# 配置环境变量
export cluster_name=my-cluster
export role_name=AmazonEKS_EFS_CSI_DriverRole


# 使用eksctl 创建 Amazon EFS CSI 插件 IAM 角色
eksctl create iamserviceaccount \
    --name efs-csi-controller-sa \
    --namespace kube-system \
    --cluster $cluster_name \
    --role-name $role_name \
    --role-only \
    --attach-policy-arn arn:aws:iam::aws:policy/service-role/AmazonEFSCSIDriverPolicy \
    --approve


# 修改策略
TRUST_POLICY=$(aws iam get-role --role-name $role_name --query 'Role.AssumeRolePolicyDocument' | \
    sed -e 's/efs-csi-controller-sa/efs-csi-*/' -e 's/StringEquals/StringLike/')
    

# 更新策略
aws iam update-assume-role-policy --role-name $role_name --policy-document "$TRUST_POLICY"

###配置区域
export region=us-east-1

###获取当前vpc
vpc_id=$(aws eks describe-cluster \
    --name $cluster_name \
    --query "cluster.resourcesVpcConfig.vpcId" \
    --output text)
 
###获取当前子网范围
cidr_range=$(aws ec2 describe-vpcs \
    --vpc-ids $vpc_id \
    --query "Vpcs[].CidrBlock" \
    --output text \
    --region $region)
 
###创建一个安全组
security_group_id=$(aws ec2 create-security-group \
    --group-name MyEfsSecurityGroup \
    --description "My EFS security group" \
    --vpc-id $vpc_id \
    --output text)
 
###配置一个安全组规则
aws ec2 authorize-security-group-ingress \
    --group-id $security_group_id \
    --protocol tcp \
    --port 2049 \
    --cidr $cidr_range
 
###创建一个efs
file_system_id=$(aws efs create-file-system \
    --region $region \
    --performance-mode generalPurpose \
    --query 'FileSystemId' \
    --output text)
 
###查看子网
aws ec2 describe-subnets \
    --filters "Name=vpc-id,Values=$vpc_id" \
    --query 'Subnets[*].{SubnetId: SubnetId,AvailabilityZone: AvailabilityZone,CidrBlock: CidrBlock}' \
    --output text
 
###for循环为efs创建端点
for i in $(aws ec2 describe-subnets     --filters "Name=vpc-id,Values=$vpc_id"     --query 'Subnets[*].{SubnetId: SubnetId,AvailabilityZone: AvailabilityZone,CidrBlock: CidrBlock}'     --output text |awk '{print $NF}') ; do aws efs create-mount-target --file-system-id $file_system_id --subnet-id $i --security-groups $security_group_id ; sleep 1 ; done

###安装efs插件
eksctl create addon --name aws-efs-csi-driver --cluster raymond-eks --service-account-role-arn arn:aws:iam::917958955567:role/AmazonEKS_EFS_CSI_DriverRole --force

###删除插件
eksctl delete addon --name aws-efs-csi-driver --cluster raymond-eks

###创建一个storageclass动态分配
cat > storageclass.yaml <<'EOF'
kind: StorageClass
apiVersion: storage.k8s.io/v1
metadata:
  name: efs-sc
provisioner: efs.csi.aws.com
parameters:
  provisioningMode: efs-ap
  fileSystemId: fs-080792a3dd27d8628
  directoryPerms: "700"
  gidRangeStart: "1000" # optional
  gidRangeEnd: "2000" # optional
  basePath: "/dynamic_provisioning" # optional
  subPathPattern: "${.PVC.namespace}/${.PVC.name}" # optional
  ensureUniqueDirectory: "true" # optional
  reuseAccessPoint: "false" # optional
EOF

  
###创建一个pvc
cat > claim.yaml <<EOF
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: efs-claim
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: efs-sc
  resources:
    requests:
      storage: 5Gi
EOF
 
###创建一个pod
cat > pod.yaml <<'EOF'
apiVersion: v1
kind: Pod
metadata:
  name: efs-app
spec:
  containers:
  - name: app
    image: busybox
    command: ["/bin/sh"]
    args: ["-c", "while true; do echo $(date -u) >> /data/out.txt; sleep 5; done"]
    volumeMounts:
    - name: persistent-storage
      mountPath: /data
  volumes:
  - name: persistent-storage
    persistentVolumeClaim:
      claimName: efs-claim
EOF
 
###部署
kubectl apply -f .

###注意点：开启vpc的dns主机名解析
kubectl rollout restart deployment efs-csi-controller -n kube-system


###测试代码
git clone https://github.com/kubernetes-sigs/aws-efs-csi-driver.git


###Github地址
https://github.com/kubernetes-sigs/aws-efs-csi-driver/tree/master/examples/kubernetes/dynamic_provisioning

# 创建挂在点
mkdir /data

# 登录到一个node节点,执行挂载命令
sudo mount -t nfs4 -o nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport fs-06901d65c049c0d51.efs.us-east-1.amazonaws.com:/ /data

# 查看对应目录
ls -lh /data