コラム

接続環境セットアップ

[cloudshell-user@ip-10-134-76-71 ~]$ kubectl version
Client Version: v1.28.1-eks-43840fb
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
The connection to the server localhost:8080 was refused - did you specify the right host or port?

[cloudshell-user@ip-10-134-76-71 ~]$ kubectl config view
apiVersion: v1
clusters: null
contexts: null
current-context: ""
kind: Config
preferences: {}
users: null

aws eks update-kubeconfig --region us-west-2 --name mountpoint-s3-csi-test

kubectl config view

ノードグループ作成

バケット作成

[cloudshell-user@ip-10-134-76-71 ~]$ aws s3 mb s3://mountpoint-s3-csi-test-20240108
make_bucket: mountpoint-s3-csi-test-20240108

アドオン導入前提条件セットアップ

{
   "Version": "2012-10-17",
   "Statement": [
        {
            "Sid": "MountpointFullBucketAccess",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::mountpoint-s3-csi-test-20240108"
            ]
        },
        {
            "Sid": "MountpointFullObjectAccess",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:AbortMultipartUpload",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::mountpoint-s3-csi-test-20240108/*"
            ]
        }
   ]
}

EKSアドオンによるMountpoint for Amazon S3 CSI driver導入

[cloudshell-user@ip-10-134-76-71 ~]$ kubectl get pods -n kube-system
NAME                           READY   STATUS    RESTARTS   AGE
aws-node-4m5m9                 2/2     Running   0          45m
coredns-59754897cf-b6gxr       1/1     Running   0          59m
coredns-59754897cf-bshqq       1/1     Running   0          59m
eks-pod-identity-agent-dbnx5   1/1     Running   0          45m
kube-proxy-p6dv6               1/1     Running   0          45m
s3-csi-node-22r9p              3/3     Running   0          2m41s

[cloudshell-user@ip-10-134-76-71 ~]$ kubectl get pod -o yaml -n kube-system s3-csi-node-22r9p | grep -i serviceaccount:
  serviceAccount: s3-csi-driver-sa


[cloudshell-user@ip-10-134-76-71 ~]$ kubectl get sa -n kube-system s3-csi-driver-sa -o yaml | grep -i role-arn
    eks.amazonaws.com/role-arn: arn:aws:iam::<ACCOUNTID>:role/AmazonEKS_S3_CSI_DriverRole-20240108

サンプルアプリケーションのデプロイ

[cloudshell-user@ip-10-134-76-71 ~]$ wget https://raw.githubusercontent.com/awslabs/mountpoint-s3-csi-driver/main/examples/kubernetes/static_provisioning/non_root.yaml

[cloudshell-user@ip-10-134-76-71 ~]$ sdiff -s non_root.yaml non_root.yaml.org 
    - allow-delete                                            <
    - region us-west-2                                        <
      bucketName: mountpoint-s3-csi-test-20240108             |       bucketName: s3-csi-driver

[cloudshell-user@ip-10-134-76-71 ~]$ kubectl apply -f non_root.yaml
persistentvolume/s3-pv created
persistentvolumeclaim/s3-claim created
pod/s3-app created


[cloudshell-user@ip-10-134-76-71 ~]$ kubectl get pv,pvc,pod 
NAME                     CAPACITY   ACCESS MODES   RECLAIM POLICY   STATUS   CLAIM              STORAGECLASS   REASON   AGE
persistentvolume/s3-pv   1200Gi     RWX            Retain           Bound    default/s3-claim                           30s
 
NAME                             STATUS   VOLUME   CAPACITY   ACCESS MODES   STORAGECLASS   AGE
persistentvolumeclaim/s3-claim   Bound    s3-pv    1200Gi     RWX                           30s
 
NAME         READY   STATUS    RESTARTS   AGE
pod/s3-app   1/1     Running   0          30s

[cloudshell-user@ip-10-134-76-71 ~]$ kubectl exec -it s3-app -- bash
bash-4.4$ mount | grep s3
mountpoint-s3 on /data type fuse (rw,nosuid,nodev,noatime,user_id=0,group_id=0,default_permissions,allow_other)


bash-4.4$ cd /data/
bash-4.4$ ls
'Mon Jan  8 13:36:27 UTC 2024.txt'
bash-4.4$ cat 'Mon Jan  8 13:36:27 UTC 2024.txt' 
Hello from the container!
bash-4.4$ rm 'Mon Jan  8 13:36:27 UTC 2024.txt'
bash-4.4$ ls