Deploy the FSx for Lustre driver

Create an IAM role and attach the Amazon managed policy with the following command. Replace my-cluster with the name of the cluster you want to use. The command deploys an Amazon CloudFormation stack that creates an IAM role and attaches the IAM policy to it.

eksctl create iamserviceaccount \
    --name fsx-csi-controller-sa \
    --namespace kube-system \
    --cluster my-cluster \
    --role-name AmazonEKS_FSx_CSI_DriverRole \
    --role-only \
    --attach-policy-arn arn:aws-cn:iam::aws:policy/AmazonFSxFullAccess \
    --approve

You’ll see several lines of output as the service account is created. The last lines of output are similar to the following.

[ℹ]  1 task: {
    2 sequential sub-tasks: {
        create IAM role for serviceaccount "kube-system/fsx-csi-controller-sa",
        create serviceaccount "kube-system/fsx-csi-controller-sa",
    } }
[ℹ]  building iamserviceaccount stack "eksctl-my-cluster-addon-iamserviceaccount-kube-system-fsx-csi-controller-sa"
[ℹ]  deploying stack "eksctl-my-cluster-addon-iamserviceaccount-kube-system-fsx-csi-controller-sa"
[ℹ]  waiting for CloudFormation stack "eksctl-my-cluster-addon-iamserviceaccount-kube-system-fsx-csi-controller-sa"
[ℹ]  created serviceaccount "kube-system/fsx-csi-controller-sa"

Note the name of the Amazon CloudFormation stack that was deployed. In the previous example output, the stack is named eksctl-my-cluster-addon-iamserviceaccount-kube-system-fsx-csi-controller-sa.

Note the security group for your cluster. You can see it in the Amazon Web Services Management Console under the Networking section or by using the following Amazon CLI command. Replace my-cluster with the name of the cluster you want to use.

aws eks describe-cluster --name my-cluster --query cluster.resourcesVpcConfig.clusterSecurityGroupId

Create a security group for your Amazon FSx file system according to the criteria shown in Amazon VPC Security Groups in the Amazon FSx for Lustre User Guide. For the VPC, select the VPC of your cluster as shown under the Networking section. For "the security groups associated with your Lustre clients", use your cluster security group. You can leave the outbound rules alone to allow All traffic.

Download the storage class manifest with the following command.

curl -O https://raw.githubusercontent.com/kubernetes-sigs/aws-fsx-csi-driver/master/examples/kubernetes/dynamic_provisioning/specs/storageclass.yaml

Edit the parameters section of the storageclass.yaml file. Replace every example value with your own values.

parameters:
  subnetId: subnet-0eabfaa81fb22bcaf
  securityGroupIds: sg-068000ccf82dfba88
  deploymentType: PERSISTENT_1
  automaticBackupRetentionDays: "1"
  dailyAutomaticBackupStartTime: "00:00"
  copyTagsToBackups: "true"
  perUnitStorageThroughput: "200"
  dataCompressionType: "NONE"
  weeklyMaintenanceStartTime: "7:09:00"
  fileSystemTypeVersion: "2.12"

Create the storage class manifest.

kubectl apply -f storageclass.yaml

An example output is as follows.

storageclass.storage.k8s.io/fsx-sc created

Download the persistent volume claim manifest.

curl -O https://raw.githubusercontent.com/kubernetes-sigs/aws-fsx-csi-driver/master/examples/kubernetes/dynamic_provisioning/specs/claim.yaml

(Optional) Edit the claim.yaml file. Change 1200Gi to one of the following increment values, based on your storage requirements and the deploymentType that you selected in a previous step.

storage: 1200Gi

Create the persistent volume claim.

kubectl apply -f claim.yaml

An example output is as follows.

persistentvolumeclaim/fsx-claim created

Confirm that the file system is provisioned.

kubectl describe pvc

An example output is as follows.

Name:          fsx-claim
Namespace:     default
StorageClass:  fsx-sc
Status:        Bound
[...]

Deploy the sample application.

kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-fsx-csi-driver/master/examples/kubernetes/dynamic_provisioning/specs/pod.yaml

Verify that the sample application is running.

kubectl get pods

An example output is as follows.

NAME      READY   STATUS              RESTARTS   AGE
fsx-app   1/1     Running             0          8s

Verify that the file system is mounted correctly by the application.

kubectl exec -ti fsx-app -- df -h

An example output is as follows.

Filesystem                   Size  Used Avail Use% Mounted on
overlay                       80G  4.0G   77G   5% /
tmpfs                         64M     0   64M   0% /dev
tmpfs                        3.8G     0  3.8G   0% /sys/fs/cgroup
192.0.2.0@tcp:/abcdef01      1.1T  7.8M  1.1T   1% /data
/dev/nvme0n1p1                80G  4.0G   77G   5% /etc/hosts
shm                           64M     0   64M   0% /dev/shm
tmpfs                        6.9G   12K  6.9G   1% /run/secrets/kubernetes.io/serviceaccount
tmpfs                        3.8G     0  3.8G   0% /proc/acpi
tmpfs                        3.8G     0  3.8G   0% /sys/firmware

Verify that data was written to the FSx for Lustre file system by the sample app.

kubectl exec -it fsx-app -- ls /data

An example output is as follows.

out.txt

This example output shows that the sample app successfully wrote the out.txt file to the file system.