<p>I tried to install mongodb in EKS cluster by following the given links.
(using mongodb-kubernetes-operator)</p>
<p><a href="https://www.youtube.com/watch?v=VqeTT0NvRR4&amp;t=1s" rel="noreferrer">https://www.youtube.com/watch?v=VqeTT0NvRR4&amp;t=1s</a></p>
<p><a href="https://github.com/mongodb/mongodb-kubernetes-operator" rel="noreferrer">https://github.com/mongodb/mongodb-kubernetes-operator</a></p>
<pre><code>kubectl apply -f config/crd/bases/mongodbcommunity.mongodb.com_mongodbcommunity.yaml
kubectl get crd/mongodbcommunity.mongodbcommunity.mongodb.com

kubectl create ns mongo

kubectl apply -k config/rbac/ --namespace mongo


kubectl get role mongodb-kubernetes-operator --namespace mongo

kubectl get rolebinding mongodb-kubernetes-operator --namespace mongo

kubectl get serviceaccount mongodb-kubernetes-operator --namespace mongo

kubectl create -f config/manager/manager.yaml --namespace mongo

kubectl get pods --namespace mongo
</code></pre>
<pre class="lang-bash prettyprint-override"><code>kubectl apply -f config/samples/mongodb.com_v1_mongodbcommunity_cr.yaml --namespace mongo
kubectl get pods -n mongo
</code></pre>
<p>When checked</p>
<pre class="lang-bash prettyprint-override"><code>kubectl get pods -n mongo
</code></pre>
<p><code>example-mongodb-0</code> pod is in pending state for very long time.</p>
<p>Upon describing the pod got the following error,</p>
<blockquote>
<p>&quot;running PreBind plugin &quot;VolumeBinding&quot;: binding volumes: timed out
waiting for the condition&quot;.</p>
</blockquote>

