aws / aws/containers-roadmap

[service] [request]: EFS Addon (EFS-CSI Driver) does not support setting annotations for node service account

Open
#2,820 1 comment 1 reaction 0 assignees View on GitHub
EKS EKS Add-Ons Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
According to your Documentation, for using s3 filesystem we need to create a dedicated iam role - seperate from the efs controller role
However your eks addon schema doesn't allow setting an explicit service account iam role arn for the node, only for both
controller and node service accounts

**Which service(s) is this request for?**
EKS (EFS-CSI Driver Addon)

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
about a month ago i successfully completed a POC on using s3 filesystem mount on a pod
I tried pushing this to production but i keep failing.
i checked the documentation and it has been completely changed stating we need 2 iam roles.
i tried adding all policies to a single role for both controller and node service accounts, but it still fails

**Are you currently working around this issue?**
i am at a loss for more then 2 days

**Additional context**
There is a misalignment between the efs csi driver helm-chart, the documentation and what you allow and support via eks addons (efs-csi driver addon)

**Attachments**
https://docs.aws.amazon.com/eks/latest/userguide/s3files-csi.html

Contributor guide

Open the contributing guide

Research direction

Start by comparing the linked EKS s3files-csi documentation with the EFS-CSI Driver Helm chart and EKS addon schema. Check how controller and node service account IAM roles or annotations are currently represented. Done means the supported configuration and documentation clearly allow separate roles, or explicitly document the limitation and required behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, helm, kubernetes
Domain
cloud, devops, infrastructure
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.