Skip to content

Commit 2a4d8c4

Browse files
LearningNewbieLearningNewbie
authored
docs: added example for EFS CSI Driver in an EKS Cluster (#2186)
* Create eks_addon_efs_csi_driver.tf * Update eks_addon.md.tmpl * Update eks_addon.md * Update eks_addon.md * Update eks_addon.md * Update eks_addon_efs_csi_driver.tf * Update eks_addon.md
1 parent b6888d5 commit 2a4d8c4

File tree

3 files changed

+171
-0
lines changed

3 files changed

+171
-0
lines changed

‎docs/resources/eks_addon.md

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,92 @@ resource "awscc_eks_addon" "ebs_csi" {
102102
}
103103
```
104104

105+
### Create EFS CSI addon
106+
```terraform
107+
# AWS IAM expects the OIDC provider URL without the `https://` prefix in the condition block.This creates a local variable for it:
108+
109+
locals {
110+
oidc_provider = replace(awscc_eks_cluster.eks_cluster.open_id_connect_issuer_url, "https://", "")
111+
}
112+
113+
# Optional Custom policy for KMS support and EBS CSI Driver Role
114+
115+
resource "awscc_iam_managed_policy" "efs_csi_kms_policy" {
116+
managed_policy_name = "AmazonEKS_EFS_CSI_KMS_Policy"
117+
policy_document = jsonencode({
118+
Version = "2012-10-17"
119+
Statement = [
120+
{
121+
Effect = "Allow"
122+
Action = [
123+
"kms:CreateGrant",
124+
"kms:ListGrants",
125+
"kms:RevokeGrant"
126+
]
127+
Resource = awscc_kms_key.example.arn
128+
Condition = {
129+
Bool = {
130+
"kms:GrantIsForAWSResource" = "true"
131+
}
132+
}
133+
},
134+
{
135+
Effect = "Allow"
136+
Action = [
137+
"kms:Encrypt",
138+
"kms:Decrypt",
139+
"kms:ReEncrypt*",
140+
"kms:GenerateDataKey*",
141+
"kms:DescribeKey"
142+
]
143+
Resource = awscc_kms_key.example.arn
144+
}
145+
]
146+
})
147+
}
148+
149+
# Create IAM role for EBS CSI Driver
150+
resource "awscc_iam_role" "efs_csi_role" {
151+
role_name = "AmazonEKS_EFS_CSI_Driver_Role"
152+
assume_role_policy_document = jsonencode({
153+
Statement = [{
154+
Action = "sts:AssumeRoleWithWebIdentity"
155+
Effect = "Allow"
156+
Principal = {
157+
Federated = awscc_iam_oidc_provider.eks.arn
158+
# Example: "arn:aws:iam::111122223333:oidc-provider/oidc.eks.region-code.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE"
159+
}
160+
Condition = {
161+
StringEquals = {
162+
"${local.oidc_provider}:sub" = "system:serviceaccount:kube-system:efs-csi-controller-sa"
163+
"${local.oidc_provider}:aud" = "sts.amazonaws.com"
164+
}
165+
}
166+
}]
167+
Version = "2012-10-17"
168+
})
169+
170+
managed_policy_arns = [
171+
awscc_iam_managed_policy.efs_csi_kms_policy.arn,
172+
"arn:aws:iam::aws:policy/service-role/AmazonEFSCSIDriverPolicy"
173+
]
174+
}
175+
176+
# Once the IAM role is ready, create EFS CSI addon
177+
178+
resource "awscc_eks_addon" "efs_csi" {
179+
cluster_name = awscc_eks_cluster.cluster_name
180+
addon_name = "aws-efs-csi-driver"
181+
addon_version = "v2.1.4-eksbuild.1" #Change version to required
182+
service_account_role_arn = awscc_iam_role.efs_csi_role.arn
183+
resolve_conflicts = "OVERWRITE"
184+
tags = [{
185+
key = "Modified By"
186+
value = "AWSCC"
187+
}]
188+
}
189+
```
190+
105191
### Create VPC CNI addon
106192
```terraform
107193
# AWS IAM expects the OIDC provider URL without the `https://` prefix in the condition block.

