Block Storage

Background

Tenants with the requirement to provision Object Storage can consider offerings from AWS S3.
Data will be stored securely at Rest based on Amazon S3 Server-Side encryption SS3-S3.
Data will be encrypted with 256-bit Advanced Encryption Standard (AES-256).

Requirements

Give a unique name to your S3 Bucket as its name is global within AWS environment as to avoid failure in provisioning. Use annotation or refer to the Example section: object-storage/bucket-name: <your_bucket_name>.
The actual Bucket name will be appended with the prefix t-<env>-<your_bucket_name>.
Access control to S3 is secured by the Bucket policy. CStack has pre-assigned a specific IAM role for the Tenant Application’s Pods to assume.
Configure the Deployment manifest to use specific SA (pre-setup by CStack) to have permission on IAM role assumption by setting spec.serviceAccountName to ns-writer. Refer to IRSA Role for more details.
Client Application must enable SSL encryption to communicate with S3 API and also enable SSE (Server Side Encryption) flag to AES256 for PutObject action. This is a pre-requisite for the client in order to upload files to the CStack S3 Bucket successfully.
By default, set spec.parameters.deletionPolicy to Orphan during the creation of Cloud Resources. Orphan implies the actual Cloud Resources will be left running even if you have removed CSBucket from cstack-manifest repository.
Before deletion of the Cloud Resources, refer to the Deletion Policy.
Take note that all objects inside the bucket need to be completely deleted if you want to remove the Bucket resource.
- PROD environment: Once files are being deleted, You have a grace period of 90 days before permanent deletion. If you require to restore back the deleted files before end of the grace period, you can refer to AWS documentation on Versioning.
- NON-PROD environment: You have a grace period of 1 day before permanent deletion.

Example

Copy the code snippet below, and save it in an s3.yml file.

Reference the s3.yml file in the kustomization.yml configuration.

apiVersion: crd.aws.container.stack.gov.sg/v1alpha1
kind: CSBucket
metadata:
  name: cstack-example-s3
  namespace: <your_namespace>
  annotations:
    object-storage/bucket-name: cstack-example-s3
spec:
  parameters:
    # Please empty the Bucket before deletion
    deletionPolicy: Delete # Recommended to set 'Orphan' in Prod

Validation

You can spin a new Deployment with the following manifest.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: s3-client
  namespace: <your_namespace>
  labels:
    app.kubernetes.io/name: s3-client
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: s3-client
  template:
    metadata:
      labels:
        app.kubernetes.io/name: s3-client
    spec:
      serviceAccountName: service_account_with_irsa # check configuration section above
      containers:
      - name: aws-s3-tester
        image: {IMAGE_REGISTRY_DOMAIN}/cstack-images/aws-cli-kubectl:2.2.31-1.20.10
        imagePullPolicy: Always
        command:
          - /bin/sleep
        args:
          - "3600"
        env:
          # AWS CLI create temporary credentials in $HOME/.aws path
          # As the container default HOME path required root permission
          # Workaround is point to /tmp path to allow write access
          - name: HOME
            value: /tmp
          - name: AWS_DEFAULT_REGION
            value: ap-southeast-1
      securityContext:
        fsGroup: 3000
        runAsGroup: 2000
        runAsUser: 1000

You can get {IMAGE_REGISTRY_DOMAIN} from: https://sgts.gitlab-dedicated.com/wog/gvt/cstack/groups/references/cstack-configuration.

Get a shell session into the Pod container.

kubectl -n <your_namespace> exec s3-client-<random_gen_id> -it -- /bin/sh

Run the following command to list your S3 Bucket’s object.
```
aws s3 ls t-<env>-<your_bucket_name>
```
You only have access to Bucket’s content, not to list Bucket.

Additional Resource

AWS Simple Storage Service User Guide

Deletion Policy

This policy applies to all Custom Resource manifests.

By default, spec.parameters.deletionPolicy is set to Orphan during creation of Cloud Resources. Orphan implies the actual Cloud Resources will be left running even you have removed CSBucket from cstack-manifest repository
Before deleting the Cloud Resources, ensure that spec.parameters.deletionPolicy is set to Delete. This setting implies that the actual Cloud Resources will be removed when deleting the CSBucket manifest. It’s important to verify that this parameter has been updated and that CSBucket shows a status type of True (Refer to Validation). Once confirmed, it is safe to remove the CR manifest from the cstack-manifest repository after the designated grace period.
It is recommended to always set spec.parameters.deletionPolicy to Orphan for Production workload.

Database

Disk