fix: AWS EFS as PV in Kubernetes

kubernetes/onpremise/kubeadm/examples/complete/id_rsa

@@ -0,0 +1 @@
+#insert your private ssh key here

kubernetes/onpremise/kubeadm/examples/complete/terraform.tfvars

@@ -2,7 +2,7 @@ master = {
   name                     = "master-1"
   public_dns               = "PUBLIC_DNS_HERE" # it can be private if you are in the destination network
   private_dns              = "PRIVATE_DNS_HERE"
-  tls_private_key_pem_file = "TLS_PRIVATE_KEY_FILE_HERE"
+  tls_private_key_pem_file = "./id_rsa" # replace the content of this file with the private ssh key 
 }
 
 workers = {

persistent-volume/aws/efs/README.md

@@ -7,7 +7,6 @@
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.3.0 |
 | <a name="requirement_helm"></a> [helm](#requirement\_helm) | >= 2.10.1 |
 | <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 2.21.1 |
-| <a name="requirement_tls"></a> [tls](#requirement\_tls) | >= 4.0.4 |
 
 ## Providers
 
@@ -16,7 +15,6 @@
 | <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.3.0 |
 | <a name="provider_helm"></a> [helm](#provider\_helm) | >= 2.10.1 |
 | <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | >= 2.21.1 |
-| <a name="provider_tls"></a> [tls](#provider\_tls) | >= 4.0.4 |
 
 ## Modules
 
@@ -28,14 +26,13 @@
 
 | Name | Type |
 |------|------|
-| [aws_iam_openid_connect_provider.eks_oidc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_openid_connect_provider) | resource |
 | [aws_iam_policy.efs_csi_driver](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
 | [aws_iam_role.efs_csi_driver](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
 | [aws_iam_role_policy_attachment.efs_csi_driver](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
 | [helm_release.efs_csi](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
 | [kubernetes_service_account.efs_csi_driver](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/service_account) | resource |
+| [aws_iam_openid_connect_provider.eks_oidc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_openid_connect_provider) | data source |
 | [aws_iam_policy_document.efs_csi_driver](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
-| [tls_certificate.eks](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/data-sources/certificate) | data source |
 
 ## Inputs
 

persistent-volume/aws/efs/efs-csi-iam.tf

@@ -46,10 +46,8 @@ resource "aws_iam_policy" "efs_csi_driver" {
   tags        = local.tags
 }
 
-resource "aws_iam_openid_connect_provider" "eks_oidc" {
-  client_id_list  = ["sts.amazonaws.com"]
-  thumbprint_list = concat([data.tls_certificate.eks.certificates[0].sha1_fingerprint], local.oidc_thumbprint_list)
-  url             = var.eks_issuer
+data "aws_iam_openid_connect_provider" "eks_oidc" {
+  url = var.eks_issuer
 }
 
 resource "aws_iam_role" "efs_csi_driver" {
@@ -72,8 +70,7 @@ resource "aws_iam_role" "efs_csi_driver" {
       }
     ]
   })
-  tags       = local.tags
-  depends_on = [aws_iam_openid_connect_provider.eks_oidc]
+  tags = local.tags
 }
 
 resource "aws_iam_role_policy_attachment" "efs_csi_driver" {

persistent-volume/aws/efs/locals.tf

@@ -1,15 +1,9 @@
-# EKS certificate
-data "tls_certificate" "eks" {
-  url = var.eks_issuer
-}
-
 locals {
   tags                 = merge(var.tags, { module = "pv-efs" })
   efs_csi_name         = try(var.csi_driver.name, "efs-csi-driver")
   efs_csi_namespace    = try(var.csi_driver.namespace, "kube-system")
-  oidc_arn             = aws_iam_openid_connect_provider.eks_oidc.arn
-  oidc_url             = trimprefix(aws_iam_openid_connect_provider.eks_oidc.url, "https://")
-  oidc_thumbprint_list = []
+  oidc_arn             = data.aws_iam_openid_connect_provider.eks_oidc.arn
+  oidc_url             = trimprefix(var.eks_issuer, "https://")
   node_selector_keys   = keys(var.csi_driver.node_selector)
   node_selector_values = values(var.csi_driver.node_selector)
   tolerations = [

persistent-volume/aws/efs/versions.tf

@@ -13,9 +13,5 @@ terraform {
       source  = "hashicorp/helm"
       version = ">= 2.10.1"
     }
-    tls = {
-      source  = "hashicorp/tls"
-      version = ">= 4.0.4"
-    }
   }
 }

storage/aws/efs/locals.tf

@@ -8,6 +8,7 @@ data "aws_subnet" "private_subnet" {
 }
 
 locals {
-  tags    = merge(var.tags, { module = "efs" })
-  encrypt = (var.efs.kms_key_id != "" && var.efs.kms_key_id != null)
+  tags       = merge(var.tags, { module = "efs" })
+  encrypt    = (var.efs.kms_key_id != "" && var.efs.kms_key_id != null)
+  subnet_ids = flatten([for key, value in { for subnet in data.aws_subnet.private_subnet : subnet.availability_zone_id => subnet.id... } : value[0]])
 }

storage/aws/efs/main.tf

@@ -26,9 +26,9 @@ resource "aws_security_group" "efs" {
 }
 
 resource "aws_efs_mount_target" "efs" {
-  for_each        = data.aws_subnet.private_subnet
+  for_each        = toset(local.subnet_ids)
   file_system_id  = aws_efs_file_system.efs.id
-  subnet_id       = each.value.id
+  subnet_id       = each.key
   security_groups = [aws_security_group.efs.id]
 }