设置 Filestore 代理卷

在创建卷池或预配卷之前，您必须使用 Private Service Connect (PSC) 配置虚拟私有云 (VPC) 网络，启用所需的 API，并授予相应的 IAM 角色。

创建项目并启用 API

  1. 登录您的 Google Cloud 账号。如果您是 Google Cloud新手，请 创建一个账号来评估我们的产品在实际场景中的表现。新客户还可获享 $300 赠金，用于运行、测试和部署工作负载。

  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  3. If you're using an existing project for this guide, verify that you have the permissions required to complete this guide. If you created a new project, then you already have the required permissions.

  4. Verify that billing is enabled for your Google Cloud project.

  5. Enable the Filestore APIs.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the APIs

  6. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  7. If you're using an existing project for this guide, verify that you have the permissions required to complete this guide. If you created a new project, then you already have the required permissions.

  8. Verify that billing is enabled for your Google Cloud project.

  9. Enable the Filestore APIs.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the APIs

    10.

所需的角色

如需获得设置 Filestore 代理卷所需的权限，请让管理员向您授予项目的以下 IAM 角色：

如需详细了解如何授予角色，请参阅管理对项目、文件夹和组织的访问权限。

您也可以通过自定义角色或其他预定义角色来获取所需的权限。

初始化服务代理

如果您尚未在项目中创建 Filestore 实例，请运行以下命令来初始化 Filestore 服务代理：

gcloud beta services identity create \
    --service=file.googleapis.com \
    --project=PROJECT_ID

将 PROJECT_ID 替换为您的 Google Cloud项目的 ID。

向服务代理授予权限

如需设置 Filestore 代理卷，请向 Filestore 服务代理授予 Cloud Filestore 编辑者 (roles/file.editor) 角色：

gcloud projects add-iam-policy-binding PROJECT_ID \
    --member="serviceAccount:service-PROJECT_NUMBER@cloud-filer.iam.iam.gserviceaccount.com" \
    --role="roles/file.editor"

替换以下内容：

  • PROJECT_ID：您的 Google Cloud 项目的 ID。
  • PROJECT_NUMBER：您的Google Cloud 项目的项目编号。

配置 Private Service Connect 网络

Filestore 代理卷使用 Private Service Connect 将受管存储基础设施直接连接到您的 VPC 网络。Private Service Connect 可确保实现私密、高带宽和低延迟的通信，而无需使用公共 IP 地址或 VPC 网络对等互连配置。

如需创建服务连接政策，请运行以下命令：

gcloud network-connectivity service-connection-policies create POLICY_NAME \
    --project=PROJECT_ID \
    --region=REGION \
    --network=projects/PROJECT_ID/global/networks/VPC_NETWORK \
    --subnets=SUBNET_NAME \
    --service-class=google-cloud-filestore

替换以下内容：

  • POLICY_NAME：服务连接政策的名称，例如 filestore-agent-psc-policy。
  • PROJECT_ID：您的 Google Cloud 项目的 ID。
  • REGION：卷池和工作负载将所在的区域，例如 us-central1。
  • VPC_NETWORK：现有 VPC 网络的名称。
  • SUBNET_NAME：指定区域中常规 VPC 子网的名称，Private Service Connect 端点 IP 地址将分配到该子网中。例如，默认子网的 --purpose 标志设置为 PRIVATE。

创建卷池和 StorageClass

卷池为代理卷提供共享存储空间容量和 IOPS。 如需在 GKE 中从卷池动态预配卷，请创建卷池，然后定义引用该卷池的 Kubernetes StorageClass。

创建卷池

如需创建示例卷池，请向 volumePools.create 端点发送 HTTP POST 请求：

curl -X POST \
    -H "Authorization: Bearer $(gcloud auth print-access-token)" \
    -H "Content-Type: application/json; charset=utf-8" \
    -d '{
      "description": "Sample volume pool for agent volumes",
      "network": "projects/PROJECT_ID/global/networks/VPC_NETWORK",
      "defaultVolumeQuotaMib": 2048,
    }' \
    "https://file.googleapis.com/v1beta1/projects/PROJECT_ID/locations/LOCATION/volumePools?volumePoolId=VOLUME_POOL_ID"

替换以下内容：

  • PROJECT_ID：您的 Google Cloud 项目的 ID。
  • VPC_NETWORK：启用 PSC 的 VPC 网络的名称。
  • LOCATION：卷池部署到的区域，例如 us-central1。
  • VOLUME_POOL_ID：卷池的标识符，例如 my-volume-pool。

如需了解详情，请参阅创建和管理卷池。

创建一个 StorageClass

创建名为 volume-pool-sc.yaml 的 StorageClass 清单，该清单引用您的卷池：

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: volume-pool-sc
provisioner: filestore.csi.storage.gke.io
volumeBindingMode: Immediate
reclaimPolicy: Delete
allowVolumeExpansion: true
parameters:
  volume-pool: "projects/<var>PROJECT_ID</var>/locations/<var>LOCATION</var>/volumePools/<var>VOLUME_POOL_ID</var>"

替换以下内容：

  • PROJECT_ID：您的 Google Cloud 项目的 ID。
  • LOCATION：卷池的部署区域。
  • VOLUME_POOL_ID：卷池的标识符。

如果您已安装 Filestore CSI 驱动程序的现有 GKE 集群，请应用 StorageClass：

kubectl apply -f volume-pool-sc.yaml

否则，请在为 Filestore 代理卷设置 GKE 环境中设置集群后应用此清单。

后续步骤