<p>I have followed the steps from this <a href="https://docs.aws.amazon.com/efs/latest/ug/creating-using.html" rel="nofollow noreferrer">guide</a> this <a href="https://github.com/kubernetes-incubator/external-storage/blob/master/aws/efs/README.md" rel="nofollow noreferrer">guide</a> to deploy the <code>efs-provider</code> for Kubernetes and bind an EFS filesystem. I have not succed. </p>

<p>I am implementing Kubernetes with Amazon EKS and I use EC2 instances as worker nodes, all are deployed using <code>eksctl</code>.</p>

<p>After I applied this adjusted <a href="https://github.com/kubernetes-incubator/external-storage/blob/master/aws/efs/deploy/manifest.yaml" rel="nofollow noreferrer">manifest file</a>, the result is:</p>

<pre><code>$ kubectl get pods
NAME                               READY   STATUS    RESTARTS
efs-provisioner-#########-#####   1/1     Running   0       

$ kubectl get pvc
NAME       STATUS    VOLUME
test-pvc   Pending   efs-storage
</code></pre>

<p>No matter how much time I wait, the status of my PVC stucks in <code>Pending</code>.</p>

<p>After the creation of a Kubernetes cluster and worker nodes and the configuration of the EFS filesystem, I apply the <code>efs-provider</code> manifest with all the variables pointing to the EFS filesystem. In the <code>StorageClass</code> configuration file is specified the <code>spec.AccessModes</code> field as <code>ReadWriteMany</code>.</p>

<p>At this point my <code>efs-provider</code> pod is running without errors and the status of  the <code>PVC</code>is <code>Pending</code>. What can it be? How can I configure the <code>efs-provider</code> to use the EFS filesystem? How much should I wait to get the <code>PVC</code> status in <code>Bound</code>?</p>

<hr>

<h1>Update</h1>

<p>About the configuration of the Amazon Web Services, these is what I have done:</p>

<ul>
<li>After the creation of the EFS filesystem, I have created a <strong>mount point</strong> for each subnet where my nodes are.</li>
<li>To each <strong>mount point</strong> is attached a <strong>security group</strong> with a inbound rule to grant the access to the NFS port (2049) from the security group of each nodegroup.</li>
</ul>

<p>The description of my EFS security group is:</p>

<pre><code>{
    "Description": "Communication between the control plane and worker nodes in cluster",
    "GroupName": "##################",
    "IpPermissions": [
        {
        "FromPort": 2049,
        "IpProtocol": "tcp",
        "IpRanges": [],
        "Ipv6Ranges": [],
        "PrefixListIds": [],
        "ToPort": 2049,
        "UserIdGroupPairs": [
            {
            "GroupId": "sg-##################",
            "UserId": "##################"
            }
        ]
        }
    ],
    "OwnerId": "##################",
    "GroupId": "sg-##################",
    "IpPermissionsEgress": [
        {
        "IpProtocol": "-1",
        "IpRanges": [
            {
            "CidrIp": "0.0.0.0/0"
            }
        ],
        "Ipv6Ranges": [],
        "PrefixListIds": [],
        "UserIdGroupPairs": []
        }
    ],
    "VpcId": "vpc-##################"
}
</code></pre>

<h2>Deployment</h2>

<p>The output of the <code>kubectl describe deploy ${DEPLOY_NAME}</code> command is:</p>

<pre><code>$ DEPLOY_NAME=efs-provisioner; \
&gt; kubectl describe deploy ${DEPLOY_NAME}
Name:               efs-provisioner
Namespace:          default
CreationTimestamp:  ####################
Labels:             app=efs-provisioner
Annotations:        deployment.kubernetes.io/revision: 1
kubectl.kubernetes.io/last-applied-configuration:
{"apiVersion":"extensions/v1beta1","kind":"Deployment","metadata":{"annotations":{},"name":"efs-provisioner","namespace":"default"},"spec"...
Selector:           app=efs-provisioner
Replicas:           1 desired | 1 updated | 1 total | 1 available | 0 unavailable
StrategyType:       Recreate
MinReadySeconds:    0
Pod Template:
Labels:           app=efs-provisioner
Service Account:  efs-provisioner
Containers:
efs-provisioner:
Image:      quay.io/external_storage/efs-provisioner:latest
Port:       &lt;none&gt;
Host Port:  &lt;none&gt;
Environment:
FILE_SYSTEM_ID:    &lt;set to the key 'file.system.id' of config map 'efs-provisioner'&gt;    Optional: false
AWS_REGION:        &lt;set to the key 'aws.region' of config map 'efs-provisioner'&gt;        Optional: false
DNS_NAME:          &lt;set to the key 'dns.name' of config map 'efs-provisioner'&gt;          Optional: true
PROVISIONER_NAME:  &lt;set to the key 'provisioner.name' of config map 'efs-provisioner'&gt;  Optional: false
Mounts:
/persistentvolumes from pv-volume (rw)
Volumes:
pv-volume:
Type:      NFS (an NFS mount that lasts the lifetime of a pod)
Server:    fs-#########.efs.##########.amazonaws.com
Path:      /
ReadOnly:  false
Conditions:
Type           Status  Reason
----           ------  ------
Available      True    MinimumReplicasAvailable
OldReplicaSets:  &lt;none&gt;
NewReplicaSet:   efs-provisioner-576c67cf7b (1/1 replicas created)
Events:
Type    Reason             Age   From                   Message
----    ------             ----  ----                   -------
Normal  ScalingReplicaSet  106s  deployment-controller  Scaled up replica set efs-provisioner-576c67cf7b to 1
</code></pre>

