Allow controller SA to describe Secrets

For cross account provisioning, the controller pods need to be able to describe K8s Secrets in the kube-system namespace. Additionally, I modified the IAM Role used in our cross-account mount example. Users should use the managed AmazonEFSCSIDriverPolicy, which I've copied here. Eventually, we will update the documentation to point at the managed policy instead of this link.
kubernetes-sigs · Jan 25, 2024 · 4e121a2 · 4e121a2
1 parent 8eb8b1a
commit 4e121a2
Show file tree

Hide file tree

Showing 3 changed files with 112 additions and 27 deletions.
diff --git a/charts/aws-efs-csi-driver/templates/controller-serviceaccount.yaml b/charts/aws-efs-csi-driver/templates/controller-serviceaccount.yaml
@@ -40,10 +40,17 @@ rules:
   - apiGroups: ["coordination.k8s.io"]
     resources: ["leases"]
     verbs: ["get", "watch", "list", "delete", "update", "create"]
-  # - apiGroups: [ "" ]
-  #   resources: [ "secrets" ]
-  #   verbs: [ "get", "watch", "list" ]
-
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: efs-csi-external-provisioner-role-describe-secrets
+  labels:
+    app.kubernetes.io/name: {{ include "aws-efs-csi-driver.name" . }}
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "secrets" ]
+    verbs: [ "get", "watch", "list" ]
 ---
 
 kind: ClusterRoleBinding
@@ -60,3 +67,19 @@ roleRef:
   kind: ClusterRole
   name: efs-csi-external-provisioner-role
   apiGroup: rbac.authorization.k8s.io
+
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: efs-csi-provisioner-binding
+  labels:
+    app.kubernetes.io/name: {{ include "aws-efs-csi-driver.name" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Values.controller.serviceAccount.name }}
+    namespace: kube-system
+roleRef:
+  kind: ClusterRole
+  name: efs-csi-external-provisioner-role-describe-secrets
+  apiGroup: rbac.authorization.k8s.io
diff --git a/deploy/kubernetes/base/controller-serviceaccount.yaml b/deploy/kubernetes/base/controller-serviceaccount.yaml
@@ -36,9 +36,18 @@ rules:
   - apiGroups: ["coordination.k8s.io"]
     resources: ["leases"]
     verbs: ["get", "watch", "list", "delete", "update", "create"]
-  # - apiGroups: [ "" ]
-  #   resources: [ "secrets" ]
-  #   verbs: [ "get", "watch", "list" ]
+---
+# Source: aws-efs-csi-driver/templates/controller-serviceaccount.yaml
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: efs-csi-external-provisioner-role-describe-secrets
+  labels:
+    app.kubernetes.io/name: {{ include "aws-efs-csi-driver.name" . }}
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "secrets" ]
+    verbs: [ "get", "watch", "list" ]
 ---
 # Source: aws-efs-csi-driver/templates/controller-serviceaccount.yaml
 kind: ClusterRoleBinding
@@ -55,3 +64,18 @@ roleRef:
   kind: ClusterRole
   name: efs-csi-external-provisioner-role
   apiGroup: rbac.authorization.k8s.io
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: efs-csi-provisioner-binding
+  labels:
+    app.kubernetes.io/name: {{ include "aws-efs-csi-driver.name" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Values.controller.serviceAccount.name }}
+    namespace: kube-system
+roleRef:
+  kind: ClusterRole
+  name: efs-csi-external-provisioner-role-describe-secrets
+  apiGroup: rbac.authorization.k8s.io
diff --git a/...les/kubernetes/cross_account_mount/iam-policy-examples/describe-mount-target-example.json b/...les/kubernetes/cross_account_mount/iam-policy-examples/describe-mount-target-example.json
@@ -1,24 +1,62 @@
 {
   "Version": "2012-10-17",
   "Statement": [
-    {
-      "Sid" : "Stmt1DescribeMountTargets",
-      "Effect": "Allow",
-      "Action": [
-        "elasticfilesystem:DescribeFileSystems",
-        "elasticfilesystem:DescribeMountTargets",
-        "elasticfilesystem:CreateAccessPoint"
-      ],
-      "Resource": "arn:aws:elasticfilesystem:us-west-2:123456789012:file-system/file-system-ID"
-    },
-    {
-      "Sid" : "Stmt2AdditionalEC2PermissionsToDescribeMountTarget",
-      "Effect": "Allow",
-      "Action": [
-        "ec2:DescribeSubnets",
-        "ec2:DescribeNetworkInterfaces"
-      ],
-      "Resource": "*"
-    }
+      {
+          "Sid": "AllowDescribe",
+          "Effect": "Allow",
+          "Action": [
+              "elasticfilesystem:DescribeAccessPoints",
+              "elasticfilesystem:DescribeFileSystems",
+              "elasticfilesystem:DescribeMountTargets",
+              "ec2:DescribeAvailabilityZones"
+          ],
+          "Resource": "*"
+      },
+      {
+          "Sid": "AllowCreateAccessPoint",
+          "Effect": "Allow",
+          "Action": [
+              "elasticfilesystem:CreateAccessPoint"
+          ],
+          "Resource": "*",
+          "Condition": {
+              "Null": {
+                  "aws:RequestTag/efs.csi.aws.com/cluster": "false"
+              },
+              "ForAllValues:StringEquals": {
+                  "aws:TagKeys": "efs.csi.aws.com/cluster"
+              }
+          }
+      },
+      {
+          "Sid": "AllowTagNewAccessPoints",
+          "Effect": "Allow",
+          "Action": [
+              "elasticfilesystem:TagResource"
+          ],
+          "Resource": "*",
+          "Condition": {
+              "StringEquals": {
+                  "elasticfilesystem:CreateAction": "CreateAccessPoint"
+              },
+              "Null": {
+                  "aws:RequestTag/efs.csi.aws.com/cluster": "false"
+              },
+              "ForAllValues:StringEquals": {
+                  "aws:TagKeys": "efs.csi.aws.com/cluster"
+              }
+          }
+      },
+      {
+          "Sid": "AllowDeleteAccessPoint",
+          "Effect": "Allow",
+          "Action": "elasticfilesystem:DeleteAccessPoint",
+          "Resource": "*",
+          "Condition": {
+              "Null": {
+                  "aws:ResourceTag/efs.csi.aws.com/cluster": "false"
+              }
+          }
+      }
   ]
-}
+}