1.EBS CSI 를 EKS 내에 구축

1. ebs-csi-policy.json 작성(policy 생성)

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:AttachVolume",
                "ec2:CreateSnapshot",
                "ec2:CreateVolume",
                "ec2:DetachVolume",
                "ec2:DeleteSnapshot",
                "ec2:DeleteVolume",
                "ec2:ModifyVolume",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeAccountAttributes",
                "ec2:DescribeInstances",
                "ec2:DescribeSnapshots",
                "ec2:DescribeTags",
                "ec2:DescribeVolumes",
                "ec2:DescribeVolumeAttribute",
                "ec2:DescribeVolumeStatus",
                "ec2:CreateTags",
                "ec2:DeleteTags"
            ],
            "Resource": "*"
        }
    ]
}

OIDC를 안한 경우

### IAM OIDC 생성
eksctl utils associate-iam-oidc-provider --region=ap-northeast-2 --cluster=SPD-EKS --approve

2.trust_policy.json 작성(role 생성)

<aside> 💡 자신의 userID가 들어간 arn으로 넣어야함 OIDC

</aside>

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::825958448855:oidc-provider/oidc.eks.ap-northeast-2.amazonaws.com/id/2CAB896BE60CFBAB3E4BDB39834D95BC"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "oidc.eks.ap-northeast-2.amazonaws.com/id/2CAB896BE60CFBAB3E4BDB39834D95BC:sub": "system:serviceaccount:kube-system:ebs-csi-controller-sa",
                    "oidc.eks.ap-northeast-2.amazonaws.com/id/2CAB896BE60CFBAB3E4BDB39834D95BC:aud": "sts.amazonaws.com"
                }
            }
        }
    ]
}

3. role과 policy 정책 바인딩

aws iam create-policy --policy-name spd-eks-pv 
\ --policy-document file://ebs-csi-policy.json

aws iam create-role --role-name spd-role-eks-pv
\ --assume-role-policy-document file://trust_policy.json

aws iam attach-role-policy --role-name spd-role-eks-pv 
\ --policy-arn arn:aws:iam::825958448855:policy/spd-eks-pv

4.Service account 생성

eksctl create iamserviceaccount --region ap-northeast-2 --name ebs-csi-controller-sa 
\ --namespace kube-system --cluster SPD-EKS
\ --attach-role-arn arn:aws:iam::825958448855:role/spd-role-eks-pv --approve 
\ --override-existing-serviceaccounts

5. annotation 추가 및 EBS-CSI install

helm repo add aws-ebs-csi-driver <https://kubernetes-sigs.github.io/aws-ebs-csi-driver>
kubectl annotate serviceaccount ebs-csi-controller-sa -n kube-system
\ meta.helm.sh/release-name=aws-ebs-csi-driver --overwrite
kubectl annotate serviceaccount ebs-csi-controller-sa -n kube-system
\ meta.helm.sh/release-namespace=kube-system --overwrite
kubectl label serviceaccount ebs-csi-controller-sa -n kube-system
\ app.kubernetes.io/managed-by=Helm --overwrite

helm install aws-ebs-csi-driver aws-ebs-csi-driver/aws-ebs-csi-driver 
\ --namespace kube-system --set serviceAccount.create=false
\ --set serviceAccount.name=ebs-csi-controller-sa

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
 name: ebs-sc
provisioner: ebs.csi.aws.com
parameters:
 type: gp2
 fsType: ext4
reclaimPolicy: Retain
volumeBindingMode: WaitForFirstConsumer

Kafka 구축

1. kafka ns 생성

kubectl create ns kafka

2. helm repo 생성 (bitnami kafak 사용)

helm repo add bitnami <https://charts.bitnami.com/bitnami>
helm repo update 

helm install kafka -n kafka \
  --set volumePermissions.enabled=true \
  --set replicaCount=3 \
  --set listeners.client.protocol=PLAINTEXT \
  --set broker.persistence.storageClass=ebs-sc \
  --set controller.persistence.storageClass=ebs-sc \
  oci://registry-1.docker.io/bitnamicharts/kafka