Chapter 5. Using Container Storage Interface (CSI)

Procedure

1. Create an IAM policy JSON file with the following content:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "elasticfilesystem:DescribeAccessPoints",
           "elasticfilesystem:DescribeFileSystems",
           "elasticfilesystem:DescribeMountTargets",
           "ec2:DescribeAvailabilityZones",
           "elasticfilesystem:TagResource"
         ],
         "Resource": "*"
       },
       {
         "Effect": "Allow",
         "Action": [
           "elasticfilesystem:CreateAccessPoint"
         ],
         "Resource": "*",
         "Condition": {
           "StringLike": {
             "aws:RequestTag/efs.csi.aws.com/cluster": "true"
           }
         }
       },
       {
         "Effect": "Allow",
         "Action": "elasticfilesystem:DeleteAccessPoint",
         "Resource": "*",
         "Condition": {
           "StringEquals": {
             "aws:ResourceTag/efs.csi.aws.com/cluster": "true"
           }
         }
       }
     ]
   }

2. Create an IAM trust JSON file with the following content:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "Federated": "arn:aws:iam::<your_aws_account_ID>:oidc-provider/<openshift_oidc_provider>"  1
         },
         "Action": "sts:AssumeRoleWithWebIdentity",
         "Condition": {
           "StringEquals": {
             "<openshift_oidc_provider>:sub": [  2
               "system:serviceaccount:openshift-cluster-csi-drivers:aws-efs-csi-driver-operator",
               "system:serviceaccount:openshift-cluster-csi-drivers:aws-efs-csi-driver-controller-sa"
             ]
           }
         }
       }
     ]
   }

   1

   Specify your AWS account ID and the OpenShift OIDC provider endpoint.

   Obtain your AWS account ID by running the following command:

   $ aws sts get-caller-identity --query Account --output text

   Obtain the OpenShift OIDC endpoint by running the following command:

   $ rosa describe cluster \
     -c $(oc get clusterversion -o jsonpath='{.items[].spec.clusterID}{"\n"}') \
     -o yaml | awk '/oidc_endpoint_url/ {print $2}' | cut -d '/' -f 3,4

   2

   Specify the OpenShift OIDC endpoint again.

3. Create the IAM role:

   ROLE_ARN=$(aws iam create-role \
     --role-name "<your_cluster_name>-aws-efs-csi-operator" \
     --assume-role-policy-document file://<your_trust_file_name>.json \
     --query "Role.Arn" --output text); echo $ROLE_ARN

   Copy the role ARN. You will need it when you install the AWS EFS CSI Driver Operator.

4. Create the IAM policy:

   POLICY_ARN=$(aws iam create-policy \
     --policy-name "<your_cluster_name>-aws-efs-csi" \
     --policy-document file://<your_policy_file_name>.json \
     --query 'Policy.Arn' --output text); echo $POLICY_ARN

5. Attach the IAM policy to the IAM role:

   $ aws iam attach-role-policy \
     --role-name "<your_cluster_name>-aws-efs-csi-operator" \
     --policy-arn $POLICY_ARN

1. Log in to the web console.

2. Install the AWS EFS CSI Operator:

   1. Click Operators OperatorHub.
   2. Locate the AWS EFS CSI Operator by typing AWS EFS CSI in the filter box.
   3. Click the AWS EFS CSI Driver Operator button.
   Important

   Be sure to select the AWS EFS CSI Driver Operator and not the AWS EFS Operator. The AWS EFS Operator is a community Operator and is not supported by Red Hat.

   1. On the AWS EFS CSI Driver Operator page, click Install.

   2. On the Install Operator page, ensure that:

      • If you are using AWS EFS with AWS Secure Token Service (STS), in the role ARN field, enter the ARN role copied from the last step of the Obtaining a role Amazon Resource Name for Security Token Service procedure.
      • All namespaces on the cluster (default) is selected.
      • Installed Namespace is set to openshift-cluster-csi-drivers.

   3. Click Install.

      After the installation finishes, the AWS EFS CSI Operator is listed in the Installed Operators section of the web console.

Procedure

1. Click Administration CustomResourceDefinitions ClusterCSIDriver.
2. On the Instances tab, click Create ClusterCSIDriver.

3. Use the following YAML file:

   apiVersion: operator.openshift.io/v1
   kind: ClusterCSIDriver
   metadata:
       name: efs.csi.aws.com
   spec:
     managementState: Managed

4. Click Create.

5. Wait for the following Conditions to change to a "True" status:

   • AWSEFSDriverNodeServiceControllerAvailable
   • AWSEFSDriverControllerServiceControllerAvailable

1. Click Administration > CustomResourceDefinitions.
2. On the CustomResourceDefinitions page next to the Name dropdown box, type clustercsidriver.
3. Click CRD ClusterCSIDriver.
4. Click the YAML tab.

5. Under spec.aws.efsVolumeMetrics.state, set the value to RecursiveWalk.

   RecursiveWalk indicates that volume metrics collection in the AWS EFS CSI Driver is performed by recursively walking through the files in the volume.

   Example ClusterCSIDriver efs.csi.aws.com YAML file

   spec:
       driverConfig:
           driverType: AWS
           aws:
               efsVolumeMetrics:
                 state: RecursiveWalk
                 recursiveWalk:
                   refreshPeriodMinutes: 100
                   fsRateLimit: 10

6. Optional: To define how the recursive walk operates, you can also set the following fields:

   • refreshPeriodMinutes: Specifies the refresh frequency for volume metrics in minutes. If this field is left blank, a reasonable default is chosen, which is subject to change over time. The current default is 240 minutes. The valid range is 1 to 43,200 minutes.
   • fsRateLimit: Defines the rate limit for processing volume metrics in goroutines per file system. If this field is left blank, a reasonable default is chosen, which is subject to change over time. The current default is 5 goroutines. The valid range is 1 to 100 goroutines.
7. Click Save.

1. Edit ClusterCSIDriver by running the following command:

   $ oc edit clustercsidriver efs.csi.aws.com

2. Under spec.aws.efsVolumeMetrics.state, set the value to RecursiveWalk.

   RecursiveWalk indicates that volume metrics collection in the AWS EFS CSI Driver is performed by recursively walking through the files in the volume.

   Example ClusterCSIDriver efs.csi.aws.com YAML file

   spec:
       driverConfig:
           driverType: AWS
           aws:
               efsVolumeMetrics:
                 state: RecursiveWalk
                 recursiveWalk:
                   refreshPeriodMinutes: 100
                   fsRateLimit: 10

3. Optional: To define how the recursive walk operates, you can also set the following fields:

   • refreshPeriodMinutes: Specifies the refresh frequency for volume metrics in minutes. If this field is left blank, a reasonable default is chosen, which is subject to change over time. The current default is 240 minutes. The valid range is 1 to 43,200 minutes.
   • fsRateLimit: Defines the rate limit for processing volume metrics in goroutines per file system. If this field is left blank, a reasonable default is chosen, which is subject to change over time. The current default is 5 goroutines. The valid range is 1 to 100 goroutines.
4. Save the changes to the efs.csi.aws.com object.