Supporting Parameter to Assume Role in Storage Class Definition #1191
Description
Problem
Currently, EBS CSI controller has a 1-1 mapping between the SA account and AWS IAM role used for the API operations i.e, all the API operations for the Controller happens using this single role (or credentials supplied alternatively). This is a problem, when different storage classes need to have tighter permission boundaries. The following are some of the use-cases where this problem might arise
- Two storage classes use two different KMS Key IDs but the permission to access them are restricted to only 1 role per Key ID.
- There is a shared/central controller for several Kubernetes clusters and each of the Kubernetes cluster has security requirement to use distinct IAM roles so that the volumes aren't accessible by each other.
Potential Solution
Supporting assumeRoleARN as a parameter along with kmsKeyID and using the mentioned role for operations pertinent to the given storage class definiton.
Eg:
---
kind: StorageClass
apiVersion: storage.k8s.io/v1
metadata:
name: enc-ebs-gp3-3
provisioner: ebs.csi.aws.com
volumeBindingMode: WaitForFirstConsumer
parameters:
type: gp3
encrypted: 'true'
kmsKeyId: arn:aws:kms:eu-west-1:0123456:key/abcd-1234-efgh-abcd-123456
assumeRoleARN: arn:aws:iam::0123456:role/ebs-csi-controller-role-1
Alternative Considered
Running multiple controllers in a single cluster but couldn't find much information about this and prior art of doing this.