GitLab CI/CD, Kubernetes and, Private Volumes

Question

I have an application that uses a database. I want to set up a GitLab CI/CD pipeline to deploy my app to a Kubernetes cluster. My issue right now is that I can't seem to get persistent storage to work. My thought processes are as follows:

Create a persistent Volume -> Create a persistent Volume Claim -> Mount that PVC to my pod running a database

I am running into the issue that a PV is a system-wide configuration, so GitLab can't seem to create one. If I manage to make A PV before deployment GitLab only allows me to work with objects within a specific namespace. This means the PVC won't see the PV I created when my pipeline is run.

manifest.yaml

apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-sql0001
  labels:
    type: amazoneEBS
spec:
  capacity: 
    storage: 15Gi
  accessModes:
    - ReadWriteOnce
  awsElasticBlockStore:
    volumeID: <volume ID>
    fsType: ext4
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: sql-pvc
  labels:
    type: amazoneEBS
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 15Gi
  selector:
    matchLabels:
      type: "amazoneEBS"

kubectl Error

kubectl apply -f manifest.yaml
persistentvolumeclaim/sql-pvc created
Error from server (Forbidden): error when retrieving current configuration of:
Resource: "/v1, Resource=persistentvolumes", GroupVersionKind: "/v1, Kind=PersistentVolume"
Name: "pv-sql0001", Namespace: ""
from server for: "manifest.yaml": persistentvolumes "pv-sql0001" is forbidden: User "system:serviceaccount:namespace:namespace-service-account" cannot get resource "persistentvolumes" in API group "" at the cluster scope

I tried what was recommended in @Rakesh Gupta post but I am still getting the same error. Unless I am misunderstanding.

eddy@DESKTOP-1MHAKBA:~$ kubectl describe  ClusterRole  stateful-site-26554211-CR --namespace=stateful-site-26554211-pr
Name:         stateful-site-26554211-CR
Labels:       <none>
Annotations:  <none>
PolicyRule:
  Resources                      Non-Resource URLs  Resource Names  Verbs
  ---------                      -----------------  --------------  -----
  namespaces                     []                 []              [list watch create]
  nodes                          []                 []              [list watch create]
  persistentvolumes              []                 []              [list watch create]
  storageclasses.storage.k8s.io  []                 []              [list watch create]

eddy@DESKTOP-1MHAKBA:~$ kubectl describe  ClusterRoleBinding  stateful-site-26554211-CRB --namespace=stateful-site-26554211-production
Name:         stateful-site-26554211-CRB
Labels:       <none>
Annotations:  <none>
Role:
  Kind:  ClusterRole
  Name:  stateful-site-26554211-CR
Subjects:
  Kind            Name                                               Namespace
  ----            ----                                               ---------
  ServiceAccount  stateful-site-26554211-production-service-account  stateful-site-26554211-production

Any insight into how I should do this would be appreciated. I might just be doing this all wrong, and maybe there is a better way. I will be around to answer any questions.

Answer 1

You need to create a ServiceAccount, ClusterRole and ClusterRoleBinding as PV, PVC, Nodes are cluster scoped objects.

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: <name of your cluster role>
rules:
- apiGroups: [""]
  resources:
  - nodes
  - persistentvolumes
  - namespaces
  verbs: ["list", "watch", "create"]
- apiGroups: ["storage.k8s.io"]
  resources:
  - storageclasses
  verbs: ["list", "watch", "create"]
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: <name of your cluster role binding>
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: <name of your cluster role which should be matched with the previous one>
subjects:
  - kind: ServiceAccount
    name: <service account name>

Reference: https://stackoverflow.com/a/60617584/2777988

If this does not work, you may try to remove "PersistentVolume" section from your yaml. Looks like your setup doesn't allow PersistentVolume creation. Howerver, PVC may in turn create a PV.