Migrate EBS CSI policy to AmazonEBSCSIDriverPolicy managed policy #8422
+17
−294
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Today,
eksctl
applies an EBS CSI policy that is hardcoded inside ofeksctl
itself. This policy is out of date, in particular missing the change from kubernetes-sigs/aws-ebs-csi-driver#2190 which means that installations of the EBS CSI Driver fromeksctl
cannot create snapshots (without manually tweaking the policy).Rather than continue to use a manual policy that must be kept in sync, this PR switches the EBS CSI policy over to the AWS-managed
AmazonEBSCSIDriverPolicy
(https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEBSCSIDriverPolicy.html). Because this is an AWS-managed policy, this means any important policy changes will be synced by AWS and no manual change is needed ineksctl
.Checklist
README.md
, or theuserdocs
directory) - Don't think the docs need an update, but let me know if I missed somethingarea/nodegroup
) and kind (e.g.kind/improvement
)BONUS POINTS checklist: complete for good vibes and maybe prizes?! 🤯