Skip to content

OSDOCS-13459#Add cross-subscription support for Azure File #92108

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

OSDOCS-13459#Add cross-subscription support for Azure File #92108

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
86 changes: 86 additions & 0 deletions ...storage-csi-azure-file-cross-sub-dynamic-pre-provisioning-pv-pvc-procedure.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,86 @@
// Module included in the following assemblies:
//
// * storage/container_storage_interface/persistent_storage-csi-azure-file.adoc
//
:_mod-docs-content-type: PROCEDURE
[id="persistent-storage-csi-azure-file-cross-sub-dynamic-pre-provisioning-pv-pvc-procedure_{context}"]
= Pre-provisioning across subscriptions for Azure File by creating a PV and PVC:

.Prerequisites
* Installed Azure cluster with the service principal or managed identity as Azure identity

* Access to another subscription in the tenant with the cluster

* Logged in to the Azure CLI

.Procedure
. For the desired existing Azure File share, record the resource group, storage account, storage account key, and Azure File name. These values are used for the next steps.

. Create a secret for the persistent volume parameter `spec.csi.nodeStageSecretRef.name` by running the following command:
+
[source, terminal]
----
$ oc create secret generic azure-storage-account-{storageaccount-name}-secret --from-literal=azurestorageaccountname="<azure-storage-account-name>" --from-literal azurestorageaccountkey="<azure-storage-account-key>" --type=Opaque <1>
----
<1> Where `<azure-storage-account-name>` and `<azure-storage-account-key>` are the Azure storage account name and key respectively that you recorded in Step 1.

. Create a persistent volume (PV) using a similar configuration to the following example file:
+
.Example PV YAML file
[source, terminal]
Comment on lines +29 to +30
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
.Example PV YAML file
[source, terminal]
.Example PV YAML file
[source,yaml]

----
apiVersion: v1
kind: PersistentVolume
metadata:
annotations:
pv.kubernetes.io/provisioned-by: file.csi.azure.com
name: <pv-name> <1>
spec:
capacity:
storage: 10Gi <2>
accessModes:
- ReadWriteMany
persistentVolumeReclaimPolicy: Retain
storageClassName: azurefile-csi-manual
mountOptions:
- cache=strict
- nosharesock
- actimeo=30
- nobrl
csi:
driver: file.csi.azure.com
volumeHandle: "{resource-group-name}#{storage-account-name}#{file-share-name}" <3>
volumeAttributes:
shareName: <existing-file-share-name> <4>
nodeStageSecretRef:
name: <secret-name> <5>
namespace: <secret-namespace> <6>
----
<1> <pv-name> is the PV name.
<2> The size of the PV.
<3> Ensure that `volumeHandle` is unique for every identical share in the cluster.
<4> For `<existing-file-share-name>, use only the file share name and not the full path.
<5> <secret-name> is the secret name created in the previous step.
<6> <secret-namespace> is the namespace where the secret resides.

. Create a persistent value claim (PVC) specifying the existing Azure File share referenced in Step 1 using a similar configuration to the following:
+
.Example PVC YAML file
[source, yaml]
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure the space is needed, or does anything.

Suggested change
[source, yaml]
[source,yaml]

----
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: <pvc-name> <1>
spec:
storageClassName: <sc-name-cross-sub> <2>
accessModes:
- ReadWriteMany
resources:
requests:
storage: 5Gi
----
<1> `<pvc-name>` is the name of the PVC.
<2> `<sc-name-cross-sub>` is the name of the storage class.


106 changes: 106 additions & 0 deletions ...persistent-storage-csi-azure-file-cross-sub-dynamic-provisioning-procedure.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,106 @@
// Module included in the following assemblies:
//
// * storage/container_storage_interface/persistent_storage-csi-azure-file.adoc
//
:_mod-docs-content-type: PROCEDURE
[id="persistent-storage-csi-azure-file-cross-sub-dynamic-provisioning-procedure_{context}"]
= Dynamic provisioning across subscriptions for Azure File

.Prerequisites
* Installed Azure cluster with the service principal or managed identity as Azure identity

* Access to another subscription in the tenant with the cluster

* Logged in to the Azure CLI

.Procedure
To use Azure File dynamic provisioning across subscriptions:

. Record the Azure identity (service principal or managed identity) by running the following applicable commands. The Azure identity is needed in the next step:
+
* If using the _service principal_ as Azure identity when installing the cluster:
+
[source,terminal]
====
$ sp_id=$(oc -n openshift-cluster-csi-drivers get secret azure-file-credentials -o jsonpath='{.data.azure_client_id}' | base64 --decode)

