kep-1979: add object bucket quota to design #4196
Conversation
k8s-ci-robot
added
cncf-cla: yes
|
Welcome @BlaineEXE! |
k8s-ci-robot
added
the
needs-ok-to-test
|
Hi @BlaineEXE. Thanks for your PR. I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: BlaineEXE The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
size/L
| - BucketClaims/Bucket are similar to PVC/PV. | ||
| - BucketClaim is used to request generation of new buckets. | ||
| - Buckets represent the actual Bucket. | ||
| - BucketClaims/Bucket are similar to PVC/PV. | ||
| - BucketClaim is used to request generation of new buckets. | ||
| - Buckets represent the actual Bucket. |
There was a problem hiding this comment.
Looks like my editor is automatically cleaning up a bunch of whitespace all through the doc
| Rook users have requested the ability to limit the max size of buckets as the max number of objects in a bucket. | ||
| However, adding this to the COSI API spec may be problematic. | ||
|
|
||
| When a user deletes a BucketAccess, the corresponding secret/serviceaccount are also deleted. If a pod has that secret mounted when delete is called, then a finalizer on the secret will prevent it from being deleted. Instead, the deletionTimestamp will be set on the secret. In this way, access to a Bucket is preserved until the application pod dies. | ||
| Amazon's S3 service does not seem to implement either of those quotas. Either by their | ||
| [quota mechanism](https://docs.aws.amazon.com/general/latest/gr/s3.html) or by their | ||
| [bucket policy mechanism](https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html). | ||
|
|
||
| When an admin deletes any of the class objects, it does not affect existing Buckets as fields from the class objects are copied into the Buckets during creation. | ||
| These particular quotas may not be a good fit for the COSI design. :( |
There was a problem hiding this comment.
This is unfortunate, but I wonder if it would still be beneficial to continue with some comments about quotas, even if the guidance is that the opaque parameters should be used on a per-provider basis.
[addendum]
This might be a good time to make some mention of explicitly relying on ResourceQuotas to control the number of Buckets, BucketClaims, or BucketAccesses for users, specifically or generally.
[/addendum]
Alternatively the COSI design could include these as official API and make the implementation of them optional for backends. To do that, we would probably want to follow some sort of mechanism for querying/reporting supported functionality, similar to this in CSI: https://kubernetes-csi.github.io/docs/support-fsgroup.html#supported-modes
|
/ok-to-test |
k8s-ci-robot
added
ok-to-test
Quotas are proving to be an oft-requested feature for COSI. While a set of common, portable quotas has yet to be identfied, COSI can still provide guidance for driver vendors on how to support vendor-specific quotas. COSI can also describe how administrators may work within the bounds of COSI's spec to accomplish commonly-requested goals. Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
BlaineEXE
force-pushed
the
bucket-quotas-1979-cosi
branch
from
0d96e17
to
c2a985d
Compare
| Below are some examples of how to achieve the desired outcome within the bounds of what COSI is able to provide. Be mindful that implementing these options will add difficulty (sometimes substantial) when porting applications between different cloud environments. | ||
|
|
||
| * The administrator may create an array of Bucket(Access)Classes and allow users to self-select the closest provided option that matches their needs. | ||
| * If that is too limiting, administrators may create a web form or custom controller that can create a custom Bucket(Access)Class for a user on-demand. |
There was a problem hiding this comment.
Take a look at the VolumeAttributesClass KEP: #3780
There was a problem hiding this comment.
|
The Kubernetes project currently lacks enough contributors to adequately respond to all PRs. This bot triages PRs according to the following rules:
You can:
Please send feedback to sig-contributor-experience at kubernetes/community. /lifecycle stale |
k8s-ci-robot
added
the
lifecycle/stale
Add initial bucket quota support to the Container Object Storage Interface (COSI) design KEP. This is an incremental improvement to the specification based on early user feedback.