<p>We are having issues with our openshift aws deployment when trying to use persistent volumes. </p>

<p>These are some of the there errors when trying to deploy the mysql-persistent instance.</p>

<p>-Unable to mount volumes for pod "mysql-4-uizxn_persistent-test": Cloud provider does not support volumes
-Error syncing pod, skipping: Cloud provider does not support volumes</p>

<p>We added the following on each of our nodes node-config.yaml</p>

<pre><code>kubeletArguments:
  cloud-provider:
    - "aws"
  cloud-config:
    - "/etc/aws/aws.conf"
</code></pre>

<p>and also added the following to our master-config.yaml</p>

<pre><code>kubernetesMasterConfig:
  apiServerArguments:
    cloud-provider:
      - "aws"
    cloud-config:
      - "/etc/aws/aws.conf"
  controllerArguments:
    cloud-provider:
      - "aws"
    cloud-config:
      - "/etc/aws/aws.conf"
</code></pre>

<p>Not sure if we are just missing something or if there is a known issue/work around.</p>

<p>Also a question is how does openshift or kubernetes know that the config files have been changed?</p>

<p>Also just to give you some context we used <a href="https://github.com/openshift/openshift-ansible/blob/master/README_AWS.md" rel="nofollow">openshift-ansible</a> to deploy our environment.</p>

<p>The way the documentation states to export environment variables is a bit inaccurate. They need to be added to the environment that is referenced by the systemd unit file or the node needs to be granted appropriate IAM permissions.</p>

<p>For configuring the credentials in the environment for the node, add the following to /etc/sysconfig/origin-node (assuming Origin 1.1):</p>

<pre><code>AWS_ACCESS_KEY_ID=&lt;key id&gt;
AWS_SECRET_ACCESS_KEY=&lt;secret key&gt;
</code></pre>

<p>Alternatively, the nodes can be assigned an IAM role with the appropriate permissions. The following cloudformation resource snippet creates a role with the appropriate permissions for a node:</p>

<pre><code>"NodeIAMRole": {
  "Type": "AWS::IAM::Role",
  "Properties": {
    "AssumeRolePolicyDocument": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": { "Service": [ "ec2.amazonaws.com" ] },
          "Action": [ "sts:AssumeRole" ]
        }
      ]
    },
    "Policies": [
      {
        "PolicyName": "demo-node-1",
        "PolicyDocument": {
          "Version" : "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": "ec2:Describe*",
              "Resource": "*"
            }
          ]
        }
      },
      {
        "PolicyName": "demo-node-2",
        "PolicyDocument": {
          "Version" : "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": "ec2:AttachVolume",
              "Resource": "*"
            }
          ]
        }
      },
      {
        "PolicyName": "demo-node-3",
        "PolicyDocument": {
          "Version" : "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": "ec2:DetachVolume",
              "Resource": "*"
            }
          ]
        }
      }
    ]
  }
}
</code></pre>
