If by “minimal” you mean without use of k8s
I said “minimally-different” not “minimal” - you need to narrow down the difference between a working and a broken configuration. Swapping out EFS for EBS is far too large a difference to be useful. You were earlier saying that you thought the permissions on a log directory were the important factor: if so, the difference between the working and broken configs should just be these permissions.
Maybe that helps you move forwards but if not then @RainTown is right, we probably need to break out strace and compare the actual sequence of syscalls between the working and broken versions to see where the difference in behaviour is coming from.
@RainTown is also right that I’m not going to go and set up all this AWS infrastructure to try and reproduce what you’re seeing. Elasticsearch itself doesn’t know anything about k8s or EBS-vs-EFS, it’s fundamentally just a plain old userspace application that interacts with the kernel through the regular syscall interface. Your kernel, in your specific configuration, is rejecting one of these syscalls.