AKS CSI/Blob extension configuration with Managed Identity
az group create --name fusetest --location westeurope
az aks create -g fusetest -n fusetest --enable-managed-identity --node-count 1 --generate-ssh-keys
az feature register --name EnableBlobCSIDriver --namespace Microsoft.ContainerService
az provider register -n Microsoft.ContainerService
az aks update --enable-blob-driver -n fusetest -g fusetest
Check that the storage class for blob-driver is available with:
kubectl get sc
(make sure you have connection to right cluster i.e. (az aks get-credentials --name fusetest --resource-group fusetest --overwrite-existing
)
you should see azureblob-fuse-premium
in the response
az storage account create --name fusetest --resource-group fusetest --kind BlobStorage --access-tier hot
az storage container create --name fusecontainer --account-name fusetest --auth-mode login
Next find out the managed-identity of the kubelet-identity:
Note: This query does not work if you have assigned multiple identities. Then use the one you want
clusterid=$(az aks list --resource-group fusetest --query "[].{id:identityProfile.kubeletidentity.objectId}[0].id" --out tsv)
And the id of your blob-storage resource group
rgid=$(az group show -n fusetest --query "id" --out tsv)
add kubelet sp-id as Storage Blob Data Contributor to resource-group of the blob-storage
Note: Contributor does not work
az role assignment create --assignee $clusterid --role 'Storage Blob Data Contributor' --scope $rgid
Apply persistent-volume.yml
kubectl apply -f persistent-volume.yml
check that volume got created.
kubectl get pv
Apply persistent-volume-claim
kubectl apply -f persistent-volume-claim.yml
Check that it got created
kubectl get pvc
Install the test application (nginx)
kubectl apply -f deployment.yml
Check it works:
kubectl get pods
(wait until its done)
Thats it!
You should now see the mount with
kubectl exec -it nginx-blob -- df -h
If you need to add extra parameters to persistent-volume.yml volumeAttributes, you can find the docs here https://docs.microsoft.com/en-us/azure/aks/azure-csi-blob-storage-static?tabs=secret