<p>I tested kubernetes deployment with EBS volume mounting on AWS cluster provisioned by kops. This is deployment yml file:</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: helloworld-deployment-volume
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: helloworld
    spec:
      containers:
      - name: k8s-demo
        image: wardviaene/k8s-demo
        ports:
        - name: nodejs-port
          containerPort: 3000
        volumeMounts:
        - mountPath: /myvol
          name: myvolume
      volumes:
      - name: myvolume
        awsElasticBlockStore:
          volumeID: &lt;volume_id&gt;
</code></pre>

<p>After <code>kubectl create -f &lt;path_to_this_yml&gt;</code>, I got the following message in pod description:</p>

<pre><code>Attach failed for volume "myvolume" : Error attaching EBS volume "XXX" to instance "YYY": "UnauthorizedOperation: You are not authorized to perform this operation. status code: 403
</code></pre>

<p>Looks like this is just a permission issue. Ok, I checked policy for node role <code>IAM</code> -> <code>Roles</code> -> <code>nodes.&lt;my_domain&gt;</code> and found that there where no actions which allow to manipulate volumes, there was only <code>ec2:DescribeInstances</code> action by default. So I added <code>AttachVolume</code> and <code>DetachVolume</code> actions:</p>

<pre><code>    {
        "Sid": "kopsK8sEC2NodePerms",
        "Effect": "Allow",
        "Action": [
            "ec2:DescribeInstances",
            "ec2:AttachVolume",
            "ec2:DetachVolume"
        ],
        "Resource": [
            "*"
        ]
    },
</code></pre>

<p>And this didn't help. I'm still getting that error:</p>

<pre><code>Attach failed for volume "myvolume" : Error attaching EBS volume "XXX" to instance "YYY": "UnauthorizedOperation: You are not authorized to perform this operation.
</code></pre>

<p>Am I missing something?</p>

<p>I found a solution. It's described <a href="https://stackoverflow.com/questions/47278433/need-help-on-volume-mount-issue-with-kubernetes">here</a>.</p>

<p>In kops 1.8.0-beta.1, master node requires you to tag the AWS volume with:</p>

<p><code>KubernetesCluster</code>: <code>&lt;clustername-here&gt;</code></p>

<p>So it's necessary to create EBS volume with that tag by using <code>awscli</code>:</p>

<pre><code>aws ec2 create-volume --size 10 --region eu-central-1 --availability-zone eu-central-1a --volume-type gp2 --tag-specifications 'ResourceType=volume,Tags=[{Key=KubernetesCluster,Value=&lt;clustername-here&gt;}]'
</code></pre>

<p>or you can tag it by manually in <code>EC2</code> -> <code>Volumes</code> -> <code>Your volume</code> -> <code>Tags</code></p>

<p>That's it.</p>

<p><strong><em>EDIT:</em></strong></p>

<p>The right cluster name can be found within EC2 instances tags which are part of cluster. Key is the same: <code>KubernetesCluster</code>.</p>
