Pod identity support for the node component in EKS managed addon

[yann-soubeyrand]

Is your feature request related to a problem?/Why is this needed

In the documentation (https://github.com/kubernetes-sigs/aws-efs-csi-driver/blob/master/docs/parameters.md) it is indicated the one can use the iam mount option to

Use the CSI Node Pod's IAM identity to authenticate with Amazon EFS.

However, the EKS EFS CSI driver managed addon does not seem to support configuring a pod identity for the node component, only for the controller component.

/feature

Describe the solution you'd like in detail

In addition to being able to configure a pod identity for the controller component when deploying the EKS EFS CSI driver managed addon, I’d like to be able to configure a pod identity for the node component as well.

Describe alternatives you've considered

Until this feature is available, one can manually add a pod identity association for the node component service account.

Additional context

We try to secure the access to our EFS filesystems as much as possible and so we mandate the use of IAM to mount a filesystem. We do so by using the following filesystem policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Principal": {
                "AWS": "*"
            },
            "Action": "*",
            "Resource": "arn:aws:elasticfilesystem:eu-west-1:<redacted>:file-system/fs-<redacted>",
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            }
        },
        {
            "Effect": "Deny",
            "Principal": {
                "AWS": "*"
            },
            "Action": "*",
            "Resource": "arn:aws:elasticfilesystem:eu-west-1:<redacted>:file-system/fs-<redacted>",
            "Condition": {
                "Bool": {
                    "elasticfilesystem:AccessedViaMountTarget": "false"
                }
            }
        }
    ]
}

We then assign a policy to IAM roles to give access to the filesystem. In the case of the EFS CSI driver, we assign this policy to the node pod identity

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "elasticfilesystem:ClientMount",
                "elasticfilesystem:ClientWrite"
            ],
            "Resource": "arn:aws:elasticfilesystem:eu-west-1:<redacted>:file-system/fs-<redacted>",
            "Effect": "Allow"
        }
    ]
}

[dankova22]

Hello @yann-soubeyrand thanks for raising the issue.

I have a couple questions to better understand your request:

1. You mention that:

the EKS EFS CSI driver managed addon does not seem to support configuring a pod identity for the node component, only for the controller component .In addition to being able to configure a pod identity for the controller component when deploying the EKS EFS CSI driver managed addon, I’d like to be able to configure a pod identity for the node component as well. Until this feature is available, one can manually add a pod identity association for the node component service account.

To clarify, based on the last statement it seems like you are able to use pod-identity with the node service account by creating a pod identity association. Is that correct?

This should be the case and is expected to work starting in driver v2.1.8 for both controller and node service accounts by creating a pod-identity association for each SA.

If that is the case, are you looking for a better automatic mechanism to create this pod-identity association? Or are you reporting that you have created an association for both but only the controller is properly using the configured IAM role?

2. If pod-identity is not working with efs-csi-node for you, could you share the aws-efs-csi-driver version, EKS version, and node AMI?

3. Could you share an example storage class you are using? Particularly, are you adding the "iam" mount option required for iam/pod-identity mounts?

[yann-soubeyrand]

Yes, I was able to use a pod identity with the node service account by manually creating a pod identity association after having deployed the AWS managed addon.

What I’m asking (but maybe this is not the right place) is to be able to configure a pod identity during the AWS managed addon installation, so that the addon installation creates the pod identity association (just like things work for the controller service account).

[dankova22]

I see, thanks for clarifying that makes sense. We will work with the EKS team that supports this and get back to you.