<p>Trying to mount an encrypted EFS (AWS) to my k8s cluster,</p>

<p>I created everything that is needed (storageclass, PV, PVC) and everything was working fine when the EFS wasn't encrypted.</p>

<p>But now when trying to create the pod I get this error:</p>

<pre><code> Warning  FailedMount  42s  kubelet, ip-10-10-21-111.ap-southeast-2.compute.internal  Unable to mount volumes for pod "apim-rdbms-6d7c484c88-4xp6l_default(e6a2e36d-9ec4-11e8-b026-0644ba7f9448)": timeout expired waiting for volumes to attach/mount for pod "default"/"apim-rdbms-6d7c484c88-4xp6l". list of unattached/unmounted volumes=[apim-rdbms-efs]
</code></pre>

<p>I didn't see any special instructions regarding connecting the pod to encrypted EFS, When tried to mount the nodes to the EFS I had no issue.</p>

<p>Should I install tls on my cluster nodes? Is there a k8s flag I need to use?
couldn't find info regarding this.</p>

Shahar Hamuzim Rajuan
<p>So the oroblem was that I didn't mount target my efs to security groups that my nodes are assigened to.</p>

<p>After creating the encrypted EFS you need to mount the EFS.You can create one mount target in each Availability Zone in your VPC. All EC2 instances in a VPC within a given Availability Zone share a single mount target for a given file system. If you have multiple subnets in an Availability Zone, you create a mount target in one of the subnets. </p>

<p>You can see mounting instructions here:</p>

<p><a href="https://docs.aws.amazon.com/efs/latest/ug/manage-fs-access-create-delete-mount-targets.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/efs/latest/ug/manage-fs-access-create-delete-mount-targets.html</a></p>
