Skip to content

Commit 6eb4555

Browse files
dallinstevensbryantbiggs
dallinstevens
authored and
bryantbiggs
committed
add fsx openzfs support
1 parent 453e9d6 commit 6eb4555

File tree

3 files changed

+85
-0
lines changed

3 files changed

+85
-0
lines changed

‎modules/iam-role-for-service-accounts-eks/README.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ Creates an IAM role which can be assumed by AWS EKS `ServiceAccount`s with optio
99
- [External DNS](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/aws.md#iam-policy)
1010
- [External Secrets](https://github.com/external-secrets/external-secrets#add-a-secret)
1111
- [FSx for Lustre CSI Driver](https://github.com/kubernetes-sigs/aws-fsx-csi-driver/blob/master/docs/README.md)
12+
- [FSx for OpenZFS CSI Driver](https://github.com/kubernetes-sigs/aws-fsx-openzfs-csi-driver/blob/main/README.md)
1213
- [Karpenter](https://github.com/aws/karpenter/blob/main/website/content/en/preview/getting-started/getting-started-with-karpenter/cloudformation.yaml)
1314
- [Load Balancer Controller](https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/install/iam_policy.json)
1415
- [Load Balancer Controller Target Group Binding Only](https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/deploy/installation/#iam-permission-subset-for-those-who-use-targetgroupbinding-only-and-dont-plan-to-use-the-aws-load-balancer-controller-to-manage-security-group-rules)
@@ -134,6 +135,7 @@ No modules.
134135
| [aws_iam_policy.external_dns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
135136
| [aws_iam_policy.external_secrets](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
136137
| [aws_iam_policy.fsx_lustre_csi](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
138+
| [aws_iam_policy.fsx_openzfs_csi](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
137139
| [aws_iam_policy.karpenter_controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
138140
| [aws_iam_policy.load_balancer_controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
139141
| [aws_iam_policy.load_balancer_controller_targetgroup_only](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
@@ -154,6 +156,7 @@ No modules.
154156
| [aws_iam_role_policy_attachment.external_dns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
155157
| [aws_iam_role_policy_attachment.external_secrets](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
156158
| [aws_iam_role_policy_attachment.fsx_lustre_csi](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
159+
| [aws_iam_role_policy_attachment.fsx_openzfs_csi](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
157160
| [aws_iam_role_policy_attachment.karpenter_controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
158161
| [aws_iam_role_policy_attachment.load_balancer_controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
159162
| [aws_iam_role_policy_attachment.load_balancer_controller_targetgroup_only](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
@@ -174,6 +177,7 @@ No modules.
174177
| [aws_iam_policy_document.external_dns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
175178
| [aws_iam_policy_document.external_secrets](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
176179
| [aws_iam_policy_document.fsx_lustre_csi](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
180+
| [aws_iam_policy_document.fsx_openzfs_csi](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
177181
| [aws_iam_policy_document.karpenter_controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
178182
| [aws_iam_policy_document.load_balancer_controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
179183
| [aws_iam_policy_document.load_balancer_controller_targetgroup_only](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
@@ -204,6 +208,7 @@ No modules.
204208
| <a name="input_attach_external_dns_policy"></a> [attach\_external\_dns\_policy](#input\_attach\_external\_dns\_policy) | Determines whether to attach the External DNS IAM policy to the role | `bool` | `false` | no |
205209
