Pod Impersonation for IAM

[adammw]

Is your feature request related to a problem? Please describe.
Currently, IAM role permissions must be assigned to the CSI driver itself rather than the pods that mount the volumes, leaving permissions of preventing which pods can mount these volumes as an exercise to the cluster administrator.

Describe the solution you'd like in detail
AWS EFS CSI Driver can impersonate the pod service account identity and exchange that identity for an IAM role that is used for mounting, instead of the CSI driver's native IAM identity.

Describe alternatives you've considered
n/a

Additional context
#885 seems to describe a similar feature, but was closed by automation

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[adammw]

/remove-lifecycle stale

[erihanse]

I'm wondering what the status on this is. I see it was implemented then reverted. We want to leverage IRSA with Fargate on EKS. Today I don't see how we could do so without this.