devops-stack-module-efs-csi-driver

A DevOps Stack module to deploy an Amazon EFS Container Storage Interface (CSI) driver.

The EFS CSI Driver chart used by this module is shipped in this repository as well, in order to avoid any unwanted behaviors caused by unsupported versions.

Current Chart Version	Original Repository	Default Values
3.0.8	Chart	`values.yaml`

Usage

This module can be declared by adding the following block on your Terraform configuration:

module "efs" {
  source = "git::https://github.com/camptocamp/devops-stack-module-efs-csi-driver.git?ref=<RELEASE>"

  cluster_name            = local.cluster_name
  argocd_namespace        = local.argocd_namespace
  efs_file_system_id      = resource.aws_efs_file_system.eks.id
  create_role             = true
  cluster_oidc_issuer_url = module.eks.cluster_oidc_issuer_url

  depends_on = [
    module.argocd_bootstrap,
  ]
}

In case you want to create an OIDC assumable IAM role on your own, you’ll need to provide the ARN for that role and disable the creation of the role inside of the module as follows:

module "efs" {
  source = "git::https://github.com/camptocamp/devops-stack-module-efs-csi-driver.git?ref=<RELEASE>"

  cluster_name       = local.cluster_name
  argocd_namespace   = local.argocd_namespace
  efs_file_system_id = resource.aws_efs_file_system.eks.id
  create_role        = false
  iam_role_arn       = module.iam_assumable_role_efs.iam_role_arn

  depends_on = [
    module.argocd_bootstrap,
  ]
}

Important

The create_role variable is required. If passing iam_role_arn it should be set as false, otherwise you will need to specify the variable cluster_oidc_issuer_url and set it as true.

This module needs to have other resources created externally. You can follow the example bellow:

resource "aws_efs_file_system" "eks" {
  creation_token = module.eks.cluster_name

  tags = {
    Name = module.eks.cluster_name
  }
}

resource "aws_security_group" "efs_eks" {
  name        = "efs-devops-stack"
  description = "Security group for EFS."
  vpc_id      = module.vpc.vpc_id

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port       = 2049
    to_port         = 2049
    protocol        = "tcp"
    security_groups = [module.eks.node_security_group_id]
  }
}

resource "aws_efs_mount_target" "eks" {
  count = length(local.private_subnets)

  file_system_id  = resource.aws_efs_file_system.eks.id
  subnet_id       = element(module.vpc.private_subnets, count.index)
  security_groups = [resource.aws_security_group.efs_eks.id]
}

Technical Reference

Dependencies

`module.argocd_bootstrap`

This module must be one of the first ones to be deployed and consequently it needs to be deployed after the module argocd_bootstrap.

Requirements

The following requirements are needed by this module:

argocd (>= 6)
null (>= 3)
utils (>= 1)

Providers

The following providers are used by this module:

argocd (>= 6)
utils (>= 1)
aws
null (>= 3)

Modules

The following Modules are called:

iam_assumable_role_efs

Source: terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc

Version: ~> 5.0

Resources

The following resources are used by this module:

argocd_application.this (resource)
argocd_project.this (resource)
null_resource.dependencies (resource)
null_resource.this (resource)
aws_iam_policy.AmazonEFSCSIDriverPolicy (data source)
utils_deep_merge_yaml.values (data source)

Required Inputs

The following input variables are required:

efs_file_system_id

Description: EFS Filesystem ID to use by the CSI driver to create volumes.

Type: string

Description: Boolean to indicate that the OIDC assumable IAM role should be created. If passing iam_role_arn this should be false, otherwise if you want to create the OIDC assumable IAM role provided by this module, you will need to specify the variable cluster_oidc_issuer_url.

Type: bool

Optional Inputs

The following input variables are optional (have default values):

cluster_name

Description: Name given to the cluster. Value used for naming some the resources created by the module.

Type: string

Default: "cluster"

argocd_project

Description: Name of the Argo CD AppProject where the Application should be created. If not set, the Application will be created in a new AppProject only for this Application.

Type: string

Default: null

argocd_labels

Description: Labels to attach to the Argo CD Application resource.

Type: map(string)

Default: {}

destination_cluster

Description: Destination cluster where the application should be deployed.

Type: string

Default: "in-cluster"

target_revision

Description: Override of target revision of the application chart.

Type: string

Default: "v5.0.0"

helm_values

Description: Helm chart value overrides. They should be passed as a list of HCL structures.

Type: any

Default: []

app_autosync

Description: Automated sync options for the Argo CD Application resource.

Type:

object({
    allow_empty = optional(bool)
    prune       = optional(bool)
    self_heal   = optional(bool)
  })

Default:

{
  "allow_empty": false,
  "prune": true,
  "self_heal": true
}

dependency_ids

Description: IDs of the other modules on which this module depends on.

Type: map(string)

Default: {}

resources

Description: Resource limits and requests for aws-efs-csi-driver’s components. Follow the style on official documentation to understand the format of the values."

Note	These are the same values as the defaults on the Helm chart aws-efs-csi-driver.