<h2>Pod Logs</h2>

<p>The output of the <code>kubectl logs ${POD_NAME}</code> command is:</p>

<pre><code>$ POD_NAME=efs-provisioner-576c67cf7b-5jm95; \
&gt; kubectl logs ${POD_NAME}
E0708 16:03:46.841229       1 efs-provisioner.go:69] fs-#########.efs.##########.amazonaws.com
I0708 16:03:47.049194       1 leaderelection.go:187] attempting to acquire leader lease  default/kubernetes.io-aws-efs...
I0708 16:03:47.061830       1 leaderelection.go:196] successfully acquired lease default/kubernetes.io-aws-efs
I0708 16:03:47.062791       1 controller.go:571] Starting provisioner controller kubernetes.io/aws-efs_efs-provisioner-576c67cf7b-5jm95_f7c5689f-a199-11e9-a152-def1285e1be5!
I0708 16:03:47.062877       1 event.go:221] Event(v1.ObjectReference{Kind:"Endpoints", Namespace:"default", Name:"kubernetes.io-aws-efs", UID:"f7c682cd-a199-11e9-80bd-1640944916e4", APIVersion:"v1", ResourceVersion:"3914", FieldPath:""}): type: 'Normal' reason: 'LeaderElection' efs-provisioner-576c67cf7b-5jm95_f7c5689f-a199-11e9-a152-def1285e1be5 became leader
I0708 16:03:47.162998       1 controller.go:620] Started provisioner controller kubernetes.io/aws-efs_efs-provisioner-576c67cf7b-5jm95_f7c5689f-a199-11e9-a152-def1285e1be5!
</code></pre>

<h2>StorageClass</h2>

<p>The output of the <code>kubectl describe sc ${STORAGE_CLASS_NAME}</code> command is:</p>

<pre><code>$ STORAGE_CLASS_NAME=aws-efs; \
&gt; kubectl describe sc ${STORAGE_CLASS_NAME}
Name:            aws-efs
IsDefaultClass:  No
Annotations:     kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"storage.k8s.io/v1","kind":"StorageClass","metadata":{"annotations":{},"name":"aws-efs"},"provisioner":"aws-efs"}
Provisioner:           aws-efs
Parameters:            &lt;none&gt;
AllowVolumeExpansion:  &lt;unset&gt;
MountOptions:          &lt;none&gt;
ReclaimPolicy:         Delete
VolumeBindingMode:     Immediate
Events:                &lt;none&gt;
</code></pre>

<h2>PersistentVolumeClaim</h2>

<p>The output of the <code>kubectl describe pvc ${PVC_NAME}</code> command is:</p>

<pre><code>$ PVC_NAME=efs; \
&gt; kubectl describe pvc ${PVC_NAME}
Name:          efs
Namespace:     default
StorageClass:  aws-efs
Status:        Pending
Volume:
Labels:        &lt;none&gt;
Annotations:   kubectl.kubernetes.io/last-applied-configuration:
{"apiVersion":"v1","kind":"PersistentVolumeClaim","metadata":{"annotations":{"volume.beta.kubernetes.io/storage-class":"aws-efs"},"name":"...
volume.beta.kubernetes.io/storage-class: aws-efs
Finalizers:    [kubernetes.io/pvc-protection]
Capacity:
Access Modes:
Events:
Type       Reason              Age                 From                         Message
----       ------              ----                ----                         -------
Warning    ProvisioningFailed  43s (x12 over 11m)  persistentvolume-controller  no volume plugin matched
Mounted By:  &lt;none&gt;
</code></pre>

<blockquote>
  <h2>About the questions</h2>
  
  <ol>
  <li><p><strong>Do you have the EFS filesystem id properly configured for your <code>efs-provisioner</code>?</strong> </p>
  
  <ul>
  <li>Yes, both (from the fs and the configured) match.</li>
  </ul></li>
  <li><p><strong>Do you have the proper IAM credentials to access this EFS?</strong> </p>
  
  <ul>
  <li>Yes, my user has and also the <code>eksctl</code> tool configures it.</li>
  </ul></li>
  <li><p><strong>Does that EFS path specified for your provisioner exist?</strong> </p>
  
  <ul>
  <li>Yes, is only the root (/) path.</li>
  </ul></li>
  <li><p><strong>Did you add an EFS endpoint to the subnet that your worker node(s) are running on, or ensure that your EFS subnets have an
  Internet Gateway attached?</strong> </p>
  
  <ul>
  <li>Yes, I have added the EFS endpoints to the subnet that my worker
  node(s) are running on.</li>
  </ul></li>
  <li><p><strong>Did you set your security group to allow the Inbound for NFS port(s)?</strong> </p>
  
  <ul>
  <li>Yes.</li>
  </ul></li>
  </ol>
</blockquote>

<p>I have solved my issue by replacing the provisioner name of my <code>StorageClass</code> from <code>kubernetes.io/aws-efs</code> to only <code>aws-efs</code>. </p>

<p>As we can read on <a href="https://github.com/kubernetes-incubator/external-storage/issues/1111#issuecomment-469307428" rel="nofollow noreferrer">this issue comment</a> on Github posted by <a href="https://github.com/kubernetes-incubator/external-storage/issues/1111#issuecomment-469307428" rel="nofollow noreferrer">wongma7</a>:</p>

<blockquote>
  <p>The issue is that provisioner is <code>kubernetes.io/aws-efs</code>. It can't
  begin with <code>kubernetes.io</code> as that is reserved by kubernetes.</p>
</blockquote>

<p>That solves the <code>ProvisioningFailed</code> on the Events produced on the <code>
PersistentVolumeClaim</code> by the <code>persistentvolume-controller</code>.</p>
