5.11. AWS Elastic File Service CSI Driver Operator

在 AWS 帐户 B 中创建 EFS 卷：

配置 AWS 帐户 B 上 AWS EFS 卷的网络访问：

在 AWS 帐户 A 的 OpenShift Container Platform 集群 VPC 和 AWS 帐户 B 中的 AWS EFS VPC 之间创建 VPC 对等：

确保两个 VPC 使用不同的网络 CIDR，并在创建 VPC 对等后，在每个 VPC 中添加路由来连接两个 VPC 网络。

在 AWS 帐户 B 中创建一个 IAM 角色，如 "my-efs-acrossaccount-role"，它与 AWS 帐户 A 具有信任关系，并使用调用"my-efs-acrossaccount-driver-policy"的权限添加内联 AWS EFS 策略。

这个角色供在 AWS 帐户 A 的 OpenShift Container Platform 集群上运行的 CSI 驱动程序控制器服务决定 AWS 帐户 B 中文件系统的挂载目标。

# Trust relationships trusted entity trusted account A configuration on my-efs-acrossaccount-role in account B

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::301721915996:root"
            },
            "Action": "sts:AssumeRole",
            "Condition": {}
        }
    ]
}

# my-cross-account-assume-policy policy attached to my-efs-acrossaccount-role in account B

{
    "Version": "2012-10-17",
    "Statement": {
        "Effect": "Allow",
        "Action": "sts:AssumeRole",
        "Resource": "arn:aws:iam::589722580343:role/my-efs-acrossaccount-role"
    }
}

# my-efs-acrossaccount-driver-policy attached to my-efs-acrossaccount-role in account B

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeNetworkInterfaces",
                "ec2:DescribeSubnets"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "elasticfilesystem:DescribeMountTargets",
                "elasticfilesystem:DeleteAccessPoint",
                "elasticfilesystem:ClientMount",
                "elasticfilesystem:DescribeAccessPoints",
                "elasticfilesystem:ClientWrite",
                "elasticfilesystem:ClientRootAccess",
                "elasticfilesystem:DescribeFileSystems",
                "elasticfilesystem:CreateAccessPoint"
            ],
            "Resource": [
                "arn:aws:elasticfilesystem:*:589722580343:access-point/*",
                "arn:aws:elasticfilesystem:*:589722580343:file-system/*"
            ]
        }
    ]
}

在 AWS 帐户 A 中，将内联策略附加到 AWS EFS CSI 驱动程序控制器服务帐户的 IAM 角色中，并具有在之前创建的 IAM 角色上执行安全令牌服务(STS)所需的权限。

# my-cross-account-assume-policy policy attached to Openshift cluster efs csi driver user in account A

{
    "Version": "2012-10-17",
    "Statement": {
        "Effect": "Allow",
        "Action": "sts:AssumeRole",
        "Resource": "arn:aws:iam::589722580343:role/my-efs-acrossaccount-role"
    }
}

创建一个 Kubernetes secret，使用 awsRoleArn 作为键，以及之前创建的角色作为值：

$ oc -n openshift-cluster-csi-drivers create secret generic my-efs-cross-account --from-literal=awsRoleArn='arn:aws:iam::589722580343:role/my-efs-acrossaccount-role'

由于驱动程序控制器需要从 secret 获取跨帐户角色信息，您需要将 secret 角色绑定添加到 AWS EFS CSI 驱动程序控制器 ServiceAccount (SA)：

$ oc -n openshift-cluster-csi-drivers create role access-secrets --verb=get,list,watch --resource=secrets

$ oc -n openshift-cluster-csi-drivers create rolebinding --role=access-secrets default-to-secrets --serviceaccount=openshift-cluster-csi-drivers:aws-efs-csi-driver-controller-sa

在帐户 B 中为文件系统 (AWS EFS 卷) 中创建一个 filesystem 策略，它允许 AWS 帐户 A 在其上执行挂载。

This step is not mandatory, but can be safer for AWS EFS volume usage.

# EFS volume filesystem policy in account B
{
    "Version": "2012-10-17",
    "Id": "efs-policy-wizard-8089bf4a-9787-40f0-958e-bc2363012ace",
    "Statement": [
        {
            "Sid": "efs-statement-bd285549-cfa2-4f8b-861e-c372399fd238",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": [
                "elasticfilesystem:ClientRootAccess",
                "elasticfilesystem:ClientWrite",
                "elasticfilesystem:ClientMount"
            ],
            "Resource": "arn:aws:elasticfilesystem:us-east-2:589722580343:file-system/fs-091066a9bf9becbd5",
            "Condition": {
                "Bool": {
                    "elasticfilesystem:AccessedViaMountTarget": "true"
                }
            }
        },
        {
            "Sid": "efs-statement-03646e39-d80f-4daf-b396-281be1e43bab",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::589722580343:role/my-efs-acrossaccount-role"
            },
            "Action": [
                "elasticfilesystem:ClientRootAccess",
                "elasticfilesystem:ClientWrite",
                "elasticfilesystem:ClientMount"
            ],
            "Resource": "arn:aws:elasticfilesystem:us-east-2:589722580343:file-system/fs-091066a9bf9becbd5"
        }
    ]
}

使用类似如下的配置创建 AWS EFS 卷存储类：

# The cross account efs volume storageClass
kind: StorageClass
apiVersion: storage.k8s.io/v1
metadata:
  name: efs-cross-account-mount-sc
provisioner: efs.csi.aws.com
mountOptions:
  - tls
parameters:
  provisioningMode: efs-ap
  fileSystemId: fs-00f6c3ae6f06388bb
  directoryPerms: "700"
  gidRangeStart: "1000"
  gidRangeEnd: "2000"
  basePath: "/account-a-data"
  csi.storage.k8s.io/provisioner-secret-name: my-efs-cross-account
  csi.storage.k8s.io/provisioner-secret-namespace: openshift-cluster-csi-drivers
volumeBindingMode: Immediate

点击 Create 文件系统 ：

等待卷和挂载目标完成完全创建：

在 Inbound rules 选项卡中，点 Edit inbound rules，然后使用以下设置添加新规则，以允许 OpenShift Container Platform 节点访问 EFS 卷：

删除所有 AWS EFS PV：

卸载 AWS EFS CSI 驱动程序 ：

卸载 AWS EFS CSI Operator：