devops-stack-module-efs-csi-driver

A DevOps Stack module to deploy an Amazon EFS Container Storage Interface (CSI) driver.

The EFS CSI Driver chart used by this module is shipped in this repository as well, in order to avoid any unwanted behaviors caused by unsupported versions.

Current Chart Version	Original Repository	Default Values
3.0.8	Chart	values.yaml

Usage

This module can be declared by adding the following block on your Terraform configuration:

module "efs" {
  source = "git::https://github.com/camptocamp/devops-stack-module-efs-csi-driver.git?ref=<RELEASE>"

  cluster_name            = local.cluster_name
  argocd_namespace        = local.argocd_namespace
  efs_file_system_id      = resource.aws_efs_file_system.eks.id
  create_role             = true
  cluster_oidc_issuer_url = module.eks.cluster_oidc_issuer_url

  depends_on = [
    module.argocd_bootstrap,
  ]
}

In case you want to create an OIDC assumable IAM role on your own, you’ll need to provide the ARN for that role and disable the creation of the role inside of the module as follows:

module "efs" {
  source = "git::https://github.com/camptocamp/devops-stack-module-efs-csi-driver.git?ref=<RELEASE>"

  cluster_name       = local.cluster_name
  argocd_namespace   = local.argocd_namespace
  efs_file_system_id = resource.aws_efs_file_system.eks.id
  create_role        = false
  iam_role_arn       = module.iam_assumable_role_efs.iam_role_arn

  depends_on = [
    module.argocd_bootstrap,
  ]
}

Important

The create_role variable is required. If passing iam_role_arn it should be set as false, otherwise you will need to specify the variable cluster_oidc_issuer_url and set it as true.

This module needs to have other resources created externally. You can follow the example bellow:

resource "aws_efs_file_system" "eks" {
  creation_token = module.eks.cluster_name

  tags = {
    Name = module.eks.cluster_name
  }
}

resource "aws_security_group" "efs_eks" {
  name        = "efs-devops-stack"
  description = "Security group for EFS."
  vpc_id      = module.vpc.vpc_id

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port       = 2049
    to_port         = 2049
    protocol        = "tcp"
    security_groups = [module.eks.node_security_group_id]
  }
}

resource "aws_efs_mount_target" "eks" {
  count = length(local.private_subnets)

  file_system_id  = resource.aws_efs_file_system.eks.id
  subnet_id       = element(module.vpc.private_subnets, count.index)
  security_groups = [resource.aws_security_group.efs_eks.id]
}

Technical Reference

Dependencies

module.argocd_bootstrap

This module must be one of the first ones to be deployed and consequently it needs to be deployed after the module argocd_bootstrap.

Requirements

The following requirements are needed by this module:

• argocd (>= 6)

• null (>= 3)

• utils (>= 1)

Providers

The following providers are used by this module:

• argocd (>= 6)

• utils (>= 1)

• aws

• null (>= 3)

Modules

The following Modules are called:

iam_assumable_role_efs

Source: terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc

Version: ~> 5.0

Resources

The following resources are used by this module:

• argocd_application.this (resource)

• argocd_project.this (resource)

• null_resource.dependencies (resource)

• null_resource.this (resource)

• aws_iam_policy.AmazonEFSCSIDriverPolicy (data source)

• utils_deep_merge_yaml.values (data source)

Required Inputs

The following input variables are required:

efs_file_system_id

Description: EFS Filesystem ID to use by the CSI driver to create volumes.

Type: string

create_role

Description: Boolean to indicate that the OIDC assumable IAM role should be created. If passing iam_role_arn this should be false, otherwise if you want to create the OIDC assumable IAM role provided by this module, you will need to specify the variable cluster_oidc_issuer_url.

Type: bool

Optional Inputs

The following input variables are optional (have default values):

cluster_name

Description: Name given to the cluster. Value used for naming some the resources created by the module.

Type: string

Default: "cluster"

argocd_project

Description: Name of the Argo CD AppProject where the Application should be created. If not set, the Application will be created in a new AppProject only for this Application.

Type: string

Default: null

argocd_labels

Description: Labels to attach to the Argo CD Application resource.

Type: map(string)

Default: {}

destination_cluster

Description: Destination cluster where the application should be deployed.

Type: string

Default: "in-cluster"

target_revision

Description: Override of target revision of the application chart.

Type: string

Default: "v5.0.0"

helm_values

Description: Helm chart value overrides. They should be passed as a list of HCL structures.

Type: any

Default: []

app_autosync

Description: Automated sync options for the Argo CD Application resource.

