AWS eks medium security documentation change
Summary
Added documentation for Amazon FSx CSI driver EKS add-on including installation notes, IAM requirements, and dependency on EKS Pod Identity Agent
Security assessment
The change explicitly requires EKS Pod Identity Agent for authentication to prevent add-on failures and mandates IAM roles with AmazonFSxFullAccess permissions. This addresses potential authentication/authorization failures that could impact storage operations.
Diff
diff --git a/eks/latest/userguide/workloads-add-ons-available-eks.md b/eks/latest/userguide/workloads-add-ons-available-eks.md index 6321b3e6a..e88493e40 100644 --- a//eks/latest/userguide/workloads-add-ons-available-eks.md +++ b//eks/latest/userguide/workloads-add-ons-available-eks.md @@ -5 +5 @@ -Amazon VPC CNI plugin for KubernetesCoreDNSKube-proxyAmazon EBS CSI driverAmazon EFS CSI driverMountpoint for Amazon S3 CSI DriverCSI snapshot controllerAmazon SageMaker HyperPod task governanceAWS Network Flow Monitor AgentNode monitoring agentAWS Distro for OpenTelemetryAmazon GuardDuty agentAmazon CloudWatch Observability agentEKS Pod Identity Agent +Amazon VPC CNI plugin for KubernetesCoreDNSKube-proxyAmazon EBS CSI driverAmazon EFS CSI driverAmazon FSx CSI driverMountpoint for Amazon S3 CSI DriverCSI snapshot controllerAmazon SageMaker HyperPod task governanceAWS Network Flow Monitor AgentNode monitoring agentAWS Distro for OpenTelemetryAmazon GuardDuty agentAmazon CloudWatch Observability agentEKS Pod Identity Agent @@ -11 +11 @@ To contribute to this user guide, choose the **Edit this page on GitHub** link t -# AWS Add-ons +# AWS add-ons @@ -23,0 +24 @@ Provide Amazon EFS storage for your cluster | Amazon EFS CSI driver | EC2, EKS +Provide Amazon FSx for Lustre storage for your cluster | Amazon FSx CSI driver | EC2, EKS Auto Mode @@ -161,0 +163,35 @@ To learn more about the add-on, see [Store an elastic file system with Amazon EF +## Amazon FSx CSI driver + +The Amazon FSx CSI driver Amazon EKS add-on is a Kubernetes Container Storage Interface (CSI) plugin that provides Amazon FSx for Lustre storage for your cluster. + +The Amazon EKS add-on name is `aws-fsx-csi-driver`. + +###### Note + + * Pre-existing Amazon FSx CSI driver installations in the cluster can cause add-on installation failures. When you attempt to install the Amazon EKS add-on version while a non-EKS FSx CSI Driver exists, the installation will fail due to resource conflicts. Use the `OVERWRITE` flag during installation to resolve this issue: + + aws eks create-addon --addon-name aws-fsx-csi-driver --cluster-name my-cluster --resolve-conflicts OVERWRITE + + * The Amazon FSx CSI Driver EKS add-on requires the EKS Pod Identity agent for authentication. Without this component, the add-on will fail with the error `Amazon EKS Pod Identity agent is not installed in the cluster`, preventing volume operations. Install the Pod Identity agent before or after deploying the FSx CSI Driver add-on. For more information, see [Set up the Amazon EKS Pod Identity Agent](./pod-id-agent-setup.html). + + + + +### Required IAM permissions + +This add-on utilizes the IAM roles for service accounts capability of Amazon EKS. For more information, see [IAM roles for service accounts](./iam-roles-for-service-accounts.html). The permissions in the [AmazonFSxFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonFSxFullAccess.html) AWS managed policy are required. You can create an IAM role and attach the managed policy to it with the following command. Replace `my-cluster` with the name of your cluster and `AmazonEKS_FSx_CSI_DriverRole` with the name for your role. This command requires that you have [eksctl](https://eksctl.io) installed on your device. + + + eksctl create iamserviceaccount \ + --name fsx-csi-controller-sa \ + --namespace kube-system \ + --cluster my-cluster \ + --role-name AmazonEKS_FSx_CSI_DriverRole \ + --role-only \ + --attach-policy-arn arn:aws:iam::aws:policy/AmazonFSxFullAccess \ + --approve + +### Additional information + +To learn more about the add-on, see [Store high-performance apps with Amazon FSx for Lustre](./fsx-csi.html). +