 10, 2024

Uh oh!

k8s-ci-robot commented Jul 10, 2024

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

andyzhangx left a comment

Choose a reason for hiding this comment

Uh oh!

andyzhangx left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

umagnus commented Jul 11, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

k8s-ci-robot commented Jul 12, 2024

Uh oh!

umagnus commented Jul 12, 2024

Uh oh!

andyzhangx left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

k8s-ci-robot commented Jul 12, 2024

Uh oh!

Uh oh!