Type:

object({

    controller = optional(object({
      requests = optional(object({
        cpu    = optional(string, "10m")
        memory = optional(string, "40Mi")
      }), {})
      limits = optional(object({
        cpu    = optional(string)
        memory = optional(string, "256Mi")
      }), {})
    }), {})

    node = optional(object({
      requests = optional(object({
        cpu    = optional(string, "10m")
        memory = optional(string, "40Mi")
      }), {})
      limits = optional(object({
        cpu    = optional(string)
        memory = optional(string, "256Mi")
      }), {})
    }), {})

  })

Default: {}

iam_role_arn

Description: ARN of an OIDC assumable IAM role that has access to the EFS filesystem. When specified, this is added as an annotation to the EFS CSI driver controller ServiceAccount, to allow the driver to manage EFS access points for dynamic volumes provisioning.

Type: string

Default: null

cluster_oidc_issuer_url

Description: Cluster OIDC issuer URL used to create the OIDC assumable IAM role. This variable is required to create a IAM role if you set create_role as true.

Type: string

Default: ""

Outputs

The following outputs are exported:

id

Description: ID to pass other modules in order to refer to this module as a dependency.

Reference in table format

Show tables

= Requirements

Name	Version
argocd	>= 6
null	>= 3
utils	>= 1

= Providers

Name	Version
argocd	>= 6
utils	>= 1
aws	n/a
null	>= 3

= Modules

Name	Source	Version
iam_assumable_role_efs	terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc	~> 5.0

= Resources

Name	Type
argocd_application.this	resource
argocd_project.this	resource
null_resource.dependencies	resource
null_resource.this	resource
aws_iam_policy.AmazonEFSCSIDriverPolicy	data source
utils_deep_merge_yaml.values	data source

= Inputs

Name Description Type Default Required

cluster_name

Name given to the cluster. Value used for naming some the resources created by the module.

string

"cluster"

no

argocd_project

Name of the Argo CD AppProject where the Application should be created. If not set, the Application will be created in a new AppProject only for this Application.

string

null

no

argocd_labels

Labels to attach to the Argo CD Application resource.

map(string)

{}

no

destination_cluster

Destination cluster where the application should be deployed.

string

"in-cluster"

no

target_revision

Override of target revision of the application chart.

string

"v5.0.0"

no

helm_values

Helm chart value overrides. They should be passed as a list of HCL structures.

any

[]

no

app_autosync

Automated sync options for the Argo CD Application resource.

object({
    allow_empty = optional(bool)
    prune       = optional(bool)
    self_heal   = optional(bool)
  })

{
  "allow_empty": false,
  "prune": true,
  "self_heal": true
}

no

dependency_ids

IDs of the other modules on which this module depends on.

map(string)

{}

no

resources

Resource limits and requests for aws-efs-csi-driver’s components. Follow the style on official documentation to understand the format of the values."

Note	These are the same values as the defaults on the Helm chart aws-efs-csi-driver.

object({

    controller = optional(object({
      requests = optional(object({
        cpu    = optional(string, "10m")
        memory = optional(string, "40Mi")
      }), {})
      limits = optional(object({
        cpu    = optional(string)
        memory = optional(string, "256Mi")
      }), {})
    }), {})

    node = optional(object({
      requests = optional(object({
        cpu    = optional(string, "10m")
        memory = optional(string, "40Mi")
      }), {})
      limits = optional(object({
        cpu    = optional(string)
        memory = optional(string, "256Mi")
      }), {})
    }), {})

  })

{}

no

efs_file_system_id

EFS Filesystem ID to use by the CSI driver to create volumes.

string

n/a

yes

create_role

Boolean to indicate that the OIDC assumable IAM role should be created. If passing iam_role_arn this should be false, otherwise if you want to create the OIDC assumable IAM role provided by this module, you will need to specify the variable cluster_oidc_issuer_url.

bool

n/a

yes

iam_role_arn

ARN of an OIDC assumable IAM role that has access to the EFS filesystem. When specified, this is added as an annotation to the EFS CSI driver controller ServiceAccount, to allow the driver to manage EFS access points for dynamic volumes provisioning.

string

null

no

cluster_oidc_issuer_url

Cluster OIDC issuer URL used to create the OIDC assumable IAM role. This variable is required to create a IAM role if you set create_role as true.

string

""

no

= Outputs

Name	Description
id	ID to pass other modules in order to refer to this module as a dependency.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

README.adoc

README.adoc

devops-stack-module-efs-csi-driver

Usage

Technical Reference

Dependencies

`module.argocd_bootstrap`

Requirements

Providers

Modules

iam_assumable_role_efs

Resources

Required Inputs

efs_file_system_id

create_role

Optional Inputs

cluster_name

argocd_project

argocd_labels

destination_cluster

target_revision

helm_values

app_autosync

dependency_ids

resources

iam_role_arn

cluster_oidc_issuer_url

Outputs

id

Reference in table format

Files

README.adoc

Latest commit

History

README.adoc

File metadata and controls

devops-stack-module-efs-csi-driver

Usage

Technical Reference

Dependencies

module.argocd_bootstrap

Requirements

Providers

Modules

Resources

Required Inputs

Optional Inputs

Outputs

Reference in table format

`module.argocd_bootstrap`