$ az ad sp show --id ${sp_id} --query displayName --output tsv
====
Comment on lines +23 to +28
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
[source,terminal]
====
$ sp_id=$(oc -n openshift-cluster-csi-drivers get secret azure-file-credentials -o jsonpath='{.data.azure_client_id}' | base64 --decode)
$ az ad sp show --id ${sp_id} --query displayName --output tsv
====
[source,terminal]
----
$ sp_id=$(oc -n openshift-cluster-csi-drivers get secret azure-file-credentials -o jsonpath='{.data.azure_client_id}' | base64 --decode)
$ az ad sp show --id ${sp_id} --query displayName --output tsv
----

+
* If using the _managed identity_ as Azure identity when installing the cluster:
+
[source,terminal]
====
$ mi_id=$(oc -n openshift-cluster-csi-drivers get secret azure-file-credentials -o jsonpath='{.data.azure_client_id}' | base64 --decode)

$ az identity list --query "[?clientId=='${mi_id}'].{Name:name}" --output tsv
====
Comment on lines +32 to +37
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
[source,terminal]
====
$ mi_id=$(oc -n openshift-cluster-csi-drivers get secret azure-file-credentials -o jsonpath='{.data.azure_client_id}' | base64 --decode)
$ az identity list --query "[?clientId=='${mi_id}'].{Name:name}" --output tsv
====
[source,terminal]
----
$ mi_id=$(oc -n openshift-cluster-csi-drivers get secret azure-file-credentials -o jsonpath='{.data.azure_client_id}' | base64 --decode)
$ az identity list --query "[?clientId=='${mi_id}'].{Name:name}" --output tsv
----


. Obtain the Azure identity (service principal or managed identity) permission to access the resource group in another subscription where you want to provision the Azure File share:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need (service principal or managed identity) here, as it is in the prereqs?

Suggested change
. Obtain the Azure identity (service principal or managed identity) permission to access the resource group in another subscription where you want to provision the Azure File share:
. Record the Azure identity by running the following applicable commands. The Azure identity is needed in the next step:


.. Log in to the Azure portal and on the left-hand menu, click *Resource groups*.

.. Choose the resource group to which you want to assign a role by clicking *resource group* > *Access control (IAM)* > *Role assignments* tab to view current assignments, and then click *Add* > *Add role assignment*.

.. On the *Role* tab, choose the contributor role to assign, and then click *Next*. You can also create and choose your own role with required permission.

.. On the *Members* tab, choose an assignee by selecting the type of assignee: “User, group, or service principal” (Or “Managed identity”), click *Select members*, search for and then select the desired service principal or managed identity, and then click *Select* to confirm.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Substeps?

Suggested change
.. On the *Members* tab, choose an assignee by selecting the type of assignee: “User, group, or service principal” (Or “Managed identity”), click *Select members*, search for and then select the desired service principal or managed identity, and then click *Select* to confirm.
.. On the *Members* tab:
... Choose an assignee by selecting the type of assignee: “User, group, or service principal” (Or “Managed identity”).
... Click *Select members*.
... Search for and then select the desired service principal or managed identity.
... Click *Select* to confirm.

Copy link
Contributor

@mburke5678 mburke5678 Apr 11, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure what this means; maybe it is clearer in the UI

“User, group, or service principal” (Or “Managed identity”)

Maybe??

Suggested change
.. On the *Members* tab, choose an assignee by selecting the type of assignee: “User, group, or service principal” (Or “Managed identity”), click *Select members*, search for and then select the desired service principal or managed identity, and then click *Select* to confirm.
.. On the *Members* tab, choose an assignee by selecting the type of assignee: "User, group, or service principal" or "User, group, or Managed identity", click *Select members*, search for and then select the desired service principal or managed identity, and then click *Select* to confirm.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also, should this be in mark up as UI elements?

Suggested change
.. On the *Members* tab, choose an assignee by selecting the type of assignee: “User, group, or service principal” (Or “Managed identity”), click *Select members*, search for and then select the desired service principal or managed identity, and then click *Select* to confirm.
.. On the *Members* tab, choose an assignee by selecting the type of assignee: *User, group, or service principal* (Or *Managed identity*), click *Select members*, search for and then select the desired service principal or managed identity, and then click *Select* to confirm.


.. On the *Review + assign* tab, review the settings.

.. To finish the role assignment, click *Review + assign*.
+
[NOTE]
====
If you just want to use a specific storage account to provision the Azure File share, you can also obtain the Azure identity (service principal or managed identity) permission to access the storage account only with the similar steps.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Per ISG: Do not use just to mean only; use only instead. (Or nothing!).
I guessed on the phrasing at the end. It seemed to read only with the similar steps, rather than the storage account only, which I think is the case.

