Citrix SecurSpaces™

Troubleshoot AWS Mount Points

Troubleshooting

Symptom Likely cause Fix
A StorageClass exists but never appears in the Create New list. It is an AWS class with no top-level mountOptions: [tls], or it has the wrong provisioningMode. Add tls to the class.
Error citing missing TLS. The StorageClass lacks mountOptions: [tls]. Add tls to the class.
A workspace hangs while starting, although the Mount Point is ready. No mount target in the workspace’s Availability Zone, or port 2049 is blocked. Add the mount target, or open 2049.
A Mount Point created from typed coordinates becomes ready, then workspaces hang. A wrong or nonexistent file system or access point id. Coordinates are not validated against AWS. Verify the ids in AWS and re-create the Mount Point.
“Bindable PV not found”. The volume is out of the caller’s scope, is not Available, or the name is wrong. Fix the scope label, or clear claimRef.
The create dialog is missing entirely. The provider is not AWS, StorageClasses are mixed, the storage switch is off, or the user’s role cannot manage Mount Points. Check the settings page.
The settings page reports no eligible storage class. No Mount Point StorageClass exists on the cluster. Author one.

Note

Ready means the volume is bound. It does not mean the volume has been mounted. Typed coordinates are never checked against AWS, so a wrong file system id produces a Mount Point that reports ready and fails only when a workspace starts.

Provisioning is subject to two fixed timeouts that cannot be changed: three minutes for the volume to bind, and five minutes for the overall provisioning call. Exceeding either moves the Mount Point to an error state, from which it can be deleted and re-created.

A Mount Point left mid-operation by a restart of the control plane recovers without any out-of-band work. Wait until more than five minutes have passed, then delete it normally.

Warning

Do not delete the claim, volume, or AWS access point by hand first. For a Create New Mount Point that destroys data which the normal delete would have reclaimed in the correct order.

Errors shown to users are sanitized. The underlying AWS and Kubernetes text is in the central and workspace service logs. Enable platform.isDeploymentDebugMode only in test environments.

Key rotation is rejected on AWS with the message that key rotation is not supported for AWS Mount Points. AWS Mount Points have no key: access is through IAM and the access point. Administrators migrating from Azure should not look for a key field.

Troubleshoot AWS Mount Points