Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: enable support for single AP per SC #1

Open
wants to merge 14 commits into
base: master
Choose a base branch
from
Open

feat: enable support for single AP per SC #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
31d4da2
Adds subPathPattern to compliment basePath
jonathanrainer Oct 18, 2021
6fee80a
Adding functions to interpolate names from template
jonathanrainer Oct 18, 2021
bc4c463
Updates testing
jonathanrainer Oct 18, 2021
e62c49c
Updating documentation and examples
jonathanrainer Oct 18, 2021
99f2f87
Removes 0-length check to allow setting "/" as access point directory
jonathanrainer Dec 7, 2021
24a20a2
Adding ensureUniqueDirectory
jonathanrainer Jun 25, 2022
dff2a2b
Adding negative test cases and fixing as appropriate
jonathanrainer Feb 23, 2022
a0cffd9
Updating README or dynamic provisioning example
jonathanrainer Feb 23, 2022
29c21fa
Running go mod tidy properly
jonathanrainer Jun 25, 2022
04c5521
Fixing small typo
jonathanrainer Apr 27, 2022
b7c3a7f
Adding errant dot
jonathanrainer Jun 1, 2022
5856780
Adding extra test case to cover the basePath = '/' case
jonathanrainer Jun 15, 2022
cbf8129
feat: enable support for single AP per SC
portellaa Sep 15, 2022
478d973
Merge branch 'master' into single-ap
portellaa Sep 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions charts/aws-efs-csi-driver/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,11 +132,14 @@ storageClasses: []
# mountOptions:
# - tls
# parameters:
# accessPointID: fsap-0024a40ac730a6cc8
# provisioningMode: efs-ap
# fileSystemId: fs-1122aabb
# directoryPerms: "700"
# gidRangeStart: "1000"
# gidRangeEnd: "2000"
# basePath: "/dynamic_provisioning"
# subPathPattern: "/subPath"
# ensureUniqueDirectory: true
# reclaimPolicy: Delete
# volumeBindingMode: Immediate
27 changes: 15 additions & 12 deletions docs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
[![Build Status](https://travis-ci.org/kubernetes-sigs/aws-efs-csi-driver.svg?branch=master)](https://travis-ci.org/kubernetes-sigs/aws-efs-csi-driver)
[![Build Status](https://travis-ci.org/kubernetes-sigs/aws-efs-csi-driver.svg?branch=master)](https://travis-ci.org/kubernetes-sigs/aws-efs-csi-driver)
[![Coverage Status](https://coveralls.io/repos/github/kubernetes-sigs/aws-efs-csi-driver/badge.svg?branch=master)](https://coveralls.io/github/kubernetes-sigs/aws-efs-csi-driver?branch=master)
[![Go Report Card](https://goreportcard.com/badge/github.com/kubernetes-sigs/aws-efs-csi-driver)](https://goreportcard.com/report/github.com/kubernetes-sigs/aws-efs-csi-driver)

Expand Down Expand Up @@ -26,17 +27,19 @@ The following CSI interfaces are implemented:
* Identity Service: GetPluginInfo, GetPluginCapabilities, Probe

