Feature | DemoApps: Add EKS EFS Add-on and a simple layer to provision an EFS file system

apps-devstg/us-east-1/k8s-eks-demoapps/cluster/locals.tf

@@ -34,9 +34,9 @@ locals {
   # If you plan to use EKS managed add-ons keep in mind that some add-ons rely
   # on IAM roles which need to be created/updated for them to work. Said roles
   # are defined in the "identities" layer which needs to be applied only after
-  # the cluster is up and running. You can orchestrate that execution in order
-  # by toggling the "use_managed_addons" variable.
-  # The execution order should be:
+  # the cluster is up and running. You can orchestrate that execution in that
+  # order by toggling the "use_managed_addons" variable in "variables.tf".
+  # Said execution order should go as follows:
   #   1. Apply this layer
   #   2. Apply the identities layers
   #   3. Enable the "use_managed_addons" variable and apply this layer again
@@ -60,6 +60,11 @@ locals {
       resolve_conflicts        = "OVERWRITE"
       service_account_role_arn = data.terraform_remote_state.cluster-identities.outputs.eks_addons_ebs_csi
     }
+    aws-efs-csi-driver = {
+      addon_version            = "v1.7.1-eksbuild.1"
+      resolve_conflicts        = "OVERWRITE"
+      service_account_role_arn = data.terraform_remote_state.cluster-identities.outputs.eks_addons_efs_csi
+    }
   }
   addons_enabled = var.use_managed_addons ? local.addons_available : {}
 }

apps-devstg/us-east-1/k8s-eks-demoapps/identities/ids_eks_addons_efs_csi.tf

@@ -0,0 +1,19 @@
+#
+# EKS Add-ons: EBS CSI
+#
+module "role_eks_addons_efs_csi" {
+  source = "github.com/binbashar/terraform-aws-iam.git//modules/iam-role-for-service-accounts-eks?ref=v5.32.0"
+
+  create_role           = true
+  role_name             = "efs-csi"
+  attach_efs_csi_policy = true
+
+  oidc_providers = {
+    ex = {
+      provider_arn               = data.terraform_remote_state.cluster.outputs.cluster_oidc_provider_arn
+      namespace_service_accounts = ["kube-system:efs-csi-controller-sa"]
+    }
+  }
+
+  tags = local.tags
+}

apps-devstg/us-east-1/k8s-eks-demoapps/identities/outputs.tf

@@ -42,3 +42,8 @@ output "eks_addons_ebs_csi" {
   description = "EKS Add-ons EBS CSI Role ARN"
   value       = module.role_eks_addons_ebs_csi.iam_role_arn
 }
+
+output "eks_addons_efs_csi" {
+  description = "EKS Add-ons EFS CSI Role ARN"
+  value       = module.role_eks_addons_efs_csi.iam_role_arn
+}

apps-devstg/us-east-1/k8s-eks-demoapps/network/locals.tf

@@ -15,22 +15,23 @@ locals {
     "${var.region}a",
     "${var.region}b",
     "${var.region}c",
+    # "${var.region}d",
   ]
 
   private_subnets_cidr = ["10.1.0.0/17"]
   private_subnets = [
     "10.1.0.0/19",
     "10.1.32.0/19",
     "10.1.64.0/19",
-    "10.1.96.0/19"
+    # "10.1.96.0/19"
   ]
 
   public_subnets_cidr = ["10.1.128.0/17"]
   public_subnets = [
     "10.1.128.0/19",
     "10.1.160.0/19",
     "10.1.192.0/19",
-    "10.1.224.0/19"
+    # "10.1.224.0/19"
   ]
 
   tags = {

apps-devstg/us-east-1/k8s-eks-demoapps/storage/efs/common-variables.tf

@@ -0,0 +1 @@
+../../../../../config/common-variables.tf

apps-devstg/us-east-1/k8s-eks-demoapps/storage/efs/config.tf

@@ -0,0 +1,35 @@
+#
+# AWS Provider Settings
+#
+provider "aws" {
+  region  = var.region
+  profile = var.profile
+}
+
+#
+# Backend Config (partial)
+#
+terraform {
+  required_version = "~> 1.2"
+
+  required_providers {
+    aws = "~> 4.11"
+  }
+
+  backend "s3" {
+    key = "apps-devstg/k8s-eks-demoapps/storage/efs/terraform.tfstate"
+  }
+}
+
+#
+# Data sources
+#
+data "terraform_remote_state" "cluster-vpc" {
+  backend = "s3"
+  config = {
+    region  = var.region
+    profile = var.profile
+    bucket  = var.bucket
+    key     = "${var.environment}/k8s-eks-demoapps/network/terraform.tfstate"
+  }
+}

apps-devstg/us-east-1/k8s-eks-demoapps/storage/efs/locals.tf

@@ -0,0 +1,7 @@
+locals {
+  tags = {
+    Terraform   = "true"
+    Environment = var.environment
+    Project     = var.project
+  }
+}

apps-devstg/us-east-1/k8s-eks-demoapps/storage/efs/main.tf

@@ -0,0 +1,57 @@
+#------------------------------------------------------------------------------
+# EFS
+# Create a file system to be used by EKS.
+# (https://github.com/kubernetes-sigs/aws-efs-csi-driver/)
+#------------------------------------------------------------------------------
+# Requirements:
+#   - Install the EFS CSI EKS Add-on via the "cluster" layer
+#------------------------------------------------------------------------------
+# TODO
+#   - Use encrypted file systems
+#   - Test replication and backups
+#------------------------------------------------------------------------------
+module "example_efs_file_system" {
+  source = "github.com/terraform-aws-modules/terraform-aws-efs.git?ref=v1.3.1"
+
+  # General specs
+  name             = "eks-example"
+  performance_mode = "generalPurpose"
+  throughput_mode  = "bursting"
+
+  # Use encrypted if necessary
+  # encrypted      = true
+  # kms_key_arn    = "arn:aws:kms:eu-west-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
+
+  # Define mount targets
+  mount_targets = {
+    for idx, subnet_id in data.terraform_remote_state.cluster-vpc.outputs.private_subnets :
+    idx => {
+      "subnet_id" = subnet_id
+    }
+  }
+
+  # Create security group and rules
+  security_group_description = "Example EKS EFS"
+  security_group_vpc_id      = data.terraform_remote_state.cluster-vpc.outputs.vpc_id
+  security_group_rules = {
+    eks_vpc_private_subnets = {
+      description = "Allow EKS VPC private subnets"
+      cidr_blocks = data.terraform_remote_state.cluster-vpc.outputs.private_subnets_cidr
+    }
+  }
+
+  # Enable backup policy if necessary
+  enable_backup_policy = false
+
+  # Enable cross-region replication if necessary
+  # create_replication_configuration = true
+  # replication_configuration_destination = {
+  #  region = var.region_secondary
+  # }
+
+  # Make sure you know what you are doing when using file system policies since
+  # it is recommended that you do that but it might complicate the setup
+  attach_policy = false
+
+  tags = local.tags
+}

management/global/sso/policies.tf

@@ -32,6 +32,7 @@ data "aws_iam_policy_document" "devops" {
       "ecr:*",
       "ecr-public:*",
       "ecs:*",
+      "elasticfilesystem:*",
       "eks:*",
       "elasticbeanstalk:*",
       "elasticloadbalancing:*",