Persistent storage using Cinder - Configuring persistent storage | Storage

Manual provisioning with Cinder

OKD supports OpenStack Cinder volumes. You can provision your OKD cluster with persistent storage using OpenStack Cinder. Some familiarity with Kubernetes and OpenStack is assumed.

Persistent volumes are not bound to a single project or namespace; they can be shared across the OKD cluster. Persistent volume claims are specific to a project or namespace and can be requested by users.

OKD 4.11 and later provides automatic migration for the Cinder in-tree volume plugin to its equivalent CSI driver.

CSI automatic migration should be seamless. Migration does not change how you use all existing API objects, such as persistent volumes, persistent volume claims, and storage classes. For more information about migration, see "CSI automatic migration".

Additional resources

Manual provisioning with Cinder

Storage must exist in the underlying infrastructure before it can be mounted as a volume in OKD.

Manual provisioning requires that OKD is configured for OpenStack and that you have the Cinder volume ID.

Creating the persistent volume

You can create a persistent volume (PV) that provisions storage from an OpenStack Cinder volume for use with OKD.

Prerequisites

You have defined your PV in an object definition before creating it in OKD.

Procedure

Save your object definition to a file.
cinder-persistentvolume.yaml
```
apiVersion: "v1"
kind: "PersistentVolume"
metadata:
  name: "pv0001"
spec:
  capacity:
    storage: "5Gi"
  accessModes:
    - "ReadWriteOnce"
  cinder:
    fsType: "ext3"
    volumeID: "f37a03aa-6212-4c62-a805-9ce139fab180"
```
where:

metadata.name

Specifies the name of the volume that is used by persistent volume claims or pods.

spec.capacity.storage

Specifies the amount of storage allocated to this volume.

spec.cinder

Indicates cinder for OpenStack Cinder volumes.

spec.cinder.fsType

Specifies the file system that is created when the volume is mounted for the first time.

spec.cinder.volumeID

Specifies the Cinder volume to use.

Do not change the fstype parameter value after the volume is formatted and provisioned. Changing this value can result in data loss and pod failure.
Create the object definition file you saved in the previous step.
```
$ oc create -f cinder-persistentvolume.yaml
```

Persistent volume formatting

You can use unformatted Cinder volumes as PVs because OKD formats them before the first use.

Before OKD mounts the volume and passes it to a container, the system checks that it contains a file system as specified by the fsType parameter in the PV definition. If the device is not formatted with the file system, all data from the device is erased and the device is automatically formatted with the given file system.

Configuring Cinder volume security

If you use Cinder PVs in your application, configure security for their deployment resources.

Prerequisites

An SCC must be created that uses the appropriate fsGroup strategy.

Procedure

Create a service account and add it to the SCC:

$ oc create serviceaccount <service_account>

$ oc adm policy add-scc-to-user <new_scc> -z <service_account> -n <project>

In your application’s deployment resource, provide the service account name and securityContext:
```
apiVersion: v1
kind: ReplicationController
metadata:
  name: frontend-1
spec:
  replicas: 1
  selector:
    name: frontend
  template:
    metadata:
      labels:
        name: frontend
    spec:
      containers:
      - image: openshift/hello-openshift
        name: helloworld
        ports:
        - containerPort: 8080
          protocol: TCP
      restartPolicy: Always
      serviceAccountName: <service_account>
      securityContext:
        fsGroup: 7777
```
where:

spec.replicas

Specifies the number of copies of the pod to run.

spec.selector

Specifies the label selector of the pod to run.

spec.template

Specifies a template for the pod that the controller creates.

spec.template.metadata.labels

Specifies the labels on the pod. They must include labels from the label selector.

spec.template.metadata.labels.name

Specifies the maximum name length after expanding any parameters is 63 characters.

spec.template.spec.serviceAccountName

Specifies the service account you created.

spec.template.spec.securityContext.fsGroup

Specifies an fsGroup for the pods.