Error mounting a volume using the AWS EFS CSI Driver Operator on ROSA with STS
Issue
-
When installing the AWS EFS CSI Operator on ROSA cluster with STS enabled, the
aws-efs-csi-driver-controller
pods
are not starting due to missingaws-credentials
secret
. It is still looking for IAM user credentials which are not available on an STS cluster since everything uses IAM Roles. -
The events shows error messages similar to the following ones:
MountVolume.SetUp failed for volume "aws-credentials" : secret "aws-efs-cloud-credentials" not found
Warning FailedMount 48s (x10 over 5m16s) kubelet MountVolume.SetUp failed for volume "pvc-XXXXXX" : rpc error: code = Internal desc = Could not mount "fs-XXXX:/" at "/var/lib/kubelet/pods/XXXXX/volumes/kubernetes.io~csi/pvc-XXXXXX/mount": mount failed: exit status 32 Mounting command: mount Mounting arguments: -t efs -o accesspoint=fsap-xxxxx,tls fs-XXXX:/ /var/lib/kubelet/pods/XXXXX/volumes/kubernetes.io~csi/pvc-XXXXXX/mount Output: Could not start amazon-efs-mount-watchdog, unrecognized init system "aws-efs-csi-dri" b'mount.nfs4: access denied by server while mounting 127.0.0.1:/' Warning: config file does not have fips_mode_enabled item in section mount.. You should be able to find a new config file in the same folder as current config file /etc/amazon/efs/efs-utils.conf. Consider update the new config file to latest config file. Use the default value [fips_mode_enabled = False].Warning: config file does not have retry_nfs_mount_command item in section mount.. You should be able to find a new config file in the same folder as current config file /etc/amazon/efs/efs-utils.conf. Consider update the new config file to latest config file. Use the default value [retry_nfs_mount_command = True].
Environment
- Red Hat OpenShift Service on AWS (ROSA)
- 4.10
- AWS security token service (STS)
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.