k8s | NFS Provisoner for StorageClass

전제조건

• NFS 서버 준비

참고 템플릿

초기 셋팅

vi init-nfs.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: nfs-pod-provisioner-sa
  labels:
    name: provision

---
kind: ClusterRole # Role of kubernetes
apiVersion: rbac.authorization.k8s.io/v1 
metadata:
  name: nfs-provisioner-clusterRole
  labels:
    name: provision
rules:
  - apiGroups: [""] # rules on persistentvolumes
    resources: ["persistentvolumes"]
    verbs: ["get", "list", "watch", "create", "delete"]
  - apiGroups: [""]
    resources: ["persistentvolumeclaims"]
    verbs: ["get", "list", "watch", "update"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["storageclasses"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["create", "update", "patch"]
---

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: nfs-provisioner-rolebinding
  labels:
    name: provision
subjects:
  - kind: ServiceAccount
    name: nfs-pod-provisioner-sa
    namespace: default
roleRef: # binding cluster role to service account
  kind: ClusterRole
  name: nfs-provisioner-clusterRole # name defined in clusterRole
  apiGroup: rbac.authorization.k8s.io
---

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: nfs-pod-provisioner-otherRoles
  labels:
    name: provision
rules:
  - apiGroups: [""]
    resources: ["endpoints"]
    verbs: ["get", "list", "watch", "create", "update", "patch"]
---

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: nfs-pod-provisioner-otherRoles
  labels:
    name: provision
subjects:
  - kind: ServiceAccount
    name: nfs-pod-provisioner-sa # same as top of the file
    # replace with namespace where provisioner is deployed
    namespace: default
roleRef:
  kind: Role
  name: nfs-pod-provisioner-otherRoles
  apiGroup: rbac.authorization.k8s.io

프로비저너

vi dp-nfs.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nfs-pod-provisioner
  labels:
    name: provision
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nfs-pod-provisioner
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: nfs-pod-provisioner
    spec:
      serviceAccountName: nfs-pod-provisioner-sa
      containers:
        - name: nfs-client-provisioner
          image: k8s.gcr.io/sig-storage/nfs-subdir-external-provisioner:v4.0.2 # provisioner를 구성하는 image
          volumeMounts:
            - name: nfs-provisioner
              mountPath: /persistentvolumes
          env:
            - name: PROVISIONER_NAME                               
              value: k8s-sigs.io/nfs-subdir-external-provisioner   # SC에서 provisioner의 이름으로 사용
            - name: NFS_SERVER
              value: 192.168.45.100                                 # nfs 주소
            - name: NFS_PATH              
              value: /nfs/data                                 # nfs 연결 주소
      volumes:
        - name: nfs-provisioner
          nfs:
            server: 192.168.45.100
            path: /nfs/data

스토리지 클래스

vi sc-nfs.yaml

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: nfs-storageclass                                                   # pvc에서 사용할 SC Name
  annotations:
    storageclass.kubernetes.io/is-default-class: "true"
  labels:
    name: provision
provisioner: k8s-sigs.io/nfs-subdir-external-provisioner                   # provisioner에서 생성한 PROVISIONER_NAME
parameters:
  pathPattern: "${.PVC.namespace}/${.PVC.annotations.nfs.io/storage-path}" # waits for nfs.io/storage-path annotation, if not specified will accept as empty string.
  onDelete: delete
  archiveOnDelete: "false"