-
Notifications
You must be signed in to change notification settings - Fork 0
/
storage-provider-efs.tf
146 lines (123 loc) · 4.75 KB
/
storage-provider-efs.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
# # See https://docs.aws.amazon.com/eks/latest/userguide/efs-csi.html
# ################################################################################
# # IAM Policy allowing Nodes access to AWS EFS
# ################################################################################
module "efs_csi_irsa_role" {
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
role_name = "${module.shared.eks_cluster_id}-efs-${module.shared_private.region}"
# Auto attach required EFS IAM Policy
attach_efs_csi_policy = true
oidc_providers = {
main = {
provider_arn = module.shared.eks_cluster_oidc_provider_arn
namespace_service_accounts = ["kube-system:efs-csi-controller-sa"]
}
}
tags = var.default_resource_tags
}
# ################################################################################
# # Deploy aws-efs-csi-controller
# ################################################################################
resource "helm_release" "aws_efs_csi_driver" {
name = "aws-efs-csi-driver"
repository = "https://kubernetes-sigs.github.io/aws-efs-csi-driver"
chart = "aws-efs-csi-driver"
version = "2.5.2"
namespace = "kube-system"
set {
name = "controller.nodeSelector.instancegroup"
value = "vendorcorp-core"
}
set {
name = "controller.tolerations[0].key"
value = "dedicated"
}
set {
name = "controller.tolerations[0].value"
value = "vendorcorp-core"
}
set {
name = "controller.tolerations[0].operator"
value = "Equal"
}
set {
name = "controller.tolerations[0].effect"
value = "NoSchedule"
}
set {
name = "controller.serviceAccount.name"
value = "efs-csi-controller-sa"
}
set {
name = "controller.serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn"
value = module.efs_csi_irsa_role.iam_role_arn
}
set {
name = "node.serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn"
value = module.efs_csi_irsa_role.iam_role_arn
}
}
# ################################################################################
# # KMS Key for EFS encryption
# ################################################################################
resource "aws_kms_key" "efs_kms_key" {
description = "EFS Secret Encryption Key"
deletion_window_in_days = 30
enable_key_rotation = true
tags = var.default_resource_tags
}
# ################################################################################
# # Create EFS Filesystem
# ################################################################################
resource "aws_efs_file_system" "vendorcorp_eks_efs" {
creation_token = "${module.shared.eks_cluster_id}-efs"
encrypted = true
kms_key_id = aws_kms_key.efs_kms_key.arn
performance_mode = "generalPurpose"
throughput_mode = "bursting"
tags = merge(tomap({ Name = "Vendor Corp EFS for ${module.shared.eks_cluster_id}" }), var.default_resource_tags)
}
# ################################################################################
# Create Security Group to allow EFS access from EKS Nodes
# ################################################################################
resource "aws_security_group" "eks_node_efs_mount_access" {
name = "${module.shared.eks_cluster_id}-efs-mount-sg"
description = "Allow nodes in ${module.shared.eks_cluster_id} Cluster to mount EFS via NFS"
vpc_id = module.shared_private.vpc_id
ingress {
cidr_blocks = module.shared_private.private_subnet_cidrs
from_port = 2049
to_port = 2049
protocol = "tcp"
}
}
# ################################################################################
# Expose EFS Filesystem on our EKS Subnets
# ################################################################################
resource "aws_efs_mount_target" "efs_mount_targets" {
for_each = module.shared_private.private_subnet_ids_az_map
file_system_id = aws_efs_file_system.vendorcorp_eks_efs.id
security_groups = [aws_security_group.eks_node_efs_mount_access.id]
subnet_id = each.value
}
# ################################################################################
# k8s Storage Class to use our EFS Filesystem
# ################################################################################
resource "kubernetes_storage_class" "storage_class_efs" {
metadata {
name = "efs-fs"
annotations = {
"storageclass.kubernetes.io/is-default-class" = "true"
}
}
storage_provisioner = "efs.csi.aws.com"
# mount_options = ["tls"]
parameters = {
basePath = "/dynamic-efs-fs"
directoryPerms = "700"
fileSystemId = aws_efs_file_system.vendorcorp_eks_efs.id
gidRangeStart = "1000"
gidRangeEnd = "2000"
provisioningMode = "efs-ap"
}
}