| <a name="input_attach_external_secrets_policy"></a> [attach\_external\_secrets\_policy](#input\_attach\_external\_secrets\_policy) | Determines whether to attach the External Secrets policy to the role | `bool` | `false` | no |
206210
| <a name="input_attach_fsx_lustre_csi_policy"></a> [attach\_fsx\_lustre\_csi\_policy](#input\_attach\_fsx\_lustre\_csi\_policy) | Determines whether to attach the FSx for Lustre CSI Driver IAM policy to the role | `bool` | `false` | no |
211+
| <a name="input_attach_fsx_openzfs_csi_policy"></a> [attach\_fsx\_openzfs\_csi\_policy](#input\_attach\_fsx\_openzfs\_csi\_policy) | Determines whether to attach the FSx for OpenZFS CSI Driver IAM policy to the role | `bool` | `false` | no |
207212
| <a name="input_attach_karpenter_controller_policy"></a> [attach\_karpenter\_controller\_policy](#input\_attach\_karpenter\_controller\_policy) | Determines whether to attach the Karpenter Controller policy to the role | `bool` | `false` | no |
208213
| <a name="input_attach_load_balancer_controller_policy"></a> [attach\_load\_balancer\_controller\_policy](#input\_attach\_load\_balancer\_controller\_policy) | Determines whether to attach the Load Balancer Controller policy to the role | `bool` | `false` | no |
209214
| <a name="input_attach_load_balancer_controller_targetgroup_binding_only_policy"></a> [attach\_load\_balancer\_controller\_targetgroup\_binding\_only\_policy](#input\_attach\_load\_balancer\_controller\_targetgroup\_binding\_only\_policy) | Determines whether to attach the Load Balancer Controller policy for the TargetGroupBinding only | `bool` | `false` | no |
@@ -224,6 +229,7 @@ No modules.
224229
| <a name="input_external_secrets_ssm_parameter_arns"></a> [external\_secrets\_ssm\_parameter\_arns](#input\_external\_secrets\_ssm\_parameter\_arns) | List of Systems Manager Parameter ARNs that contain secrets to mount using External Secrets | `list(string)` | <pre>[<br/> "arn:aws:ssm:*:*:parameter/*"<br/>]</pre> | no |
225230
| <a name="input_force_detach_policies"></a> [force\_detach\_policies](#input\_force\_detach\_policies) | Whether policies should be detached from this role when destroying | `bool` | `true` | no |
226231
| <a name="input_fsx_lustre_csi_service_role_arns"></a> [fsx\_lustre\_csi\_service\_role\_arns](#input\_fsx\_lustre\_csi\_service\_role\_arns) | Service role ARNs to allow FSx for Lustre CSI create and manage FSX for Lustre service linked roles | `list(string)` | <pre>[<br/> "arn:aws:iam::*:role/aws-service-role/s3.data-source.lustre.fsx.amazonaws.com/*"<br/>]</pre> | no |
232+
| <a name="input_fsx_openzfs_csi_service_role_arns"></a> [fsx\_openzfs\_csi\_service\_role\_arns](#input\_fsx\_openzfs\_csi\_service\_role\_arns) | Service role ARNs to allow FSx for OpenZFS CSI create and manage FSX for OpenZFS service linked roles | `list(string)` | <pre>[<br/> "arn:aws:iam::*:role/aws-service-role/fsx.amazonaws.com/*"<br/>]</pre> | no |
227233
| <a name="input_karpenter_controller_cluster_id"></a> [karpenter\_controller\_cluster\_id](#input\_karpenter\_controller\_cluster\_id) | [Deprecated - use `karpenter_controller_cluster_name`] The name of the cluster where the Karpenter controller is provisioned/managing | `string` | `"*"` | no |
228234
| <a name="input_karpenter_controller_cluster_name"></a> [karpenter\_controller\_cluster\_name](#input\_karpenter\_controller\_cluster\_name) | The name of the cluster where the Karpenter controller is provisioned/managing | `string` | `"*"` | no |
229235
| <a name="input_karpenter_controller_node_iam_role_arns"></a> [karpenter\_controller\_node\_iam\_role\_arns](#input\_karpenter\_controller\_node\_iam\_role\_arns) | List of node IAM role ARNs Karpenter can use to launch nodes | `list(string)` | <pre>[<br/> "*"<br/>]</pre> | no |

‎modules/iam-role-for-service-accounts-eks/policies.tf

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -718,6 +718,72 @@ resource "aws_iam_role_policy_attachment" "fsx_lustre_csi" {
718718
policy_arn = aws_iam_policy.fsx_lustre_csi[0].arn
719719
}
720720