Type:

object({
    allow_empty = optional(bool)
    prune       = optional(bool)
    self_heal   = optional(bool)
  })

Default:

{
  "allow_empty": false,
  "prune": true,
  "self_heal": true
}

dependency_ids

Description: IDs of the other modules on which this module depends on.

Type: map(string)

Default: {}

resources

Description: Resource limits and requests for aws-efs-csi-driver’s components. Follow the style on official documentation to understand the format of the values."

Note	These are the same values as the defaults on the Helm chart aws-efs-csi-driver.

Type:

object({

    controller = optional(object({
      requests = optional(object({
        cpu    = optional(string, "10m")
        memory = optional(string, "40Mi")
      }), {})
      limits = optional(object({
        cpu    = optional(string)
        memory = optional(string, "256Mi")
      }), {})
    }), {})

    node = optional(object({
      requests = optional(object({
        cpu    = optional(string, "10m")
        memory = optional(string, "40Mi")
      }), {})
      limits = optional(object({
        cpu    = optional(string)
        memory = optional(string, "256Mi")
      }), {})
    }), {})

  })

Default: {}

iam_role_arn

Description: ARN of an OIDC assumable IAM role that has access to the EFS filesystem. When specified, this is added as an annotation to the EFS CSI driver controller ServiceAccount, to allow the driver to manage EFS access points for dynamic volumes provisioning.

Type: string

Default: null

cluster_oidc_issuer_url

Description: Cluster OIDC issuer URL used to create the OIDC assumable IAM role. This variable is required to create a IAM role if you set create_role as true.

Type: string

Default: ""

Outputs

The following outputs are exported:

id

Description: ID to pass other modules in order to refer to this module as a dependency.

Reference in table format

Show tables

= Requirements

Name	Version
argocd	>= 6
null	>= 3
utils	>= 1

= Providers

Name	Version
argocd	>= 6
utils	>= 1
aws	n/a
null	>= 3

= Modules

Name	Source	Version
iam_assumable_role_efs	terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc	~> 5.0

= Resources

Name	Type
argocd_application.this	resource
argocd_project.this	resource
null_resource.dependencies	resource
null_resource.this	resource
aws_iam_policy.AmazonEFSCSIDriverPolicy	data source
utils_deep_merge_yaml.values	data source

= Inputs

Name	Description	Type	Default	Required
cluster_name	Name given to the cluster. Value used for naming some the resources created by the module.	string	"cluster"	no
argocd_project	Name of the Argo CD AppProject where the Application should be created. If not set, the Application will be created in a new AppProject only for this Application.	string	null	no
argocd_labels	Labels to attach to the Argo CD Application resource.	map(string)	{}	no
destination_cluster	Destination cluster where the application should be deployed.	string	"in-cluster"	no
target_revision	Override of target revision of the application chart.	string	"v5.0.0"	no
helm_values	Helm chart value overrides. They should be passed as a list of HCL structures.	any	[]	no
app_autosync	Automated sync options for the Argo CD Application resource.	object({ allow_empty = optional(bool) prune = optional(bool) self_heal = optional(bool) })	{ "allow_empty": false, "prune": true, "self_heal": true }	no
dependency_ids	IDs of the other modules on which this module depends on.	map(string)	{}	no
resources	Resource limits and requests for aws-efs-csi-driver’s components. Follow the style on official documentation to understand the format of the values." Note These are the same values as the defaults on the Helm chart aws-efs-csi-driver.	object({ controller = optional(object({ requests = optional(object({ cpu = optional(string, "10m") memory = optional(string, "40Mi") }), {}) limits = optional(object({ cpu = optional(string) memory = optional(string, "256Mi") }), {}) }), {}) node = optional(object({ requests = optional(object({ cpu = optional(string, "10m") memory = optional(string, "40Mi") }), {}) limits = optional(object({ cpu = optional(string) memory = optional(string, "256Mi") }), {}) }), {}) })	{}	no
efs_file_system_id	EFS Filesystem ID to use by the CSI driver to create volumes.	string	n/a	yes
create_role	Boolean to indicate that the OIDC assumable IAM role should be created. If passing iam_role_arn this should be false, otherwise if you want to create the OIDC assumable IAM role provided by this module, you will need to specify the variable cluster_oidc_issuer_url.	bool	n/a	yes
iam_role_arn	ARN of an OIDC assumable IAM role that has access to the EFS filesystem. When specified, this is added as an annotation to the EFS CSI driver controller ServiceAccount, to allow the driver to manage EFS access points for dynamic volumes provisioning.	string	null	no
cluster_oidc_issuer_url	Cluster OIDC issuer URL used to create the OIDC assumable IAM role. This variable is required to create a IAM role if you set create_role as true.	string	""	no

= Outputs

Name	Description
id	ID to pass other modules in order to refer to this module as a dependency.