»csi_plugin Stanza

The "csi_plugin" stanza allows the task to specify it provides a Container Storage Interface plugin to the cluster. Nomad will automatically register the plugin so that it can be used by other jobs to claim volumes.

csi_plugin {
  id        = "csi-hostpath"
  type      = "monolith"
  mount_dir = "/csi"
}

csi_plugin {  id        = "csi-hostpath"  type      = "monolith"  mount_dir = "/csi"}

»csi_plugin Parameters

• id (string: <required>) - This is the ID for the plugin. Some plugins will require both controller and node plugin types (see below); you need to use the same ID for both so that Nomad knows they belong to the same plugin.

• type (string: <required>) - One of node, controller, or monolith. Each plugin supports one or more types. Each Nomad client node where you want to mount a volume will need a node plugin instance. Some plugins will also require one or more controller plugin instances to communicate with the storage provider's APIs. Some plugins can serve as both controller and node at the same time, and these are called monolith plugins. Refer to your CSI plugin's documentation.

• mount_dir (string: <required>) - The directory path inside the container where the plugin will expect a Unix domain socket for bidirectional communication with Nomad.

»Recommendations for Deploying CSI Plugins

CSI plugins run as Nomad jobs but after mounting the volume are not in the data path for the volume. Jobs that mount volumes write and read directly to the volume via a bind-mount and there is no communication between the job and the CSI plugin. But when an allocation that mounts a volume stops, Nomad will need to communicate with the plugin on that allocation's node to unmount the volume. This has implications on how to deploy CSI plugins:

• During node drains, jobs that claim volumes must be moved before the node or monolith plugin for those volumes. You should run node or monolith plugins as system jobs and use the -ignore-system flag on nomad node drain to ensure that the plugins are running while the node is being drained.

• Only one plugin instance of a given plugin ID and type (controller or node) should be deployed on any given client node. Use a constraint as shown below.

• Some plugins will create volumes only in the same location as the plugin. For example, the AWS EBS plugin will create and mount volumes only within the same Availability Zone. You should deploy these plugins with a unique-per-AZ plugin_id to allow Nomad to place allocations in the correct AZ.

»csi_plugin Examples

job "plugin-efs" {
  datacenters = ["dc1"]

  # you can run node plugins as service jobs as well, but running
  # as a system job ensures all nodes in the DC have a copy.
  type = "system"

  # only one plugin of a given type and ID should be deployed on
  # any given client node
  constraint {
    operator = "distinct_hosts"
    value = true
  }

  group "nodes" {
    task "plugin" {
      driver = "docker"

      config {
        image = "amazon/aws-efs-csi-driver:v.1.3.2"

        args = [
          "--endpoint=unix://csi/csi.sock",
          "--logtostderr",
          "--v=5",
        ]

        # all CSI node plugins will need to run as privileged tasks
        # so they can mount volumes to the host. controller plugins
        # do not need to be privileged.
        privileged = true
      }

      csi_plugin {
        id        = "aws-efs0"
        type      = "node"
        mount_dir = "/csi"  # this path /csi matches the --endpoint
                            # argument for the container
      }
    }
  }
}

job "plugin-efs" {  datacenters = ["dc1"]
  # you can run node plugins as service jobs as well, but running  # as a system job ensures all nodes in the DC have a copy.  type = "system"
  # only one plugin of a given type and ID should be deployed on  # any given client node  constraint {    operator = "distinct_hosts"    value = true  }
  group "nodes" {    task "plugin" {      driver = "docker"
      config {        image = "amazon/aws-efs-csi-driver:v.1.3.2"
        args = [          "--endpoint=unix://csi/csi.sock",          "--logtostderr",          "--v=5",        ]
        # all CSI node plugins will need to run as privileged tasks        # so they can mount volumes to the host. controller plugins        # do not need to be privileged.        privileged = true      }
      csi_plugin {        id        = "aws-efs0"        type      = "node"        mount_dir = "/csi"  # this path /csi matches the --endpoint                            # argument for the container      }    }  }}