### Storage Class Parameters for Dynamic Provisioning
| Parameters | Values | Default | Optional | Description |
|---------------------|--------|---------|-----------|-------------|
| provisioningMode | efs-ap | | false | Type of volume provisioned by efs. Currently, Access Points are supported. |
| fileSystemId | | | false | File System under which access points are created. |
| directoryPerms | | | false | Directory permissions for [Access Point root directory](https://docs.aws.amazon.com/efs/latest/ug/efs-access-points.html#enforce-root-directory-access-point) creation. |
| uid | | | true | POSIX user Id to be applied for [Access Point root directory](https://docs.aws.amazon.com/efs/latest/ug/efs-access-points.html#enforce-root-directory-access-point) creation and for [user identity enforcement](https://docs.aws.amazon.com/efs/latest/ug/efs-access-points.html#enforce-identity-access-points). |
| gid | | | true | POSIX group Id to be applied for [Access Point root directory](https://docs.aws.amazon.com/efs/latest/ug/efs-access-points.html#enforce-root-directory-access-point) creation and for [user identity enforcement](https://docs.aws.amazon.com/efs/latest/ug/efs-access-points.html#enforce-identity-access-points). |
| gidRangeStart | | 50000 | true | Start range of the POSIX group Id to be applied for [Access Point root directory](https://docs.aws.amazon.com/efs/latest/ug/efs-access-points.html#enforce-root-directory-access-point) creation and for [user identity enforcement](https://docs.aws.amazon.com/efs/latest/ug/efs-access-points.html#enforce-identity-access-points). Not used if uid/gid is set. For user identity enforcement, this value will be applied as both the uid and the gid. |
| gidRangeEnd | | 7000000 | true | End range of the POSIX group Id. Not used if uid/gid is set. |
| basePath | | | true | Path under which access points for dynamic provisioning is created. If this parameter is not specified, access points are created under the root directory of the file system |
| az | | "" | true | Used for cross-account mount. `az` under storage class parameter is optional. If specified, mount target associated with the az will be used for cross-account mount. If not specified, a random mount target will be picked for cross account mount |
| Parameters | Values | Default | Optional | Description |
|-----------------------|--------|-----------------|----------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| provisioningMode | efs-ap | | false | Type of volume provisioned by efs. Currently, Access Points are supported. |
| fileSystemId | | | false | File System under which access points are created. |
| directoryPerms | | | false | Directory permissions for [Access Point root directory](https://docs.aws.amazon.com/efs/latest/ug/efs-access-points.html#enforce-root-directory-access-point) creation. |
| uid | | | true | POSIX user Id to be applied for [Access Point root directory](https://docs.aws.amazon.com/efs/latest/ug/efs-access-points.html#enforce-root-directory-access-point) creation. |
| gid | | | true | POSIX group Id to be applied for [Access Point root directory](https://docs.aws.amazon.com/efs/latest/ug/efs-access-points.html#enforce-root-directory-access-point) creation. |
| gidRangeStart | | 50000 | true | Start range of the POSIX group Id to be applied for [Access Point root directory](https://docs.aws.amazon.com/efs/latest/ug/efs-access-points.html#enforce-root-directory-access-point) creation. Not used if uid/gid is set. |
| gidRangeEnd | | 7000000 | true | End range of the POSIX group Id. Not used if uid/gid is set. |
| basePath | | | true | Path under which access points for dynamic provisioning is created. If this parameter is not specified, access points are created under the root directory of the file system |
| subPathPattern | | `/${.PV.name}` | true | The template used to construct the subPath under which each of the access points created under Dynamic Provisioning. Can be made up of fixed strings and limited variables, is akin to the 'subPathPattern' variable on the [nfs-subdir-external-provisioner](https://github.com/kubernetes-sigs/nfs-subdir-external-provisioner) chart. Supports `.PVC.name`,`.PVC.namespace` and `.PV.name` |
| ensureUniqueDirectory | | true | true | **NOTE: Only set this to false if you're sure this is the behaviour you want**.<br/> Used when dynamic provisioning is enabled, if set to true, appends a UUID to the pattern specified in `subPathPattern` to ensure that access points will not accidentally point at the same directory. |
| az | | "" | true | Used for cross-account mount. `az` under storage class parameter is optional. If specified, mount target associated with the az will be used for cross-account mount. If not specified, a random mount target will be picked for cross account mount |

