Managing the Amazon EBS CSI driver as an Amazon EKS add-on

• https://docs.aws.amazon.com/eks/latest/userguide/managing-ebs-csi.html#csi-iam-role

• An existing AWS Identity and Access Management (IAM) OpenID Connect (OIDC) provider for your cluster.

aws eks describe-cluster --name my-cluster --query "cluster.identity.oidc.issuer" --output text

https://oidc.eks.us-east-1.amazonaws.com/id/187054FB6DBFE10DA216A01234567890

aws eks create-addon --cluster-name my-cluster --addon-name aws-ebs-csi-driver \
  --service-account-role-arn arn:aws:iam::111122223333:role/AmazonEKS_EBS_CSI_DriverRole

Errors

• failed to provision volume with StorageClass
• Could not create volume in EC2: UnauthorizedOperation

Activities

• Configure privileges for EBS CSI using ebs_csi_irsa_role module
• Creating an IAM OIDC provider for your cluster

Related

• kubectl describe pvc
• sts:AssumeRoleWithWebIdentity
• Creating the Amazon EBS CSI driver IAM role for service accounts
• EKS module: cluster_addons

aws_iam_role

• Terraform module: ebs_csi_irsa_role

See also

• Amazon EBS CSI driver: aws-ebs-csi-driver, ebs_csi_irsa_role, ebs-csi-controller, ebs-csi-node
• EBS, EBS Snapshots (archive), aws ebs, io1, io2, gp2, gp3, st1, sc1, aws_ebs_snapshot, aws_dlm_lifecycle_policy
• OIDC, kubectl oidc-login, AWS IAM OIDC, EKS OIDC, EKS module, aws iam list-open-id-connect-providers | aws iam create-open-id-connect-provider | aws iam get-open-id-connect-provider, OIDC tokens, aws_lb_listener_rule