Update README.md with explanation of EKS Pod Identity configuration with EFS CSI Controller #1422
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Update Controller Pod Identity config description
Is this a bug fix or adding new feature?
Feature
What is this PR about? / Why do we need it?
Adds more details of integration between EKS Pod Identities feature and k8s service account of EFS CSI controller when the controller wants to communicate with EFS services using sufficient permissions.
What testing is done?
Here is the controller logs when we do not use
arn:aws:iam::aws:policy/service-role/AmazonEFSCSIDriverPolicy
before and after:I0801 07:02:02.139270 1 controller.go:335] Using /pvc-a2755de8-c8fb-4ecd-b866-d86a43186784 as the access point directory. E0801 07:02:02.175852 1 driver.go:107] GRPC error: rpc error: code = Unauthenticated desc = Access Denied. Please ensure you have the right AWS permissions: Access denied I0801 07:03:50.748840 1 controller.go:328] Using PV name for access point directory. I0801 07:03:50.748911 1 controller.go:335] Using /pvc-c380cab3-3f23-466b-acc6-4b39fa52fd9b as the access point directory.
Here is the events log of my PVC: