You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* The Amazon EFS CSI driver needs {aws}Identity and Access Management (IAM) permissions.
32
32
**{aws} suggests using EKS Pod Identities. For more information, see <<pod-id-setup-overview>>.
33
-
** For information about IAM Roles for Service Accounts and setting up an {aws} Identity and Access Management (IAM) OpenID Connect (OIDC) provider for your cluster, see <<enable-iam-roles-for-service-accounts>>.
33
+
** For information about IAM roles for service accounts and setting up an IAM OpenID Connect (OIDC) provider for your cluster, see <<enable-iam-roles-for-service-accounts>>.
34
34
* Version `2.12.3` or later or version `1.27.160` or later of the {aws} Command Line Interface ({aws} CLI) installed and configured on your device or {aws} CloudShell. To check your current version, use `aws --version | cut -d / -f2 | cut -d ' ' -f1`. Package managers such `yum`, `apt-get`, or Homebrew for macOS are often several versions behind the latest version of the {aws} CLI. To install the latest version, see link:cli/latest/userguide/cli-chap-install.html[Installing, updating, and uninstalling the {aws} CLI,type="documentation"] and link:cli/latest/userguide/cli-configure-quickstart.html#cli-configure-quickstart-config[Quick configuration with aws configure,type="documentation"] in the _{aws} Command Line Interface User Guide_. The {aws} CLI version that is installed in {aws} CloudShell might also be several versions behind the latest version. To update it, see link:cloudshell/latest/userguide/vm-specs.html#install-cli-software[Installing {aws} CLI to your home directory,type="documentation"] in the _{aws} CloudShell User Guide_.
35
35
* The `kubectl` command line tool is installed on your device or {aws} CloudShell. The version can be the same as or up to one minor version earlier or later than the Kubernetes version of your cluster. For example, if your cluster version is `1.29`, you can use `kubectl` version `1.28`, `1.29`, or `1.30` with it. To install or upgrade `kubectl`, see <<install-kubectl>>.
36
36
@@ -57,9 +57,13 @@ The specific steps in this procedure are written for using the driver as an Amaz
57
57
58
58
====
59
59
60
-
=== `eksctl` [[eksctl_efs_store_app_data]]
61
-
==== If Using Pod Identities
62
-
Run the following commands to create an IAM role and Pod Identity association with `eksctl`. Replace [.replaceable]`my-cluster` with your cluster name and [.replaceable]`AmazonEKS_EFS_CSI_DriverRole` with the name for your role.
60
+
[#eksctl_efs_store_app_data]
61
+
=== `eksctl`
62
+
63
+
[#efs-eksctl-pod-identities]
64
+
==== If using Pod Identities
65
+
66
+
Run the following commands to create an IAM role and Pod Identity association with `eksctl`. Replace `my-cluster` with your cluster name. You can also replace `AmazonEKS_EFS_CSI_DriverRole` with a different name.
Run the following commands to create an IAM role with `eksctl`. Replace [.replaceable]`my-cluster` with your cluster name and [.replaceable]`AmazonEKS_EFS_CSI_DriverRole` with the name for your role.
81
+
[#efs-eksctl-irsa]
82
+
==== If using IAM roles for service accounts
83
+
84
+
Run the following commands to create an IAM role with `eksctl`. Replace `my-cluster` with your cluster name. You can also replace `AmazonEKS_EFS_CSI_DriverRole` with a different name.
Run the following to create an IAM role with {aws-management-console}.
99
106
100
107
. Open the IAM console at https://console.aws.amazon.com/iam/.
101
108
. In the left navigation pane, choose *Roles*.
102
109
. On the *Roles* page, choose *Create role*.
103
110
. On the *Select trusted entity* page, do the following:
104
-
+
105
-
.. If using *EKS Pod Identities*
106
-
... In the *Trusted entity type* section, choose *AWS service*.
111
+
.. If using EKS Pod Identities:
112
+
... In the *Trusted entity type* section, choose *{aws} service*.
107
113
... In the *Service or use case* drop down, choose *EKS*.
108
114
... In the *Use case* section, choose *EKS - Pod Identity*.
109
115
... Choose *Next*.
110
-
.. If using *IAM Roles for Service Accounts*
116
+
.. If using IAM roles for service accounts:
111
117
... In the *Trusted entity type* section, choose *Web identity*.
112
118
... For *Identity provider*, choose the *OpenID Connect provider URL* for your cluster (as shown under *Overview* in Amazon EKS).
113
119
... For *Audience*, choose `sts.amazonaws.com`.
114
120
... Choose *Next*.
115
121
. On the *Add permissions* page, do the following:
116
-
+
117
-
.. In the *Filter policies* box, enter [.replaceable]`AmazonEFSCSIDriverPolicy`.
118
-
.. Select the check box to the left of the [.replaceable]`AmazonEFSCSIDriverPolicy` returned in the search.
122
+
.. In the *Filter policies* box, enter `AmazonEFSCSIDriverPolicy`.
123
+
.. Select the check box to the left of the `AmazonEFSCSIDriverPolicy` returned in the search.
119
124
.. Choose *Next*.
120
125
. On the *Name, review, and create* page, do the following:
121
-
+
122
-
.. For *Role name*, enter a unique name for your role, such as [.replaceable]`AmazonEKS_EFS_CSI_DriverRole`.
126
+
.. For *Role name*, enter a unique name for your role, such as `AmazonEKS_EFS_CSI_DriverRole`.
