Add well-known IRSA policy for the EBS CSI driver

Add well-known IAM policy support for EBS CSI driver/controller IAM role service accounts.
eksctl-io · Apr 4, 2021 · b56343a · b56343a
1 parent 34f77ed
commit b56343a
Show file tree

Hide file tree

Showing 4 changed files with 21 additions and 5 deletions.
diff --git a/pkg/apis/eksctl.io/v1alpha5/assets/schema.json b/pkg/apis/eksctl.io/v1alpha5/assets/schema.json
@@ -2007,6 +2007,12 @@
           "x-intellij-html-description": "adds cert-manager policies. See <a href=\"https://cert-manager.io/docs/configuration/acme/dns01/route53\">cert-manager docs</a>.",
           "default": "false"
         },
+        "ebsCSIController": {
+          "type": "boolean",
+          "description": "adds policies for using the ebs-csi-controller. See [aws-ebs-csi-driver docs](https://github.com/kubernetes-sigs/aws-ebs-csi-driver#set-up-driver-permission).",
+          "x-intellij-html-description": "adds policies for using the ebs-csi-controller. See <a href=\"https://github.com/kubernetes-sigs/aws-ebs-csi-driver#set-up-driver-permission\">aws-ebs-csi-driver docs</a>.",
+          "default": "false"
+        },
         "externalDNS": {
           "type": "boolean",
           "description": "adds external-dns policies for Amazon Route 53. See [external-dns docs](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/aws.md).",
@@ -2025,7 +2031,8 @@
         "autoScaler",
         "awsLoadBalancerController",
         "externalDNS",
-        "certManager"
+        "certManager",
+        "ebsCSIController"
       ],
       "additionalProperties": false,
       "description": "for attaching common IAM policies",

diff --git a/pkg/apis/eksctl.io/v1alpha5/schema.go b/pkg/apis/eksctl.io/v1alpha5/schema.go
diff --git a/pkg/apis/eksctl.io/v1alpha5/well_known_iam_policy.go b/pkg/apis/eksctl.io/v1alpha5/well_known_iam_policy.go
@@ -18,8 +18,12 @@ type WellKnownPolicies struct {
 	// CertManager adds cert-manager policies. See [cert-manager
 	// docs](https://cert-manager.io/docs/configuration/acme/dns01/route53).
 	CertManager bool `json:"certManager,inline"`
+	// EBSCSIController adds policies for using the
+	// ebs-csi-controller. See [aws-ebs-csi-driver
+	// docs](https://github.com/kubernetes-sigs/aws-ebs-csi-driver#set-up-driver-permission).
+	EBSCSIController bool `json:"ebsCSIController,inline"`
 }
 
 func (p *WellKnownPolicies) HasPolicy() bool {
-	return p.ImageBuilder || p.AutoScaler || p.AWSLoadBalancerController || p.ExternalDNS || p.CertManager
+	return p.ImageBuilder || p.AutoScaler || p.AWSLoadBalancerController || p.ExternalDNS || p.CertManager || p.EBSCSIController
 }
diff --git a/pkg/cfn/builder/iam_helper.go b/pkg/cfn/builder/iam_helper.go
@@ -62,6 +62,11 @@ func createWellKnownPolicies(wellKnownPolicies api.WellKnownPolicies) ([]managed
 			}...,
 		)
 	}
+	if wellKnownPolicies.EBSCSIController {
+		customPolicies = append(customPolicies,
+			customPolicyForRole{Name: "PolicyEBSCSIController", Statements: ebsStatements()},
+		)
+	}
 	return managedPolicies, customPolicies
 }