EKS中使用非*标识符的EFS策略无法生效问题求助

问题描述 #

我配置了如下EFS策略语句：

policy_statements = [
  {
    sid     = "${var.cluster_name}"
    actions = ["elasticfilesystem:ClientMount",
               "elasticfilesystem:ClientRootAccess",
               "elasticfilesystem:ClientWrite"]
    principals = [
      {
        type        = "AWS"
        identifiers = ["arn:aws:iam::xxxx:role/efs-test-role"]
      }
    ]
  }
]

当我将标识符设为""时策略可以正常工作。*

已通过OIDC联合身份验证创建角色arn:aws:iam::xxxx:role/efs-test-role，其信任策略如下：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::xxxx:oidc-provider/oidc.eks.us-west-2.amazonaws.com/id/xxxx"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "oidc.eks.us-west-2.amazonaws.com/id/xxxx:aud": "sts.amazonaws.com"
                }
            }
        }
    ]
}

创建了带有角色注解的ServiceAccount：

eks.amazonaws.com/role-arn: arn:aws:iam::xxxx:role/efs-test-role

使用Persistent Volume创建挂载EFS卷的Pod时，出现如下错误：

Output: Could not start amazon-efs-mount-watchdog, unrecognized init system "aws-efs-csi-dri"
b'mount.nfs4: access denied by server while mounting 127.0.0.1:/'

已尝试将AmazonElasticFileSystemsUtils添加到EKS工作节点实例配置文件，但仍出现相同错误。

解决方案 #

1. 修正EFS策略的Principal指向 #

EFS挂载操作在节点层面执行，权限验证依赖节点实例的IAM角色，而非Pod使用的ServiceAccount角色。因此需要修改EFS策略的identifiers为节点实例配置文件对应的IAM角色ARN：

policy_statements = [
  {
    sid     = "${var.cluster_name}"
    actions = ["elasticfilesystem:ClientMount",
               "elasticfilesystem:ClientRootAccess",
               "elasticfilesystem:ClientWrite"]
    principals = [
      {
        type        = "AWS"
        identifiers = ["arn:aws:iam::xxxx:role/eks-node-instance-role"] // 替换为你的节点实例角色ARN
      }
    ]
  }
]

2. 完善ServiceAccount角色的信任策略 #

当前信任策略未限定仅指定ServiceAccount能Assume该角色，需添加sub条件锁定目标ServiceAccount（替换为你的ServiceAccount命名空间和名称）：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::xxxx:oidc-provider/oidc.eks.us-west-2.amazonaws.com/id/xxxx"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "oidc.eks.us-west-2.amazonaws.com/id/xxxx:aud": "sts.amazonaws.com",
                    "oidc.eks.us-west-2.amazonaws.com/id/xxxx:sub": "system:serviceaccount:kube-system:efs-csi-controller-sa"
                }
            }
        }
    ]
}

3. 验证EFS CSI驱动配置 #

• 确认已安装最新版EFS CSI驱动，且驱动Deployment已正确关联绑定的ServiceAccount；
• 检查PersistentVolume配置，确保EFS文件系统ID、驱动参数正确：

apiVersion: v1
kind: PersistentVolume
metadata:
  name: efs-pv
spec:
  capacity:
    storage: 5Gi
  volumeMode: Filesystem
  accessModes:
    - ReadWriteMany
  persistentVolumeReclaimPolicy: Retain
  storageClassName: efs-sc
  csi:
    driver: efs.csi.aws.com
    volumeHandle: fs-xxxxxxx // 替换为你的EFS文件系统ID

4. 处理watchdog警告 #

Could not start amazon-efs-mount-watchdog属于容器环境下的非致命警告，不影响挂载权限。若需消除该警告：

• 确保EFS CSI驱动容器内安装了最新版amazon-efs-utils；
• 自定义驱动镜像时可添加systemd依赖，或调整watchdog启动逻辑。

内容的提问来源于stack exchange，提问作者Rad4