123
127
.. Under *Add tags (Optional)*, add metadata to the role by attaching tags as key-value pairs. For more information about using tags in IAM, see link:IAM/latest/UserGuide/id_tags.html[Tagging IAM resources,type="documentation"] in the _IAM User Guide_.
124
128
.. Choose *Create role*.
125
129
. After the role is created:
126
-
.. If using *EKS Pod Identities*
130
+
.. If using EKS Pod Identities:
127
131
... Open the link:eks/home#/clusters[Amazon EKS console,type="console"].
128
132
... In the left navigation pane, select *Clusters*, and then select the name of the cluster that you want to configure the EKS Pod Identity association for.
129
133
... Choose the *Access* tab.
130
134
... In *Pod Identity associations*, choose *Create*.
131
135
... Choose the *IAM role* dropdown and select your newly created role.
132
-
... Choose the *Kubernetes namespace* field and input *kube-system*.
133
-
... Choose the *Kubernetes service account* field and input *efs-csi-controller-sa*.
136
+
... Choose the *Kubernetes namespace* field and input `kube-system`.
137
+
... Choose the *Kubernetes service account* field and input `efs-csi-controller-sa`.
134
138
... Choose *Create*.
135
139
... For more information on creating Pod Identity associations, see <<pod-id-association-create>>.
136
-
.. If using *IAM Roles for Service Accounts*
137
-
... Choose the role in the console to open it for editing.
140
+
.. If using IAM roles for service accounts:
141
+
... Choose the role to open it for editing.
138
142
... Choose the *Trust relationships* tab, and then choose *Edit trust policy*.
139
143
... Find the line that looks similar to the following line:
Add the following line above the previous line. Replace [.replaceable]`region-code` with the {aws} Region that your cluster is in. Replace [.replaceable]`EXAMPLED539D4633E53DE1B71EXAMPLE` with your cluster's OIDC provider ID.
150
+
Add the following line above the previous line. Replace `<region-code>` with the {aws} Region that your cluster is in. Replace `<EXAMPLED539D4633E53DE1B71EXAMPLE>` with your cluster's OIDC provider ID.
... Modify the `Condition` operator from `"StringEquals"` to `"StringLike"`.
153
157
... Choose *Update policy* to finish.
154
158
155
159
156
-
=== {aws} CLI [[awscli_efs_store_app_data]]
160
+
[#awscli_efs_store_app_data]
161
+
=== {aws} CLI
157
162
Run the following commands to create an IAM role with {aws} CLI.
158
163
159
-
==== If Using Pod Identities
164
+
[#efs-cli-pod-identities]
165
+
==== If using Pod Identities
166
+
160
167
. Create the IAM role that grants the `AssumeRole` and `TagSession` actions to the `pods.eks.amazonaws.com` service.
161
168
+
162
169
.. Copy the following contents to a file named `aws-efs-csi-driver-trust-policy-pod-identity.json`.
@@ -180,12 +187,14 @@ Run the following commands to create an IAM role with {aws} CLI.
180
187
]
181
188
}
182
189
----
183
-
.. Create the role. You can change [.replaceable]`AmazonEKS_EFS_CSI_DriverRole` to a different name, but if you do, make sure to change it in later steps too.
190
+
.. Create the role. Replace `my-cluster` with your cluster name. You can also replace `AmazonEKS_EFS_CSI_DriverRole` with a different name.
. Run the following command to create the Pod Identity association. Replace [.replaceable]`my-cluster` with your cluster name. Replace [.replaceable]`arn:aws:iam::111122223333:role/my-role` with the role created in previous steps.
209
+
. Run the following command to create the Pod Identity association. Replace `{arn-aws}iam::<111122223333>:role/my-role` with the role created in previous steps.
. For more information on creating Pod Identity associations, see <<pod-id-association-create>>.
206
215
207
-
==== If using IAM Roles for Service Accounts
216
+
[#efs-cli-irsa]
217
+
==== If using IAM roles for service accounts
208
218
209
-
. View your cluster's OIDC provider URL. Replace [.replaceable]`my-cluster` with your cluster name. If the output from the command is `None`, review the *Prerequisites*.
219
+
. View your cluster's OIDC provider URL. Replace `my-cluster` with your cluster name. You can also replace `AmazonEKS_EFS_CSI_DriverRole` with a different name.
210
220
+
211
221
[source,bash,subs="verbatim,attributes"]
212
222
----
213
-
aws eks describe-cluster --name my-cluster --query "cluster.identity.oidc.issuer" --output text
223
+
export cluster_name=my-cluster
224
+
export role_name=AmazonEKS_EFS_CSI_DriverRole
225
+
aws eks describe-cluster --name $cluster_name --query "cluster.identity.oidc.issuer" --output text
If the output from the command is `None`, review the *Prerequisites*.
222
236
. Create the IAM role that grants the `AssumeRoleWithWebIdentity` action.
223
237
+
224
-
.. Copy the following contents to a file named `aws-efs-csi-driver-trust-policy.json`. Replace [.replaceable]`111122223333` with your account ID. Replace [.replaceable]`EXAMPLED539D4633E53DE1B71EXAMPLE` and [.replaceable]`region-code` with the values returned in the previous step.
238
+
.. Copy the following contents to a file named `aws-efs-csi-driver-trust-policy.json`. Replace `<111122223333>` with your account ID. Replace `<EXAMPLED539D4633E53DE1B71EXAMPLE>` and `<region-code>` with the values returned in the previous step.
.. Create the role. You can change [.replaceable]`AmazonEKS_EFS_CSI_DriverRole` to a different name, but if you do, make sure to change it in later steps too.
0 commit comments