**Notes**:
* Custom Posix group Id range for Access Point root directory must include both `gidRangeStart` and `gidRangeEnd` parameters. These parameters are optional only if both are omitted. If you specify one, the other becomes mandatory.
Expand Down Expand Up @@ -105,7 +108,7 @@ The following sections are Kubernetes specific. If you are a Kubernetes user, us
### Installation
#### Set up driver permission:
The driver requires IAM permission to talk to Amazon EFS to manage the volume on user's behalf. There are several methods to grant driver IAM permission:
* Using IAM Role for Service Account (Recommended if you're using EKS): create an [IAM Role for service accounts](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) with the [required permissions](./iam-policy-example.json). Uncomment annotations and put the IAM role ARN in [service-account manifest](../deploy/kubernetes/base/serviceaccount-csi-controller.yaml)
* Using IAM Role for Service Account (Recommended if you're using EKS): create an [IAM Role for service accounts](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) with the [required permissions](./iam-policy-example.json). Uncomment annotations and put the IAM role ARN in [service-account manifest](../deploy/kubernetes/base/controller-serviceaccount.yaml)
* Using IAM [instance profile](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html) - grant all the worker nodes with [required permissions](./iam-policy-example.json) by attaching policy to the instance profile of the worker.

#### Deploy the driver:
Expand Down
1 change: 1 addition & 0 deletions examples/kubernetes/cross_account_mount/specs/storageclass.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ metadata:
name: efs-sc
provisioner: efs.csi.aws.com
parameters:
accessPointID: fsap-0024a40ac730a6cc8 # optional
provisioningMode: efs-ap
fileSystemId: fs-92107410
directoryPerms: "700"
Expand Down
12 changes: 11 additions & 1 deletion examples/kubernetes/dynamic_provisioning/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,13 +20,23 @@ parameters:
gidRangeStart: "1000"
gidRangeEnd: "2000"
basePath: "/dynamic_provisioning"
subPathPattern: "${.PVC.namespace}/${.PVC.name}"
ensureUniqueDirectories: true
```
* provisioningMode - The type of volume to be provisioned by efs. Currently, only access point based provisioning is supported `efs-ap`.
* fileSystemId - The file system under which Access Point is created.
* directoryPerms - Directory Permissions of the root directory created by Access Point.
* gidRangeStart (Optional) - Starting range of Posix Group ID to be applied onto the root directory of the access point. Default value is 50000.
* gidRangeEnd (Optional) - Ending range of Posix Group ID. Default value is 7000000.
* basePath (Optional) - Path on the file system under which access point root directory is created. If path is not provided, access points root directory are created under the root of the file system.
* basePath (Optional) - Path on the file system under which access point root directory is created. If path is not
provided, access points root directory are created under the root of the file system.
* subPathPattern (Optional) - A pattern that describes the subPath under which an access point should be created. So in
the example given above if the PVC namespace is `foo` and the PVC name is `pvc-123-456` the access point would be
created at `/dynamic_provisioner/foo/pvc-123-456-<UUID>`. (The UUID being appended is due to ensureUniqueDirectories below)
* ensureUniqueDirectories (Optional) - A boolean that ensures that, if set, a UUID is appended to the final element of
any dynamically provisioned path, as in the above example. This can be turned off but this requires you as the
administrator to ensure that your storage classes are set up correctly. Otherwise, it's possible that 2 pods could
end up writing to the same directory by accident. **Please think very carefully before setting this to false!**

### Deploy the Example
Create storage class, persistent volume claim (PVC) and the pod which consumes PV:
Expand Down
5 changes: 4 additions & 1 deletion examples/kubernetes/dynamic_provisioning/specs/storageclass.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,12 @@ metadata:
name: efs-sc
provisioner: efs.csi.aws.com
parameters:
accessPointID: fsap-0024a40ac730a6cc8 # optional
provisioningMode: efs-ap
fileSystemId: fs-92107410
directoryPerms: "700"
gidRangeStart: "1000" # optional
gidRangeEnd: "2000" # optional
basePath: "/dynamic_provisioning" # optional
basePath: "/dynamic_provisioning" # optional
subPathPattern: "${.PVC.namespace}/${.PVC.name}" # optional
ensureUniqueDirectory: "true" # optional
Loading