Support Dynamic Provisioning of PersistentVolumes on AWS

[iaguis]

This means PersistentVolumeClaims created are automatically provisioned with an EBS volume.

To do that we can use https://github.com/kubernetes-sigs/aws-ebs-csi-driver/

I took some notes while testing it that I captured in #145 (comment):

• Created an IAM user with the following policy https://github.com/kubernetes-sigs/aws-ebs-csi-driver/blob/master/docs/example-iam-policy.json
• Created a secret with this manifest https://github.com/kubernetes-sigs/aws-ebs-csi-driver/blob/master/deploy/kubernetes/secret.yaml and put the new IAM user access data there
• Edited the kube-apiserver deployment to add the following flag: --feature-gates=CSINodeInfo=true,CSIDriverRegistry=true,CSIBlockVolume=true,VolumeSnapshotDataSource=true
  • Note: this might not be needed because I see those feature gates are enabled by default k8s v1.17
• Edited the kubelet daemonset to add the following flag: --feature-gates=CSINodeInfo=true,CSIDriverRegistry=true,CSIBlockVolume=true
  • Note: this might not be needed because I see those feature gates are enabled by default k8s v1.17
• Applied the YAML files in here: https://github.com/kubernetes-sigs/aws-ebs-csi-driver/tree/master/deploy/kubernetes/base

After that, I followed their Dynamic Provisioning example and everything worked as expected: the StorageClass was created, the PersistentVolumeClaim was created and after some seconds it was Bound, then the Pod using that claim was started and I could see that the Volume worked.

As they mention in their readme There are two ways to grant permissions to the ebs-csi-driver:

• Creating an IAM user and adding its credentials to the cluster as a secret (the way I used)
• Giving the InstanceProfile the right permissions for Worker nodes.

I'm not sure what's best so we should discuss it: the InstanceProfile route would mean that anything on that machine can do the operations listed in the policy IIUC so it seems creating an IAM user and placing it in a secret is safer (making sure the cluster is set up properly so only the CSI driver has access to the secret, of course).

[johananl]

Note that before we can safely attach IAM roles to nodes, we should implement #467 for AWS.

[iaguis]

Fixed by #423