Suggested change
If you just want to use a specific storage account to provision the Azure File share, you can also obtain the Azure identity (service principal or managed identity) permission to access the storage account only with the similar steps.
If you want to use a specific storage account to provision the Azure File share, you can also obtain the Azure identity (service principal or managed identity) permission to access only the storage account by using similar steps.

====

. Create an Azure File storage class using a similar configuration to the following:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
. Create an Azure File storage class using a similar configuration to the following:
. Create an Azure File storage class by using a similar configuration to the following:

+
.Example Azure File storage class YAML file
[source, yaml]
----
allowVolumeExpansion: true
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: <sc-name-cross-sub> <1>
mount options:
- mfsymlinks
- cache=strict
- nosharesock
- actimeo=30
parameters:
subscriptionID: <xxxx-xxxx-xxxx-xxxx-xxxx> <2>
resourceGroup: <resource group name> <3>
storageAccount: <storage account> <4>
skuName: <skuName> <5>
provisioner: file.csi.azure.com
reclaimPolicy: Delete
volumeBindingMode: Immediate
----
<1> Name of the storage class
<2> The cross account subscription ID
<3> The resource group name in cross account subscription
<4> Storage account name, if you want to specify your own
<5> Name of the SKU type
Comment on lines +85 to +86
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To be consistent?

Suggested change
<4> Storage account name, if you want to specify your own
<5> Name of the SKU type
<4> The storage account name, if you want to specify your own
<5> The name of the SKU type


. Create a persistent volume claim (PVC) specifying the Azure File storage class that you created in the previous step using a similar configuration to the following:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe a little clearer?

Suggested change
. Create a persistent volume claim (PVC) specifying the Azure File storage class that you created in the previous step using a similar configuration to the following:
. Create a persistent volume claim (PVC) that specifies the Azure File storage class you created in the previous step by using a similar configuration to the following:

+
.Example PVC YAML file
[source, yaml]
----
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: <pvc-name> <1>
spec:
storageClassName: <sc-name-cross-sub> <2>
accessModes:
- ReadWriteMany
resources:
requests:
storage: 5Gi
----
<1> `<pvc-name>` is the name of the PVC.
<2> `<sc-name-cross-sub>` is the name of the storage class that you created in the previous step.
Comment on lines +105 to +106
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need the variables in the call-outs?

Suggested change
<1> `<pvc-name>` is the name of the PVC.
<2> `<sc-name-cross-sub>` is the name of the storage class that you created in the previous step.
<1> The name of the PVC.
<2> The name of the storage class that you created in the previous step.

15 changes: 15 additions & 0 deletions modules/persistent-storage-csi-azure-file-cross-sub-overview.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
// Module included in the following assemblies:
//
// * storage/container_storage_interface/persistent_storage-csi-azure-file.adoc
//

:_mod-docs-content-type: CONCEPT
[id="persistent-storage-csi-azure-file-cross-sub-overview_{context}"]
= Azure File cross-subscription support

Cross-subscription support allows you to have an {product-title} cluster in one Azure subscription and mount your Azure file share in another Azure subscription using the Azure File Container Storage Interface (CSI) driver.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

??

Suggested change
Cross-subscription support allows you to have an {product-title} cluster in one Azure subscription and mount your Azure file share in another Azure subscription using the Azure File Container Storage Interface (CSI) driver.
Cross-subscription support allows you to have an {product-title} cluster in one Azure subscription and mount your Azure file share in another Azure subscription by using the Azure File Container Storage Interface (CSI) driver.


[IMPORTANT]
====
Both the {product-title} cluster and the Azure File share (pre-provisioning or to be provisioned) should be inside the same tenant.
====
8 changes: 7 additions & 1 deletion storage/container_storage_interface/persistent-storage-csi-azure-file.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,9 +25,15 @@ Azure File CSI Driver Operator does _not_ support:

For more information about supported features, see xref:../../storage/container_storage_interface/persistent-storage-csi.adoc#csi-drivers-supported_persistent-storage-csi[Supported CSI drivers and features].

include::modules/persistent-storage-csi-about.adoc[leveloffset=+1]

include::modules/persistent-storage-csi-azure-file-nfs.adoc[leveloffset=+1]

include::modules/persistent-storage-csi-about.adoc[leveloffset=+1]
include::modules/persistent-storage-csi-azure-file-cross-sub-overview.adoc[leveloffset=+1]

include::modules/persistent-storage-csi-azure-file-cross-sub-dynamic-provisioning-procedure.adoc[leveloffset=+2]

include::modules/persistent-storage-csi-azure-file-cross-sub-dynamic-pre-provisioning-pv-pvc-procedure.adoc[leveloffset=+2]

[role="_additional-resources"]
.Additional resources
Expand Down