Amazon EKS创建EBS的存储类

1、创建 Amazon EBS CSI 驱动程序 IAM 角色
相关文档
先决条件，是否有 IAM OIDC 提供商，详情 IAM OIDC 提供商创建文档
IAM OIDC 提供商id

在 Select trusted entity（选择受信任的实体）页面上操作，最后点击下一步

在 Add permissions（添加权限）页面上筛选AmazonEBSCSIDriverPolicy勾选后，然后点击下一步

在 Name, review, and create（命名、查看和创建）页面中，取名AmazonEKS_EBS_CSI_DriverRole，然后滑倒最后点击创建角色

创建后，我们重新编辑
将原来的id全部改成我们eks集群的id: 523E4251EE6E3D0855D8BCF7AAAD8206

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Principal": {
				"Federated": "arn:aws:iam::XXXXXXX:oidc-provider/oidc.eks.ap-east-1.amazonaws.com/id/523E4251EE6E3D0855D8BCF7AAAD8206"
			},
			"Action": "sts:AssumeRoleWithWebIdentity",
			"Condition": {
				"StringEquals": {
					"oidc.eks.ap-east-1.amazonaws.com/id/523E4251EE6E3D0855D8BCF7AAAD8206:aud": "sts.amazonaws.com",
					"oidc.eks.ap-east-1.amazonaws.com/id/523E4251EE6E3D0855D8BCF7AAAD8206:sub": "system:serviceaccount:kube-system:ebs-csi-controller-sa"
				}
			}
		}
	]
}

最后点击更新策略
创建AmazonEBSVolumePolicy角色
不创建的话可能会报错

AttachVolume.Attach failed for volume "aws-pv2" : rpc error: code = Internal desc = Could not attach volume "vol-07b297f1ae13f164a" to node "i-0900340d8108b7fe8": could not attach volume "vol-07b297f1ae13f164a" to node "i-0900340d8108b7fe8": operation error EC2: AttachVolume, https response error StatusCode: 400, RequestID: ecab32b9-1bb5-45df-b669-1ad61836d792, api error InvalidVolume.ZoneMismatch: The volume 'vol-07b297f1ae13f164a' is not in the same availability zone as instance 'i-0900340d8108b7fe8'

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
				"ec2:DescribeVolumes",
				"ec2:DescribeVolumeAttachment",            
                "ec2:AttachVolume",
                "ec2:DetachVolume"
            ],
            "Resource": "*"
        }
    ]
}

并将该策略添加到node角色AmazonEKSNodeRole中

2、将 Amazon EBS CSI 驱动程序作为 Amazon EKS 附加组件管理
相关文档

# eksctl create addon --name aws-ebs-csi-driver --cluster eks-test --service-account-role-arn arn:aws:iam::369180331248:role/AmazonEKS_EBS_CSI_DriverRole2 --force
2024-05-03 18:02:46 [!]  no IAM OIDC provider associated with cluster, try 'eksctl utils associate-iam-oidc-provider --region=ap-east-1 --cluster=eks-test'
2024-05-03 18:02:46 [ℹ]  Kubernetes version "1.29" in use by cluster "eks-test"
2024-05-03 18:02:46 [!]  OIDC is disabled but policies are required/specified for this addon. Users are responsible for attaching the policies to all nodegroup roles
2024-05-03 18:02:46 [ℹ]  creating addon

如果您删除 --force 选项，并且任何 Amazon EKS 附加组件设置与您的现有设置冲突，那么更新 Amazon EKS 附加组件将会失败，而且您会收到一条帮助您解决冲突的错误消息。在指定此选项之前，请确保 Amazon EKS 附加组件不会管理您需要管理的设置，因为这些设置会被此选项覆盖

查询附加的组件是否正常

# kubectl get csidrivers
NAME              ATTACHREQUIRED   PODINFOONMOUNT   STORAGECAPACITY   TOKENREQUESTS   REQUIRESREPUBLISH   MODES        AGE
ebs.csi.aws.com   true             false            false             <unset>         false               Persistent   119m

3、部署示例应用程序并验证 CSI 驱动程序是否正常运行
相关文档
1）拉取aws-ebs-csi-driver驱动代码

# git clone https://github.com/kubernetes-sigs/aws-ebs-csi-driver.git
Cloning into 'aws-ebs-csi-driver'...
remote: Enumerating objects: 30626, done.
remote: Counting objects: 100% (8952/8952), done.
remote: Compressing objects: 100% (2710/2710), done.
remote: Total 30626 (delta 6965), reused 6522 (delta 6168), pack-reused 21674
Receiving objects: 100% (30626/30626), 27.11 MiB | 13.63 MiB/s, done.
Resolving deltas: 100% (17521/17521), done.
# cd aws-ebs-csi-driver/examples/kubernetes/dynamic-provisioning/

2）默认情况下，manifests/storageclass.yaml 文件预置 gp2 Amazon EBS 卷。要改用 gp3 卷，请将 type: gp3 添加到 manifests/storageclass.yaml

echo "parameters:
  type: gp3" >> manifests/storageclass.yaml

3）从 manifests 目录部署 ebs-sc 存储类、ebs-claim 持久性卷声明和 app 示例应用程序

# kubectl apply -f manifests/
persistentvolumeclaim/ebs-claim created
pod/app created
storageclass.storage.k8s.io/ebs-sc created

4）描述查询存储类

# kubectl describe storageclass ebs-sc
Name:            ebs-sc
IsDefaultClass:  No
Annotations:     kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"storage.k8s.io/v1","kind":"StorageClass","metadata":{"annotations":{},"name":"ebs-sc"},"parameters":{"type":"gp3"},"provisioner":"ebs.csi.aws.com","volumeBindingMode":"WaitForFirstConsumer"}

Provisioner:           ebs.csi.aws.com
Parameters:            type=gp3
AllowVolumeExpansion:  <unset>
MountOptions:          <none>
ReclaimPolicy:         Delete
VolumeBindingMode:     WaitForFirstConsumer
Events:                <none>