721+
722+
################################################################################
723+
# FSx for OpenZFS CSI Driver Policy
724+
################################################################################
725+
726+
# https://github.com/kubernetes-sigs/aws-fsx-openzfs-csi-driver/blob/main/docs/install.md
727+
data "aws_iam_policy_document" "fsx_openzfs_csi" {
728+
count = var.create_role && var.attach_fsx_openzfs_csi_policy ? 1 : 0
729+
730+
statement {
731+
actions = [
732+
"iam:CreateServiceLinkedRole",
733+
"iam:AttachRolePolicy",
734+
"iam:PutRolePolicy"
735+
]
736+
resources = var.fsx_openzfs_csi_service_role_arns
737+
}
738+
739+
statement {
740+
actions = ["iam:CreateServiceLinkedRole"]
741+
resources = ["*"]
742+
743+
condition {
744+
test = "StringLike"
745+
variable = "iam:AWSServiceName"
746+
values = ["fsx.${local.dns_suffix}"]
747+
}
748+
}
749+
750+
statement {
751+
actions = [
752+
"fsx:CreateFileSystem",
753+
"fsx:UpdateFileSystem",
754+
"fsx:DeleteFileSystem",
755+
"fsx:DescribeFileSystems",
756+
"fsx:CreateVolume",
757+
"fsx:DeleteVolume",
758+
"fsx:DescribeVolumes",
759+
"fsx:CreateSnapshot",
760+
"fsx:DeleteSnapshot",
761+
"fsx:DescribeSnapshots",
762+
"fsx:TagResource",
763+
"fsx:ListTagsForResource"
764+
]
765+
resources = ["*"]
766+
}
767+
}
768+
769+
resource "aws_iam_policy" "fsx_openzfs_csi" {
770+
count = var.create_role && var.attach_fsx_openzfs_csi_policy ? 1 : 0
771+
772+
name_prefix = "${var.policy_name_prefix}FSx_OpenZFS_CSI_Policy-"
773+
path = var.role_path
774+
description = "Provides permissions to manage FSx OpenZFS volumes via the container storage interface driver"
775+
policy = data.aws_iam_policy_document.fsx_openzfs_csi[0].json
776+
777+
tags = var.tags
778+
}
779+
780+
resource "aws_iam_role_policy_attachment" "fsx_openzfs_csi" {
781+
count = var.create_role && var.attach_fsx_openzfs_csi_policy ? 1 : 0
782+
783+
role = aws_iam_role.this[0].name
784+
policy_arn = aws_iam_policy.fsx_openzfs_csi[0].arn
785+
}
786+
721787
################################################################################
722788
# Karpenter Controller Policy
723789
################################################################################

‎modules/iam-role-for-service-accounts-eks/variables.tf

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -227,6 +227,19 @@ variable "fsx_lustre_csi_service_role_arns" {
227227
default = ["arn:aws:iam::*:role/aws-service-role/s3.data-source.lustre.fsx.amazonaws.com/*"]
228228
}
229229

230+
# FSx OpenZFS CSI
231+
variable "attach_fsx_openzfs_csi_policy" {
232+
description = "Determines whether to attach the FSx for OpenZFS CSI Driver IAM policy to the role"
233+
type = bool
234+
default = false
235+
}
236+
237+
variable "fsx_openzfs_csi_service_role_arns" {
238+
description = "Service role ARNs to allow FSx for OpenZFS CSI create and manage FSX for openzfs service linked roles"
239+
type = list(string)
240+
default = ["arn:aws:iam::*:role/aws-service-role/fsx.amazonaws.com/*"]
241+
}
242+
230243
# Karpenter controller
231244
variable "attach_karpenter_controller_policy" {
232245
description = "Determines whether to attach the Karpenter Controller policy to the role"

0 commit comments

Comments
 (0)