Eksctl: feat: EFS support add-on for efs-provisioner

[milkowski]

Add possibility to create PVCs on EFS filestytem using a nodegroup add-on as suggested https://github.com/weaveworks/eksctl/issues/69#issuecomment-403429166
At least AmazonElasicFilesystemReadOnlyAccess role should be added to nodes along with proper security groups setup.

[whereisaaron]

EFS is a regular NFS mount, so no IAM role is normally required, just a SecurityGroup with access to the EFS end points. Unless this IAM role is needed for the EFS CSI driver?

[rsyvarth]

I just set this up in my cluster yesterday and no IAM role was needed. Just put the EFS mount points in the same subnets as my nodes and applied a permissive SG.

[leakingtapan]

Unless this IAM role is needed for the EFS CSI driver?

EFS CSI driver is just doing regular mounts using amazon-efs-utils and no special IAM permission is needed

[kalbir]

From the comments I don't think this is an issue, please reopen if there is something we are missing.

[artem-nefedov]

I am a little confused.
Documentation says there is an addon IAM policy for EFS:

nodeGroups:
  - name: ng-1
    instanceType: m5.xlarge
    desiredCapacity: 1
    iam:
      withAddonPolicies:
        ...
        efs: true
        ...

If IAM role is not needed for EFS, what does it do?