Nandha
<p>I have contacted AWS support team regarding this issue and got the following response.</p>
<blockquote>
<p>From your correspondence, I understand that you are facing issues
while creating the mongodb pods in your EKS cluster, and after
creating the pod, your pod is going to pending status.</p>
<p>Please let me know if I misunderstood your query. Thanks for sharing
the GitHub repository URL using the same. I put some effort into
replicating the same issue on my side, and thankfully I was able to
replicate the issue.</p>
<p>Further investigation into my pending pod problem I ran the following
describe command on my cluster,</p>
<p>&quot;kubectl describe pod &lt;pending_pod_name&gt;&quot;</p>
<p>After several minutes, I found the following line in the &quot;event&quot;
part of my output.</p>
<p>&quot;running PreBind plugin &quot;VolumeBinding&quot;: binding volumes: timed out
waiting for the condition&quot;.</p>
<p>On further investigation, I found that the mongodb pod module that you
are trying to deploy on your cluster is trying to create an EBS volume
as a persistent volume, which is why I got the aforementioned error.
We need the EBS CSI driver add-on installed in your cluster to create
an EBS volume using EKS, and the above error usually occurs if the EBS
CSI driver add-on is not present. Since this add-on is not installed
by default while creating the cluster you need to install it via EKS
console add-on tab.</p>
<p>Or another possibility is that, even though the add-on is present, it
won't have the required permission to create the EBS volume. So,
before we even install the EBS CSI driver add-on to the cluster, we
need to make sure that we have created the IAM role for attaching to
the add-on. The same is referred to over here[1].</p>
<p>In your case, you can check whether the EBS CSI driver is present by
running the following command:</p>
<p>&quot;kubectl get pods -n kube-system&quot;</p>
<p>And look for pods with names like &quot;ebs-csi-controller-xxxxxxx.&quot; If
you find one, it means you've already installed the EBS CSI driver,
and the problem could be with permissions.</p>
<p>For that, you need to run the following command.</p>
<p>&quot;kubectl describe pod ebs-csi-controller-xxxxxxx -c csi-provisioner
-n kube-system&quot;</p>
<p>This will give an output of the configuration of the driver pod. In
that output, you need to check for an environment called
&quot;AWS_ROLE_ARN:&quot; If that wasn't present in your output, this implies
that you haven't provided the IAM OIDC provider role for the add-on.
So you need to create that role in the IAM console, then remove the
existing EBS CSI driver add-on from the EKS cluster console, and then
again add the EBS CSI driver add-on with that role as &quot;Service
account role&quot;. More details for adding the EBS CSI driver add-on to
the cluster are referred to here[3].</p>
<p>If you already have the value for &quot;AWS_ROLE_ARN&quot; then you need to
check for the configuration of the role by using this
documentation[2].</p>
<p>So, keeping the above things in mind, I have created the IAM OIDC
provider role for the add-on. For that, you need to follow all the
steps regarding how to create an IAM role for the add-on as referred
to here[2].</p>
<p>After creating the IAM OIDC provider role, I have installed the add-on
via console by following the steps in this documentation[3] and for
the service account role, I have selected the OIDC provider role that
was created in the above step.</p>
<p>After installing the add-on, I tried to delete the mogodb database pod
by running the following command.</p>
<p>&quot;kubectl delete -f
config/samples/mongodb.com_v1_mongodbcommunity_cr.yaml&quot;</p>
<p>Then run the following apply command to redeploy the pods.</p>
<p>&quot;kubectl apply -f
config/samples/mongodb.com_v1_mongodbcommunity_cr.yaml&quot;</p>
<p>After I checked the pods, I could see that the mongodb database pod
had come to running status.</p>
<p>The above is the most common issue that might happen, if none of the
above is your problem then please share a convenient time along with
the timezone you're working in as well as contact number with country
code so that we can connect over a call and have a screen sharing
troubleshooting session.</p>
</blockquote>
<h1>reference links:</h1>
<p>[1] Amazon EBS CSI driver add-on : <a href="https://docs.aws.amazon.com/eks/latest/userguide/ebs-csi.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/eks/latest/userguide/ebs-csi.html</a></p>
<p>[2] How to create IAM OIDC provider for EBS CSI driver add-on : <a href="https://docs.aws.amazon.com/eks/latest/userguide/csi-iam-role.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/eks/latest/userguide/csi-iam-role.html</a></p>
<p>[3] Managing the EBS CSI driver add-on : <a href="https://docs.aws.amazon.com/eks/latest/userguide/managing-ebs-csi.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/eks/latest/userguide/managing-ebs-csi.html</a></p>
<h1>Working commands/steps</h1>
<p>(Steps mentioned by support team)</p>
<ol>
<li>Creation of EKS cluster</li>
<li>Go to the newly created EKS cluster in AWS console. In the <strong>Overview</strong> tab, copy the value of <strong>OpenID Connect provider URL</strong> and save the value in some place for future reference.</li>
<li>Go to <em>IAM -&gt; Identity providers -&gt; Add Provider</em>. Select <em>OpenID Connect</em> as the <em>provider type.</em></li>
<li>Paste the copied url from step 2, in the <em>Provider URL</em> textbox and click <em>‘Get thumbprint’</em>. Set <em>Audience - sts.amazonaws.com</em> in the corresponding text box.</li>
<li>Click the <em>‘Add Provider’</em> button.</li>
<li>Create the required iam role. <em>IAM -&gt; Roles -&gt; Create Role</em>. In the <em>‘Select trusted entity’</em> section, choose <em>‘Web Identity’</em> . In <em>Identity provider</em> drop down, select the OIDC option that is created in step 5. Choose <strong>Audience - sts.amazonaws.com</strong> in the drop down. Click <strong>‘Next’</strong></li>
<li>Search for <em>AmazonEBSCSIDriverPolicy</em> policy in the next window and click ‘Next’ and give name,description,tags for the role and click create role.</li>
<li>In the <em>Roles</em> section, search for the newly created role in step 7 and go inside that role. <em>Trust relationships -&gt; Edit trust policy.</em></li>
</ol>
<blockquote>
<p>&quot;oidc.eks.eu-west-1.amazonaws.com/id/385AA11111111116116:sub&quot;:
&quot;system:serviceaccount:kube-system:ebs-csi-controller-sa&quot;</p>
</blockquote>
<ol start="9">
<li><p>Update the above text with current oidc id and add it as new key-value in the <em>Statement[0] -&gt; Condition -&gt; StringEquals</em>. Refer the full json structure of this trusted relationship json data in the last.</p>
</li>
<li><p>After updating the text, click ‘Update Policy’
Go to <em>EKS -&gt; Clusters -&gt; Newly created cluster in step 1</em>. Click <em>Add-ons</em> tab, <em>Add new.</em></p>
</li>
<li><p>In the pop up choose Name as <strong>Amazon EBS CSI Driver</strong>. <em>Version</em> as latest. Choose Role as the <em>role created in step 7</em>. If the above role is not listed in drop down, reload the section using the reload button and click <strong>Add</strong>.</p>
</li>
<li><p>After some time, the new <strong>Add on</strong> will become active. Then run this <code>kubectl get pods -n kube-system</code> command and we should see csi pods as shown.</p>
</li>
</ol>
<pre><code>    ebs-csi-controller-68d49f84c8-sl7w6   6/6     Running   0          109s 
    ebs-csi-controller-68d49f84c8-w2k6r   6/6     Running   0         2m19s 
    ebs-csi-node-ldmsm                    3/3     Running   0        2m20s
</code></pre>
<p>Then run the commands given in the question.</p>
<p>Following dictionary is the <strong>Trusted relationships</strong> json for role</p>
<pre class="lang-json prettyprint-override"><code>{
    &quot;Version&quot;: &quot;2012-10-17&quot;,
    &quot;Statement&quot;: [
        {
            &quot;Effect&quot;: &quot;Allow&quot;,
            &quot;Principal&quot;: {
                &quot;Federated&quot;: &quot;arn:aws:iam::112345678900:oidc-provider/oidc.eks.eu-west-1.amazonaws.com/id/Axxxxxxxxxxxxx&quot;
            },
            &quot;Action&quot;: &quot;sts:AssumeRoleWithWebIdentity&quot;,
            &quot;Condition&quot;: {
                &quot;StringEquals&quot;: {
                    &quot;oidc.eks.eu-west-1.amazonaws.com/id/Axxxxxxxxxxxxx:sub&quot;: &quot;system:serviceaccount:kube-system:ebs-csi-controller-sa&quot;,
                    &quot;oidc.eks.eu-west-1.amazonaws.com/id/Axxxxxxxxxxxxx:aud&quot;: &quot;sts.amazonaws.com&quot;
                }
            }
        }
    ]
}
</code></pre>
