[service] [request]: EFS Addon (EFS-CSI Driver) does not support setting annotations for node service account
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
According to your Documentation, for using s3 filesystem we need to create a dedicated iam role - seperate from the efs controller role
However your eks addon schema doesn't allow setting an explicit service account iam role arn for the node, only for both
controller and node service accounts
**Which service(s) is this request for?**
EKS (EFS-CSI Driver Addon)
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
about a month ago i successfully completed a POC on using s3 filesystem mount on a pod
I tried pushing this to production but i keep failing.
i checked the documentation and it has been completely changed stating we need 2 iam roles.
i tried adding all policies to a single role for both controller and node service accounts, but it still fails
**Are you currently working around this issue?**
i am at a loss for more then 2 days
**Additional context**
There is a misalignment between the efs csi driver helm-chart, the documentation and what you allow and support via eks addons (efs-csi driver addon)
**Attachments**
https://docs.aws.amazon.com/eks/latest/userguide/s3files-csi.html
Contributor guide
Research direction
Start by comparing the linked EKS s3files-csi documentation with the EFS-CSI Driver Helm chart and EKS addon schema. Check how controller and node service account IAM roles or annotations are currently represented. Done means the supported configuration and documentation clearly allow separate roles, or explicitly document the limitation and required behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, helm, kubernetes
- Domain
- cloud, devops, infrastructure
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100