Service Account Annotation Configuration for aws-ebs-csi-driver v1.40.0-eksbuild.1

Thank you for providing such a detailed description of your issue, Jake. It appears that the configuration schema for the AWS EBS CSI Driver add-on has changed significantly between versions v1.38.1-eksbuild.2 and v1.40.0-eksbuild.1, which is causing the update to fail.

The error message suggests that the new version no longer supports the 'annotations' field under the 'serviceAccount' configuration. Instead, it now has an 'automountServiceAccountToken' property.

To resolve this issue and successfully update to v1.40.0-eksbuild.1, you'll need to modify your Terraform configuration. Here's a suggested approach:

1. Remove the 'annotations' field from your configuration.
2. Add the 'automountServiceAccountToken' field and set it to true.

Your updated Terraform configuration might look like this:

aws-ebs-csi-driver = {
  most_recent = true
  configuration_values = jsonencode({
    controller = {
      serviceAccount = {
        automountServiceAccountToken = true
      }
    }
  })
}

This change aligns with the new configuration schema you described for v1.40.0-eksbuild.1.

However, it's important to note that removing the 'annotations' field means you're no longer explicitly setting the IAM role ARN in the service account annotations. This could potentially affect how the EBS CSI Driver interacts with AWS services.

To ensure that the EBS CSI Driver still has the necessary permissions:

1. Verify that you have an IAM Role for Service Account (IRSA) set up for the EBS CSI Driver.
2. Make sure you have an OpenID Connect (OIDC) endpoint associated with your cluster.
3. Confirm that the service account 'ebs-csi-controller-sa' in the 'kube-system' namespace is properly configured with the correct IAM role.

If these are not already in place, you may need to set them up separately from the add-on configuration.

After making these changes, try applying your Terraform configuration again. If you continue to experience issues, you may want to consider temporarily pinning to the previous version (v1.38.1-eksbuild.2) in your Terraform configuration while you further investigate the changes introduced in v1.40.0-eksbuild.1.

Lastly, for the most up-to-date and accurate information on configuring EKS add-ons, always refer to the official AWS documentation and consider reaching out to AWS support if you need further clarification on these changes.
Sources
Community | Dynamic Database Storage with the Amazon EBS CSI Driver for Amazon EKS
Community | Dynamic Database Storage with the Amazon EBS CSI Driver for Amazon EKS
Community | Dynamic Database Storage with the Amazon EBS CSI Driver for Amazon EKS

Hey Jake,

I ran across the same issue and here is what I found that worked for me:

cluster_addons = {
    most_recent = true
    aws-ebs-csi-driver = {
      service_account_role_arn = aws_iam_role.aws_ebs_csi_driver.arn
    }
}

Found the service_account_role_arn when looking at: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_addon#service_account_role_arn-1

I'm also not sure how you're generating your role but you may want to look into the iam-role-for-service-accounts-eks module to do that. (It's pretty awesome and can even create the roles for cert-manager / external-secrets / etc)

module "ebs_csi_irsa_role" {
  source    = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"

  role_name                     = "ebs-csi-role"

  attach_ebs_csi_policy = true

  oidc_providers = {
    main = {
      provider_arn               = module.eks.oidc_provider_arn
      namespace_service_accounts = ["kube-system:ebs-csi-controller-sa"]
    }
  }
}