chore(ebs-csi): move helm release to Terraform

infrastructure/mycluster-0/kustomization.yaml

@@ -2,6 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - ../base/aws-ebs-csi-driver
   - ../base/aws-load-balancer-controller
   - ../base/external-dns

terraform/eks/helm.tf

@@ -25,6 +25,32 @@ resource "helm_release" "cilium" {
   ]
 }
 
+resource "helm_release" "aws_ebs_csi_driver" {
+  name            = "aws-ebs-csi-driver"
+  atomic          = true
+  force_update    = true
+  cleanup_on_fail = false
+  replace         = true
+  timeout         = 180
+  repository      = "https://kubernetes-sigs.github.io/aws-ebs-csi-driver"
+  chart           = "aws-ebs-csi-driver"
+  version         = var.ebs_csi_driver_chart_version
+  namespace       = "kube-system"
+
+  set {
+    name  = "controller.k8sTagClusterId"
+    value = var.cluster_name
+  }
+  set {
+    name  = "controller.serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn"
+    value = module.irsa_ebs_csi_driver.iam_role_arn
+  }
+
+  values = [
+    file("${path.module}/helm_values/aws-ebs-csi-driver.yaml")
+  ]
+}
+
 resource "helm_release" "karpenter" {
   namespace        = "karpenter"
   create_namespace = true

terraform/eks/helm_values/aws-ebs-csi-driver.yaml

@@ -0,0 +1,20 @@
+controller:
+  k8sTagClusterId: ${cluster_name}
+  serviceAccount:
+    annotations:
+      eks.amazonaws.com/role-arn: ${irsa_role_arn}
+  replicaCount: 2
+  resources:
+    limits:
+      cpu: 100m
+      memory: 50Mi
+  enableMetrics: true
+  serviceMonitor:
+    forceEnable: true
+    labels:
+      prometheus-instance: main
+node:
+  resources:
+    limits:
+      cpu: 200m
+      memory: 200Mi

terraform/eks/iam.tf

@@ -1,5 +1,26 @@
+# AWS permissions for the EBS-CSI-DRIVER
+module "irsa_ebs_csi_driver" {
+  source    = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
+  version   = "5.21.0"
+  role_name = "${var.cluster_name}-ebs_csi_driver"
+
+  assume_role_condition_test = "StringLike"
+
+  role_policy_arns = {
+    policy = "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy"
+  }
+
+  oidc_providers = {
+    main = {
+      provider_arn               = module.eks.oidc_provider_arn
+      namespace_service_accounts = ["kube-system:ebs-csi-*"]
+    }
+  }
+}
+
+
 # AWS permissions for Crossplane
-module "iam_assumable_role_crossplane" {
+module "irsa_crossplane" {
   source    = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
   version   = "5.21.0"
   role_name = "${var.cluster_name}-crossplane"

terraform/eks/kubernetes.tf

@@ -90,3 +90,48 @@ resource "kubernetes_job" "delete_aws_cni_ds" {
 }
 
 
+# Set the GP3 storageclass as default
+resource "kubernetes_annotations" "gp2" {
+  api_version = "storage.k8s.io/v1"
+  kind        = "StorageClass"
+  force       = "true"
+
+  metadata {
+    name = "gp2"
+  }
+
+  annotations = {
+    # Modify annotations to remove gp2 as default storage class still retain the class
+    "storageclass.kubernetes.io/is-default-class" = "false"
+  }
+
+  depends_on = [
+    helm_release.aws_ebs_csi_driver
+  ]
+}
+
+resource "kubernetes_storage_class_v1" "gp3" {
+  metadata {
+    name = "gp3"
+
+    annotations = {
+      # Annotation to set gp3 as default storage class
+      "storageclass.kubernetes.io/is-default-class" = "true"
+    }
+  }
+
+  storage_provisioner    = "ebs.csi.aws.com"
+  allow_volume_expansion = true
+  reclaim_policy         = "Delete"
+  volume_binding_mode    = "WaitForFirstConsumer"
+
+  parameters = {
+    encrypted = true
+    fsType    = "ext4"
+    type      = "gp3"
+  }
+
+  depends_on = [
+    helm_release.aws_ebs_csi_driver
+  ]
+}

terraform/eks/variables.tf

@@ -27,6 +27,12 @@ variable "cilium_version" {
   type        = string
 }
 
+variable "ebs_csi_driver_chart_version" {
+  description = "EBS CSI Driver Helm chart version"
+  default     = "2.24.0"
+  type        = string
+}
+
 variable "gateway_api_version" {
   description = "Gateway API CRDs version"
   default     = "v0.8.1"