Guto Carvalho # 2021-11-17 @ BSB
Guto Carvalho # 2021-11-17 @ BSB

DROPS: Usando EFS em um Cluster K8S EC2

by

Aprenda a usar o EFS Provisioner em um Cluster K8S EC2/RKE.


O que são drops?

São DUMPs mentais rápidos e rasteiros, simples e objetivos – que funcionam.

Geralmente de algo que eu acabei de fazer.

Eu – quase sempre – volto para detalhar mais cada passo.

Considere com a mesma qualidade de um rascunho ou uma anotação rápida.

De qualquer forma comenta ai qquer coisa, os comentários estão ligados nos DROPS ;)

Veio a Demanda!

A ideia é instalar um EFS Provisioner no cluster para poder subir APPS que montam o mesmo volume em diferentes PODs.

Então ComoFaz?

Crie o arquivo instala_efs_provisioner.yaml

vim aplica.yaml

Insira o conteúdo abaixo

---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: efs-provisioner-runner
rules:
  - apiGroups: [""]
    resources: ["persistentvolumes"]
    verbs: ["get", "list", "watch", "create", "delete"]
  - apiGroups: [""]
    resources: ["persistentvolumeclaims"]
    verbs: ["get", "list", "watch", "update"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["storageclasses"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["create", "update", "patch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: run-efs-provisioner
subjects:
  - kind: ServiceAccount
    name: efs-provisioner
    namespace: kube-system
roleRef:
  kind: ClusterRole
  name: efs-provisioner-runner
  apiGroup: rbac.authorization.k8s.io
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: leader-locking-efs-provisioner
rules:
  - apiGroups: [""]
    resources: ["endpoints"]
    verbs: ["get", "list", "watch", "create", "update", "patch"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: leader-locking-efs-provisioner
subjects:
  - kind: ServiceAccount
    name: efs-provisioner
    namespace: kube-system
roleRef:
  kind: Role
  name: leader-locking-efs-provisioner
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: efs-provisioner
---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: efs-provisioner
spec:
  replicas: 1
  selector:
    matchLabels:
      app: efs-provisioner
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: efs-provisioner
    spec:
      serviceAccount: efs-provisioner
      containers:
        - name: efs-provisioner
          image: quay.io/external_storage/efs-provisioner:latest
          env:
            - name: FILE_SYSTEM_ID
              valueFrom:
                configMapKeyRef:
                  name: efs-provisioner
                  key: file.system.id
            - name: AWS_REGION
              valueFrom:
                configMapKeyRef:
                  name: efs-provisioner
                  key: aws.region
            - name: DNS_NAME
              valueFrom:
                configMapKeyRef:
                  name: efs-provisioner
                  key: dns.name
                  optional: true
            - name: PROVISIONER_NAME
              valueFrom:
                configMapKeyRef:
                  name: efs-provisioner
                  key: provisioner.name
          volumeMounts:
            - name: pv-volume
              mountPath: /persistentvolumes
      volumes:
        - name: pv-volume
          nfs:
            server: fs-<ID DO SEU EFS>.efs.<REGIAO AWS>.amazonaws.com
            path: /
---
kind: StorageClass
apiVersion: storage.k8s.io/v1
metadata:
  name: aws-efs
provisioner: nativetrail.io/aws-efs
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: efs-provisioner
data:
  file.system.id: fs-<ID DO SEU EFS>
  aws.region: <REGIAO AWS>
  provisioner.name: nativetrail.io/aws-efs
  dns.name: ""

Ajuste o ID do seu EFS e região da AWS no manifesto acima, e prestenção, tem que o usar o namespace kube-system pois ele é especificado nas roles e serviceaccount, se instalar o deployment em outro namespace não vai funcionar.

kubectl apply -f instala_efs_provisioner.yaml -n kube-system
    

Pronto, vamos verificar

kubectl get sc

Saída esperada

NAME                PROVISIONER              RECLAIMPOLICY   VOLUMEBINDINGMODE   ALLOWVOLUMEEXPANSION   AGE
aws-efs             nativetrail.io/aws-efs   Delete          Immediate           false                  43m
aws-ebs (default)   ebs.csi.aws.com          Delete          Immediate           false                  3d16h

agora vamos testar, crie o manifesto valida-pod-efs.ym com o conteúdo abaixo

---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: valida-aws-efs
spec:
  accessModes:
    - ReadWriteMany
  storageClassName: aws-efs
  resources:
    requests:
      storage: 1Gi

aplique

kubectl apply -f pod-efs.yaml

saída

persistentvolumeclaim/valida-aws-efs created

vamos ver

kubectl get pvc valida-aws-efs

saída

NAME             STATUS   VOLUME                                     CAPACITY   ACCESS MODES   STORAGECLASS   AGE
valida-aws-efs   Bound    pvc-c524234f-4b07-4248-b328-c6c164dddbc2   1Gi        RWX            aws-efs        3m42s

agora com mais detalhes

kubectl describe pvc valida-aws-efs

saída

Name:          valida-aws-efs
Namespace:     default
StorageClass:  aws-efs
Status:        Bound
Volume:        pvc-c524234f-4b07-4248-b328-c6c164dddbc2
Labels:        <none>
Annotations:   pv.kubernetes.io/bind-completed: yes
               pv.kubernetes.io/bound-by-controller: yes
               volume.beta.kubernetes.io/storage-provisioner: nativetrail.io/aws-efs
Finalizers:    [kubernetes.io/pvc-protection]
Capacity:      1Gi
Access Modes:  RWX
VolumeMode:    Filesystem
Used By:       <none>
Events:
  Type    Reason                 Age                    From                                                                                   Message
  ----    ------                 ----                   ----                                                                                   -------
  Normal  Provisioning           3m49s                  nativetrail.io/aws-efs_efs-provisioner-644f9f8c8c-n6n48_be97e87c-7e5b-4b42-8756-2adb23a5a105  External provisioner is provisioning volume for claim "default/valida-aws-efs"
  Normal  ProvisioningSucceeded  3m49s                  nativetrail.io/aws-efs_efs-provisioner-644f9f8c8c-n6n48_be97e87c-7e5b-4b42-8756-2adb23a5a105  Successfully provisioned volume pvc-c524234f-4b07-4248-b328-c6c164dddbc2

Perfeito, tudo funcionando, agora é só usar!

:)

refs