‎examples/resources/awscc_eks_addon/eks_addon_efs_csi_driver.tf

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
# AWS IAM expects the OIDC provider URL without the `https://` prefix in the condition block.This creates a local variable for it:
2+
3+
locals {
4+
oidc_provider = replace(awscc_eks_cluster.eks_cluster.open_id_connect_issuer_url, "https://", "")
5+
}
6+
7+
# Optional Custom policy for KMS support and EBS CSI Driver Role
8+
9+
resource "awscc_iam_managed_policy" "efs_csi_kms_policy" {
10+
managed_policy_name = "AmazonEKS_EFS_CSI_KMS_Policy"
11+
policy_document = jsonencode({
12+
Version = "2012-10-17"
13+
Statement = [
14+
{
15+
Effect = "Allow"
16+
Action = [
17+
"kms:CreateGrant",
18+
"kms:ListGrants",
19+
"kms:RevokeGrant"
20+
]
21+
Resource = awscc_kms_key.example.arn
22+
Condition = {
23+
Bool = {
24+
"kms:GrantIsForAWSResource" = "true"
25+
}
26+
}
27+
},
28+
{
29+
Effect = "Allow"
30+
Action = [
31+
"kms:Encrypt",
32+
"kms:Decrypt",
33+
"kms:ReEncrypt*",
34+
"kms:GenerateDataKey*",
35+
"kms:DescribeKey"
36+
]
37+
Resource = awscc_kms_key.example.arn
38+
}
39+
]
40+
})
41+
}
42+
43+
# Create IAM role for EBS CSI Driver
44+
resource "awscc_iam_role" "efs_csi_role" {
45+
role_name = "AmazonEKS_EFS_CSI_Driver_Role"
46+
assume_role_policy_document = jsonencode({
47+
Statement = [{
48+
Action = "sts:AssumeRoleWithWebIdentity"
49+
Effect = "Allow"
50+
Principal = {
51+
Federated = awscc_iam_oidc_provider.eks.arn
52+
# Example: "arn:aws:iam::111122223333:oidc-provider/oidc.eks.region-code.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE"
53+
}
54+
Condition = {
55+
StringEquals = {
56+
"${local.oidc_provider}:sub" = "system:serviceaccount:kube-system:efs-csi-controller-sa"
57+
"${local.oidc_provider}:aud" = "sts.amazonaws.com"
58+
}
59+
}
60+
}]
61+
Version = "2012-10-17"
62+
})
63+
64+
managed_policy_arns = [
65+
awscc_iam_managed_policy.efs_csi_kms_policy.arn,
66+
"arn:aws:iam::aws:policy/service-role/AmazonEFSCSIDriverPolicy"
67+
]
68+
}
69+
70+
# Once the IAM role is ready, create EFS CSI addon
71+
72+
resource "awscc_eks_addon" "efs_csi" {
73+
cluster_name = awscc_eks_cluster.cluster_name
74+
addon_name = "aws-efs-csi-driver"
75+
addon_version = "v2.1.4-eksbuild.1" #Change version to required
76+
service_account_role_arn = awscc_iam_role.efs_csi_role.arn
77+
resolve_conflicts = "OVERWRITE"
78+
tags = [{
79+
key = "Modified By"
80+
value = "AWSCC"
81+
}]
82+
}

‎templates/resources/eks_addon.md.tmpl

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@ description: |-
1717
### Create EBS CSI addon
1818
{{ tffile (printf "examples/resources/%s/eks_addon_ebs_csi_driver.tf" .Name)}}
1919

20+
### Create EFS CSI addon
21+
{{ tffile (printf "examples/resources/%s/eks_addon_efs_csi_driver.tf" .Name)}}
22+
2023
### Create VPC CNI addon
2124
{{ tffile (printf "examples/resources/%s/eks_addon_vpc_cni.tf" .Name)}}
2225

0 commit comments

Comments
 (0)