Skip to content

Instantly share code, notes, and snippets.

Created March 29, 2023 10:39
Show Gist options
  • Save jwmatthews/d701da13eda5d57d4e8d2adf594fc4f2 to your computer and use it in GitHub Desktop.
Save jwmatthews/d701da13eda5d57d4e8d2adf594fc4f2 to your computer and use it in GitHub Desktop.
Installing EBS-CSI AddOn for EKS clusters

Configure EBS dynamic provisioning on an EKS Cluster


I used pulumi to deploy an EKS cluster via: I noticed a gp2 storage class was defined after the cluster was up. I attempted to launch an application with a PVC expecting to see a PV be created but PVC was stuck in pending and I didn't know why.


As of k8s 1.23, EKS needs the ebs-csi AddOn installed for dynamic provisioning of EBS Pulumi is not installing this automatically with an EKS cluster, there is an open issue tracking it: pulumi/pulumi-eks#833

Manual Steps

  1. Associate an IAM OIDC provider to the cluster
eksctl utils associate-iam-oidc-provider --cluster $NAME --region $REGION --approve 
  1. Create a role for the AddOn to use

eksctl create iamserviceaccount \
  --name ebs-csi-controller-sa \
  --namespace kube-system \
  --cluster $NAME \
  --attach-policy-arn arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy \
  --approve \
  --role-only \
  --role-name JWM_AmazonEKS_EBS_CSI_DriverRole \
  --region ${REGION}
  • Example of a successful run
#$ ./
#2023-03-29 06:23:22 [ℹ]  1 iamserviceaccount (kube-system/ebs-csi-controller-sa) was included (based on the include/exclude rules)
#2023-03-29 06:23:22 [!]  serviceaccounts in Kubernetes will not be created or modified, since the option --role-only is used
#2023-03-29 06:23:22 [ℹ]  1 task: { create IAM role for serviceaccount "kube-system/ebs-csi-controller-sa" }
#2023-03-29 06:23:22 [ℹ]  building iamserviceaccount stack "eksctl-eks-cluster-eksCluster-cfb5b82-addon-iamserviceaccount-kube-system-ebs-csi-controller-sa"
#2023-03-29 06:23:22 [ℹ]  deploying stack "eksctl-eks-cluster-eksCluster-cfb5b82-addon-iamserviceaccount-kube-system-ebs-csi-controller-sa"
#2023-03-29 06:23:22 [ℹ]  waiting for CloudFormation stack "eksctl-eks-cluster-eksCluster-cfb5b82-addon-iamserviceaccount-kube-system-ebs-csi-controller-sa"
#2023-03-29 06:23:53 [ℹ]  waiting for CloudFormation stack "eksctl-eks-cluster-eksCluster-cfb5b82-addon-iamserviceaccount-kube-system-ebs-csi-controller-sa"
  1. Install the AddOn: visit: Select the IAM Role we just created: JWM_AmazonEKS_EBS_CSI_DriverRole

  2. Verify it is installed:

aws-node-8hf7g                        1/1     Running   0          11h
aws-node-bl4pk                        1/1     Running   0          11h
aws-node-fxf4n                        1/1     Running   0          11h
coredns-67f8f59c6c-dl45c              1/1     Running   0          11h
coredns-67f8f59c6c-z7z4x              1/1     Running   0          11h
ebs-csi-controller-6878c4b844-jddkf   6/6     Running   0          7m11s
ebs-csi-controller-6878c4b844-l9pcs   6/6     Running   0          7m11s
ebs-csi-node-st9kd                    3/3     Running   0          7m12s
ebs-csi-node-vjftq                    3/3     Running   0          7m12s
ebs-csi-node-xzk9v                    3/3     Running   0          7m12s
kube-proxy-g4g6z                      1/1     Running   0          11h
kube-proxy-hsrvb                      1/1     Running   0          11h
kube-proxy-l45bh                      1/1     Running   0          11h
metrics-server-55c774cdbb-fwhmm       1/1     Running   0          11h
  • Note the ebs-csi-* pods

Reference Links

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment