fix(aws-eks): EBS CSI driver + default gp3 StorageClass (EKS 1.34 storage gap) - #66
Merged
Merged
Conversation
EKS 1.34 ships no in-tree kubernetes.io/aws-ebs provisioner, so the auto-created gp2 StorageClass is non-functional and is not marked default. Any PVC-backed workload (databases, caches) hangs Pending with no usable default StorageClass. Surfaced while deploying LibreChat (MongoDB/MeiliSearch) onto the live cluster. - shared module (modules/aws-eks-cluster): add EBS CSI IRSA role (kube-system:ebs-csi-controller-sa, attach_ebs_csi_policy) + ebs_csi_role_arn output - aws-eks-singlecluster cluster layer: re-export ebs_csi_role_arn - aws-eks-singlecluster nodes layer: aws-ebs-csi-driver managed addon (deployed in Layer 3 like CoreDNS, needs nodes) + default gp3 StorageClass (ebs.csi.aws.com, encrypted, expandable, WaitForFirstConsumer) - README: reflect new IRSA role + addon/StorageClass in layer summaries Validated: terraform fmt + validate clean on module, cluster, and nodes layers. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Multicluster already uses the shared aws-eks-cluster module, so it inherits the EBS CSI IRSA role added there. Mirror the singlecluster fix into both clusters: - clusters/frontend + clusters/backend: re-export ebs_csi_role_arn - nodes/frontend + nodes/backend: aws-ebs-csi-driver addon (Layer 3, after nodes) + default gp3 StorageClass (ebs.csi.aws.com, encrypted, expandable) - README: layer summaries + deployment order Validated: terraform fmt + validate clean on all four layers. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Add architecture.svg and reference it (T2.3) - Add Resources Created section with cost notes (T2.4) - Reframe StorageClass prereq + PVC troubleshooting: repo EKS blueprints now ship a default gp3 StorageClass (EBS CSI), so manual install is only needed for externally-built/non-EKS clusters - Drop superfluous live-test validation-status blockquote (belongs in PR/QA notes) - Add eksctl IRSA service-account cleanup note (orphan prevention) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The AWS EKS blueprints build EKS 1.34 clusters that had no working block storage. The only StorageClass is the auto-created
gp2using the legacy in-tree provisionerkubernetes.io/aws-ebs, which no longer exists in 1.34 (nothing provisions it), and it isn't marked default. Onlyefs.csi.aws.comwas registered; theaws-ebs-csi-driveraddon was never installed and had no IRSA role. Any PVC-backed workload (e.g. LibreChat's MongoDB/MeiliSearch) hangsPending.Fix
modules/aws-eks-cluster(shared): EBS CSI IRSA role (kube-system:ebs-csi-controller-sa,attach_ebs_csi_policy) +ebs_csi_role_arnoutput. Both EKS blueprints inherit it.ebs_csi_role_arn; nodes layers add theaws-ebs-csi-drivermanaged addon (Layer 3, after nodes — same reason CoreDNS lives there) + a defaultgp3StorageClass (ebs.csi.aws.com, encrypted, expandable,WaitForFirstConsumer).Validation
terraform fmt+validateclean on all affected layers. Applied live onaws-eks-singlecluster:ACTIVEvia the IRSA role;ebs-csi-controller(2×6/6) +ebs-csi-nodeDaemonSet (3/3) Runninggp3is now the default StorageClassgp3PV, provisioned a real EBS volume (vol-0f14aa…), mounted and writable — then cleaned upNote: two riding-along commits
This branch also carries two local-only commits unrelated to the EBS fix (they existed nowhere else and would otherwise be lost):
08245afdocs(secure-enterprise-chat): README standards pass + architecture.svgdbad414chore: gitignore.worktrees/🤖 Generated with Claude Code