AWS: CDK and Python -  installing EBS CSI driver Add-On on EKS
Tags: python, kubernetes, aws, devops
Published: 2023-08-19 14:30:22

---
title: AWS: CDK and Python -  installing EBS CSI driver Add-On on EKS
published: true
date: 2023-07-23 03:27:08 UTC
tags: python,kubernetes,aws,devops
canonical_url: https://rtfm.co.ua/en/aws-cdk-and-python-installing-ebs-csi-driver-add-on-on-eks/
---

### AWS: CDK and Python -  installing EBS CSI driver Add-On on EKS

![](https://cdn-images-1.medium.com/max/1024/1*JZAYCCIy6Muaxtz2FKpu0w.png)

Let’s continue with AWS CDK and Python. I’m not writing because I like CDK, but because there are quite a few examples on the Internet for AWS CDK with Python, so let them at least be here.

So, we have a cluster — [AWS: CDK and Python — building an EKS cluster, and general impressions of CDK](https://rtfm.co.ua/en/aws-cdk-and-python-building-an-eks-cluster-and-general-impressions-of-cdk/), we have a couple of controllers — [AWS: CDK and Python — configure an IAM OIDC Provider, and install Kubernetes Controllers](https://rtfm.co.ua/en/aws-cdk-and-python-configure-an-iam-oidc-provider-and-install-kubernetes-controllers/). As if everything is ready — I started installing a [VictoriaMetrics](https://rtfm.co.ua/en/victoriametrics-an-overview-and-its-use-instead-of-prometheus/) chart, and everything was working except for the pod with [VMSingle](https://docs.victoriametrics.com/operator/design.html#vmsingle), which hung in the Pending status.

### “VolumeBinding”: binding volumes: timed out waiting for the condition

Let’s check the Events of this Pod:

```
…
Events:
Type Reason Age From Message
 — — — — — — — — — — — — -
Warning FailedScheduling 10m default-scheduler running PreBind plugin “VolumeBinding”: binding volumes: timed out waiting for the condition
```

Quick googling led me to [a question on StackOverflow](https://stackoverflow.com/questions/68725070/k8s-pods-failure-error-while-running-volumebinding-prebind-plugin-for-pod-a), where I recalled about [EKS Add-ons](https://docs.aws.amazon.com/eks/latest/userguide/eks-add-ons.html), in particular, about [the EBS CSI diver](https://docs.aws.amazon.com/eks/latest/userguide/ebs-csi.html), which should create EBS when a [PersistentVolumeClaim](https://kubernetes.io/docs/concepts/storage/persistent-volumes/) appears.

So today we’ll look at how to add add-ons to a cluster with the AWS CDK.

Actually, it’s quite simple, the only thing I had to google was how to use the [CfnAddon](https://translate.google.com/website?sl=uk&tl=en&hl=en&client=webapp&u=https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_eks/CfnAddon.html), but this time the documentation was found quickly, and even with examples in Python, not TypeScript.

### IAM Role for EBS CSI driver

We already have OIDC Provider, see [AWS: EKS, OpenID Connect, and ServiceAccounts](https://rtfm.co.ua/en/aws-eks-openid-connect-and-serviceaccounts/)

For the driver, we also will use IRSA. So we need to describe a ServiceAccount, and attach an [AWS Managed Policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html) with the `iam.ManagedPolicy.from_aws_managed_policy_name()`:

```
...
        # Create an IAM Role to be assumed by ExternalDNS
        ebs_csi_addon_role = iam.Role(
            self,
            'EbsCsiAddonRole',
            # for Role's Trust relationships
            assumed_by=iam.FederatedPrincipal(
                federated=oidc_provider_arn,
                conditions={
                    'StringEquals': {
                        f'{oidc_provider_url.replace("https://", "")}:sub': 'system:serviceaccount:kube-system:ebs-csi-controller-sa'
                    }
                },
                assume_role_action='sts:AssumeRoleWithWebIdentity'
            )
        )
        ebs_csi_addon_role.add_managed_policy(iam.ManagedPolicy.from_aws_managed_policy_name("service-role/AmazonEBSCSIDriverPolicy"))
...
```

In the `from_aws_managed_policy_name` specify the name as "_service-role/ManagedPolicyName_".

### CfnAddon for EBS CSI driver

Find a current version of the diver by specifying the version of the cluster — we have EKS version 1.26, because the CDK still does not support 1.27:

```
$ aws eks describe-addon-versions — addon-name aws-ebs-csi-driver — kubernetes-version 1.26 — query “addons[].addonVersions[].[addonVersion, compatibilities[].defaultVersion]” — output text
v1.20.0-eksbuild.1
True
…
```

And describe the connection of the add-on itself with the `CfnAddon` – specify the cluster name, version, and ServiceAccount's IAM Role ARN taken from the `ebs_csi_addon_role` created above:

```
...
        # Add EBS CSI add-on
        ebs_csi_addon = eks.CfnAddon(
            self,
            "EbsCsiAddonSa",
            addon_name="aws-ebs-csi-driver",
            cluster_name=cluster_name,
            resolve_conflicts="OVERWRITE",
            addon_version="v1.20.0-eksbuild.1",
            service_account_role_arn=ebs_csi_addon_role.role_arn
        )
...
```

Deploy, and check:

![](https://cdn-images-1.medium.com/max/1024/0*gbWhotXDrRQF4oUa.png)

Check Pods:

```
$ bkk -n kube-system get pod | grep csi
ebs-csi-controller-896d87c6b-7rv9z 6/6 Running 0 9m59s
ebs-csi-controller-896d87c6b-v7xg7 6/6 Running 0 9m59s
ebs-csi-node-2zwnr 3/3 Running 0 9m59s
ebs-csi-node-pt5zs 3/3 Running 0 9m59s
```

And now we have a PVC for VictoriaMetrcis in the Bound status:

```
$ kk -n dev-monitoring-ns get pvc
NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS AGE
vmsingle-victoria-metrics-k8s-stack Bound pvc-151a631b-f6de-4567–8baa-97adb4e04a87 20Gi RWO gp2 91m
```

And the VMSingle Pod now in the Running status:

```
$ kk -n dev-monitoring-ns get po | grep vmsingle
vmsingle-victoria-metrics-k8s-stack-f7794d779-n6sc7 1/1 Running 0 28m
```

Done.

_Originally published at_ [_RTFM: Linux, DevOps, and system administration_](https://rtfm.co.ua/en/aws-cdk-and-python-installing-ebs-csi-driver-add-on-on-eks/)_._

* * *