Amazon EFS CSI driver

Open the IAM console at https://console.amazonaws.cn/iam/.

In the left navigation pane, choose Roles.

On the Roles page, choose Create role.

On the Select trusted entity page, do the following:

1. In the Trusted entity type section, choose Web identity.

2. For Identity provider, choose the OpenID Connect provider URL for your cluster (as shown under Overview in Amazon EKS).

3. For Audience, choose sts.amazonaws.com.

4. Choose Next.

On the Add permissions page, do the following:

1. In the Filter policies box, enter AmazonEFSCSIDriverPolicy.

2. Select the check box to the left of the AmazonEFSCSIDriverPolicy returned in the search.

3. Choose Next.

On the Name, review, and create page, do the following:

1. For Role name, enter a unique name for your role, such as AmazonEKS_EFS_CSI_DriverRole.

2. Under Add tags (Optional), add metadata to the role by attaching tags as key–value pairs. For more information about using tags in IAM, see Tagging IAM Entities in the IAM User Guide.

3. Choose Create role.

After the role is created, choose the role in the console to open it for editing.

Choose the Trust relationships tab, and then choose Edit trust policy.

Find the line that looks similar to the following line:

"oidc.eks.region-code.amazonaws.com.cn/id/EXAMPLED539D4633E53DE1B71EXAMPLE:aud": "sts.amazonaws.com"

Add the following line above the previous line. Replace region-code with the Amazon Web Services Region that your cluster is in. Replace EXAMPLED539D4633E53DE1B71EXAMPLE with your cluster's OIDC provider ID.

"oidc.eks.region-code.amazonaws.com.cn/id/EXAMPLED539D4633E53DE1B71EXAMPLE:sub": "system:serviceaccount:kube-system:efs-csi-*",

Modify the Condition operator from "StringEquals" to "StringLike".

Choose Update policy to finish.

For self-managed installations of the driver, create Kubernetes service accounts that are annotated with the ARN of the IAM role that you created. This step isn't required if you are installing the driver as an Amazon EKS add-on.

1. Save the following contents to a file named efs-service-account.yaml. Replace 111122223333 with your account ID.

   ---
   apiVersion: v1
   kind: ServiceAccount
   metadata:
     labels:
       app.kubernetes.io/name: aws-efs-csi-driver
     name: efs-csi-controller-sa
     namespace: kube-system
     annotations:
       eks.amazonaws.com/role-arn: arn:aws-cn:iam::111122223333:role/AmazonEKS_EFS_CSI_DriverRole
   ---
   apiVersion: v1
   kind: ServiceAccount
   metadata:
     labels:
       app.kubernetes.io/name: aws-efs-csi-driver
     name: efs-csi-node-sa
     namespace: kube-system
     annotations:
       eks.amazonaws.com/role-arn: arn:aws-cn:iam::111122223333:role/AmazonEKS_EFS_CSI_DriverRole

2. Create the Kubernetes service account on your cluster. The Kubernetes service accounts (efs-csi-controller-sa and efs-csi-node-sa) are annotated with the IAM role that you created named AmazonEKS_EFS_CSI_DriverRole.

   kubectl apply -f efs-service-account.yaml

View your cluster's OIDC provider URL. Replace my-cluster with your cluster name. If the output from the command is None, review the Prerequisites.

aws eks describe-cluster --name my-cluster --query "cluster.identity.oidc.issuer" --output text

An example output is as follows.

https://oidc.eks.region-code.amazonaws.com.cn/id/EXAMPLED539D4633E53DE1B71EXAMPLE

Create the IAM role, granting the Kubernetes service account the AssumeRoleWithWebIdentity action.

1. Copy the following contents to a file named aws-efs-csi-driver-trust-policy.json. Replace 111122223333 with your account ID. Replace EXAMPLED539D4633E53DE1B71EXAMPLE and region-code with the values returned in the previous step.

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "Federated": "arn:aws-cn:iam::111122223333:oidc-provider/oidc.eks.region-code.amazonaws.com.cn/id/EXAMPLED539D4633E53DE1B71EXAMPLE"
         },
         "Action": "sts:AssumeRoleWithWebIdentity",
         "Condition": {
           "StringLike": {
             "oidc.eks.region-code.amazonaws.com.cn/id/EXAMPLED539D4633E53DE1B71EXAMPLE:sub": "system:serviceaccount:kube-system:efs-csi-*",
             "oidc.eks.region-code.amazonaws.com.cn/id/EXAMPLED539D4633E53DE1B71EXAMPLE:aud": "sts.amazonaws.com"
           }
         }
       }
     ]
   }

2. Create the role. You can change AmazonEKS_EFS_CSI_DriverRole to a different name, but if you do, make sure to change it in later steps too.

   aws iam create-role \
     --role-name AmazonEKS_EFS_CSI_DriverRole \
     --assume-role-policy-document file://"aws-efs-csi-driver-trust-policy.json"
   

Attach the required Amazon managed policy to the role with the following command.

aws iam attach-role-policy \
  --policy-arn arn:aws-cn:iam::aws:policy/service-role/AmazonEFSCSIDriverPolicy \
  --role-name AmazonEKS_EFS_CSI_DriverRole

For self-managed installations of the driver, create Kubernetes service accounts that are annotated with the ARN of the IAM role that you created. This step isn't required if you are installing the driver as an Amazon EKS add-on.

1. Save the following contents to a file named efs-service-account.yaml. Replace 111122223333 with your account ID.

   ---
   apiVersion: v1
   kind: ServiceAccount
   metadata:
     labels:
       app.kubernetes.io/name: aws-efs-csi-driver
     name: efs-csi-controller-sa
     namespace: kube-system
     annotations:
       eks.amazonaws.com/role-arn: arn:aws-cn:iam::111122223333:role/AmazonEKS_EFS_CSI_DriverRole
   ---
   apiVersion: v1
   kind: ServiceAccount
   metadata:
     labels:
       app.kubernetes.io/name: aws-efs-csi-driver
     name: efs-csi-node-sa
     namespace: kube-system
     annotations:
       eks.amazonaws.com/role-arn: arn:aws-cn:iam::111122223333:role/AmazonEKS_EFS_CSI_DriverRole

2. Create the Kubernetes service account on your cluster. The Kubernetes service accounts (efs-csi-controller-sa and efs-csi-node-sa) are annotated with the IAM role that you created named AmazonEKS_EFS_CSI_DriverRole.

   kubectl apply -f efs-service-account.yaml