|
| 1 | +// Module included in the following assemblies: |
| 2 | +// |
| 3 | +// * storage/container_storage_interface/persistent_storage-csi-azure-file.adoc |
| 4 | +// |
| 5 | +:_mod-docs-content-type: PROCEDURE |
| 6 | +[id="persistent-storage-csi-azure-file-cross-sub-dynamic-provisioning-procedure_{context}"] |
| 7 | += Dynamic provisioning across subscriptions for Azure File |
| 8 | + |
| 9 | +.Prerequisites |
| 10 | +* Installed Azure cluster with the service principal or managed identity as Azure identity |
| 11 | +
|
| 12 | +* Access to another subscription in the tenant with the cluster |
| 13 | +
|
| 14 | +* Logged in to the Azure CLI |
| 15 | +
|
| 16 | +.Procedure |
| 17 | +To use Azure File dynamic provisioning across subscriptions: |
| 18 | + |
| 19 | +. Record the Azure identity (service principal or managed identity) by running the following applicable commands. The Azure identity is needed in the next step: |
| 20 | ++ |
| 21 | +* If using the _service principal_ as Azure identity when installing the cluster: |
| 22 | ++ |
| 23 | +[source,terminal] |
| 24 | +==== |
| 25 | +$ sp_id=$(oc -n openshift-cluster-csi-drivers get secret azure-file-credentials -o jsonpath='{.data.azure_client_id}' | base64 --decode) |
| 26 | + |
| 27 | +$ az ad sp show --id ${sp_id} --query displayName --output tsv |
| 28 | +==== |
| 29 | ++ |
| 30 | +* If using the _managed identity_ as Azure identity when installing the cluster: |
| 31 | ++ |
| 32 | +[source,terminal] |
| 33 | +==== |
| 34 | +$ mi_id=$(oc -n openshift-cluster-csi-drivers get secret azure-file-credentials -o jsonpath='{.data.azure_client_id}' | base64 --decode) |
| 35 | +
|
| 36 | +$ az identity list --query "[?clientId=='${mi_id}'].{Name:name}" --output tsv |
| 37 | +==== |
| 38 | + |
| 39 | +. Obtain the Azure identity (service principal or managed identity) permission to access the resource group in another subscription where you want to provision the Azure File share: |
| 40 | + |
| 41 | +.. Log in to the Azure portal and on the left-hand menu, click *Resource groups*. |
| 42 | + |
| 43 | +.. Choose the resource group to which you want to assign a role by clicking *resource group* > *Access control (IAM)* > *Role assignments* tab to view current assignments, and then click *Add* > *Add role assignment*. |
| 44 | + |
| 45 | +.. On the *Role* tab, choose the contributor role to assign, and then click *Next*. You can also create and choose your own role with required permission. |
| 46 | + |
| 47 | +.. On the *Members* tab, choose an assignee by selecting the type of assignee: “User, group, or service principal” (Or “Managed identity”), click *Select members*, search for and then select the desired service principal or managed identity, and then click *Select* to confirm. |
| 48 | + |
| 49 | +.. On the *Review + assign* tab, review the settings. |
| 50 | + |
| 51 | +.. To finish the role assignment, click *Review + assign*. |
| 52 | ++ |
| 53 | +[NOTE] |
| 54 | +==== |
| 55 | +If you just want to use a specific storage account to provision the Azure File share, you can also obtain the Azure identity (service principal or managed identity) permission to access the storage account only with the similar steps. |
| 56 | +==== |
| 57 | + |
| 58 | +. Create an Azure File storage class using a similar configuration to the following: |
| 59 | ++ |
| 60 | +.Example Azure File storage class YAML file |
| 61 | +[source, yaml] |
| 62 | +---- |
| 63 | +allowVolumeExpansion: true |
| 64 | +apiVersion: storage.k8s.io/v1 |
| 65 | +kind: StorageClass |
| 66 | +metadata: |
| 67 | + name: <sc-name-cross-sub> <1> |
| 68 | +mount options: |
| 69 | + - mfsymlinks |
| 70 | + - cache=strict |
| 71 | + - nosharesock |
| 72 | + - actimeo=30 |
| 73 | +parameters: |
| 74 | + subscriptionID: <xxxx-xxxx-xxxx-xxxx-xxxx> <2> |
| 75 | + resourceGroup: <resource group name> <3> |
| 76 | + storageAccount: <storage account> <4> |
| 77 | + skuName: <skuName> <5> |
| 78 | +provisioner: file.csi.azure.com |
| 79 | +reclaimPolicy: Delete |
| 80 | +volumeBindingMode: Immediate |
| 81 | +---- |
| 82 | +<1> Name of the storage class |
| 83 | +<2> The cross account subscription ID |
| 84 | +<3> The resource group name in cross account subscription |
| 85 | +<4> Storage account name, if you want to specify your own |
| 86 | +<5> Name of the SKU type |
| 87 | + |
| 88 | +. Create a persistent volume claim (PVC) specifying the Azure File storage class that you created in the previous step using a similar configuration to the following: |
| 89 | ++ |
| 90 | +.Example PVC YAML file |
| 91 | +[source, yaml] |
| 92 | +---- |
| 93 | +apiVersion: v1 |
| 94 | +kind: PersistentVolumeClaim |
| 95 | +metadata: |
| 96 | + name: <pvc-name> <1> |
| 97 | +spec: |
| 98 | + storageClassName: <sc-name-cross-sub> <2> |
| 99 | + accessModes: |
| 100 | + - ReadWriteMany |
| 101 | + resources: |
| 102 | + requests: |
| 103 | + storage: 5Gi |
| 104 | +---- |
| 105 | +<1> `<pvc-name>` is the name of the PVC. |
| 106 | +<2> `<sc-name-cross-sub>` is the name of the storage class that you created in the previous step. |
0 commit comments