Convoy-NFS + AWS EFS = Connection Timeout

[vpsouza]

Hi Everybody, i try everything to make a simple convoy-nfs stack working on a single host (rancherOS) connecting to a new file-system of AWS EFS generated on the same vpc/subnet of the rancher host. Bellow my rancher-compose and docker-compose. I try to add NFS port mapping on convoy container, double check the security-group of rancher-host on my vpc... everything fine but still with timeout issue.

docker-compose.yml

convoy-nfs-storagepool:
  labels:
    io.rancher.container.create_agent: 'true'
  command:
  - storagepool-agent
  image: rancher/convoy-agent:v0.9.0
  volumes:
  - /var/run:/host/var/run
  - /run:/host/run
convoy-nfs:
  labels:
    io.rancher.scheduler.global: 'true'
    io.rancher.container.create_agent: 'true'
  command:
  - volume-agent-nfs
  ports:
    - "2049:2049"
  image: rancher/convoy-agent:v0.9.0
  pid: host
  privileged: true
  volumes:
  - /lib/modules:/lib/modules:ro
  - /proc:/host/proc
  - /var/run:/host/var/run
  - /run:/host/run
  - /etc/docker/plugins:/etc/docker/plugins

rancher-compose.yml

convoy-nfs-storagepool:
  scale: 1
  health_check:
    port: 10241
    interval: 2000
    unhealthy_threshold: 3
    strategy: recreate
    response_timeout: 2000
    request_line: GET /healthcheck HTTP/1.0
    healthy_threshold: 2
  metadata:
    mount_dir: /
    nfs_server: us-west-2a.fs-7b8b70d2.efs.us-west-2.amazonaws.com
convoy-nfs:
  health_check:
    port: 10241
    interval: 2000
    unhealthy_threshold: 3
    strategy: recreate
    response_timeout: 2000
    request_line: GET /healthcheck HTTP/1.0
    healthy_threshold: 2
  metadata:
    mount_dir: /
    nfs_server: us-west-2a.fs-7b8b70d2.efs.us-west-2.amazonaws.com
    mount_opts: nfsvers=4.1

Error:

10/19/2016 8:28:06 PM Waiting for metadata
10/19/2016 8:28:07 Pmt ime="2016-10-19T22:28:07Z" level=info msg="Execing [/usr/bin/nsenter --mount=/proc/18518/ns/mnt -F -- /var/lib/docker/overlay/832a3dc46ea137f515f5600efc61b1f961b531421de47acd280db791ba4d5e31/merged/var/lib/rancher/convoy-agent/share-mnt --stage2 /var/lib/rancher/convoy/test-convoy-edf28e0a-b049-4308-9c5f-e77c0e4c9385 -- /launch volume-agent-nfs-internal 18518]"
10/19/2016 8:28:07 PM Registering convoy socket at /var/run/convoy-test-convoy.sock
10/19/2016 8:28:07 PM Mounting at: /var/lib/rancher/convoy/test-convoy-edf28e0a-b049-4308-9c5f-e77c0e4c9385/mnt
10/19/2016 8:28:07 PM Mounting nfs. Command: mount -t nfs -o nfsvers=4.1 us-west-2a.fs-7b8b70d2.efs.us-west-2.amazonaws.com:/ /var/lib/rancher/convoy/test-convoy-edf28e0a-b049-4308-9c5f-e77c0e4c9385/mnt
10/19/2016 8:32:24 PM mount.nfs: Connection timed out

[janeczku]

You might check that the security group of the EFS mount target allows connections from the EC2 security group:
https://docs.aws.amazon.com/efs/latest/ug/troubleshooting.html#mount-hangs-fails-timeout