kubernetes使用ceph rbd存储

1.###创建ceph osd pool及用户

ceph osd pool create kube 128 128  ---创建pool

ceph auth add client.kube mon 'allow r' osd 'allow rwx pool=kube' ---创建ceph用户及此用户使用pool权限

2.查看创建用户key

ceph auth get-key client.kube

AQDLxchefwj8EBAAOKAvZ89yVVyZWtlquYCKIA==         ---userkey值

3.创建用户secret

vi csi-rbd-secret.yaml

apiVersion: v1

kind: Secret

metadata:

  name: csi-rbd-secret

  namespace: default

stringData:

  userID: kube

  userKey: AQDLxchefwj8EBAAOKAvZ89yVVyZWtlquYCKIA==

type: kubernetes.io/rbd

4.配置ceph集群信息

vi csi-config-map.yaml

apiVersion: v1

kind: ConfigMap

data:

  config.json: |-

    [

      {

        "clusterID": "36cde7de-ec26-4c3d-b765-e8f2858f66ec",   ---ceph集群ID：ceph -s

        "monitors": [

          "192.168.1.8:6789"    --mon所在主机列表

        ]

      }

    ]

metadata:

  name: ceph-csi-config

5.创建rbac权限

vi csi-nodeplugin-rbac.yaml

apiVersion: v1

kind: ServiceAccount

metadata:

  name: rbd-csi-nodeplugin

  namespace: default

vi  csi-provisioner-rbac.yaml

---

apiVersion: v1

kind: ServiceAccount

metadata:

  name: rbd-csi-provisioner

  namespace: default

---

kind: ClusterRole

apiVersion: rbac.authorization.k8s.io/v1

metadata:

  name: rbd-external-provisioner-runner

aggregationRule:

  clusterRoleSelectors:

    - matchLabels:

        rbac.rbd.csi.ceph.com/aggregate-to-rbd-external-provisioner-runner: "true"

rules: []

---

kind: ClusterRole

apiVersion: rbac.authorization.k8s.io/v1

metadata:

  name: rbd-external-provisioner-runner-rules

  labels:

    rbac.rbd.csi.ceph.com/aggregate-to-rbd-external-provisioner-runner: "true"

rules:

  - apiGroups: [""]

    resources: ["secrets"]

    verbs: ["get", "list"]

  - apiGroups: [""]

    resources: ["events"]

    verbs: ["list", "watch", "create", "update", "patch"]

  - apiGroups: [""]

    resources: ["persistentvolumes"]

    verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]

  - apiGroups: [""]

    resources: ["persistentvolumeclaims"]

    verbs: ["get", "list", "watch", "update"]

  - apiGroups: ["storage.k8s.io"]

    resources: ["storageclasses"]

    verbs: ["get", "list", "watch"]

  - apiGroups: ["snapshot.storage.k8s.io"]

    resources: ["volumesnapshots"]

    verbs: ["get", "list", "watch", "update"]

  - apiGroups: ["snapshot.storage.k8s.io"]

    resources: ["volumesnapshotcontents"]

    verbs: ["create", "get", "list", "watch", "update", "delete"]

  - apiGroups: ["snapshot.storage.k8s.io"]

    resources: ["volumesnapshotclasses"]

    verbs: ["get", "list", "watch"]

  - apiGroups: ["apiextensions.k8s.io"]

    resources: ["customresourcedefinitions"]

    verbs: ["create", "list", "watch", "delete", "get", "update"]

  - apiGroups: ["storage.k8s.io"]

    resources: ["volumeattachments"]

    verbs: ["get", "list", "watch", "update", "patch"]

  - apiGroups: ["snapshot.storage.k8s.io"]

    resources: ["volumesnapshots/status"]

    verbs: ["update"]

  - apiGroups: [""]

    resources: ["persistentvolumeclaims/status"]

    verbs: ["update", "patch"]

---

kind: ClusterRoleBinding

apiVersion: rbac.authorization.k8s.io/v1

metadata:

  name: rbd-csi-provisioner-role

subjects:

  - kind: ServiceAccount