<p>I have a problem <strong>deploying with Terraform a node group in an EKS cluster</strong>. The error looks like one plugin is having problems but I do not know how to resolve it.</p>
<p>If I see the EC2 in the AWS console (web), I can see the instance of the cluster  but I have this error in the cluster.</p>
<p>The error was shown in  my <strong>pipeline</strong>:</p>
<blockquote>
<p>Error: waiting for EKS Node Group (UNIR-API-REST-CLUSTER-DEV:node_sping_boot) creation: NodeCreationFailure: Instances failed to join the kubernetes cluster. Resource IDs: [i-05ed58f8101240dc8]<br />
on EKS.tf line 17, in resource &quot;aws_eks_node_group&quot; &quot;nodes&quot;:<br />
17: resource &quot;aws_eks_node_group&quot; &quot;nodes&quot;<br />
2020-06-01T00:03:50.576Z [DEBUG] plugin: plugin process exited: path=/home/ubuntu/.jenkins/workspace/shop_infraestucture_generator_pipline/shop-proyect-dev/.terraform/plugins/linux_amd64/terraform-provider-aws_v2.64.0_x4 pid=13475<br />
2020-06-01T00:03:50.576Z [DEBUG] plugin: plugin exited</p>
</blockquote>
<p>And the error is printed in <strong>AWS console</strong>:</p>
<p><a href="https://i.stack.imgur.com/Q7wUm.png" rel="nofollow noreferrer">Link</a></p>
<p>This is the code in  Terraform  I use to create my project:</p>
<p><strong>EKS.tf</strong> for creating the cluster and de nodes</p>
<pre><code>resource &quot;aws_eks_cluster&quot; &quot;CLUSTER&quot; {
  name     = &quot;UNIR-API-REST-CLUSTER-${var.SUFFIX}&quot;
  role_arn = &quot;${aws_iam_role.eks_cluster_role.arn}&quot;
  vpc_config {
    subnet_ids = [
      &quot;${aws_subnet.unir_subnet_cluster_1.id}&quot;,&quot;${aws_subnet.unir_subnet_cluster_2.id}&quot;
    ]
  }
  depends_on = [
    &quot;aws_iam_role_policy_attachment.AmazonEKSWorkerNodePolicy&quot;,
    &quot;aws_iam_role_policy_attachment.AmazonEKS_CNI_Policy&quot;,
    &quot;aws_iam_role_policy_attachment.AmazonEC2ContainerRegistryReadOnly&quot;,
  ]
}


resource &quot;aws_eks_node_group&quot; &quot;nodes&quot; {
  cluster_name    = &quot;${aws_eks_cluster.CLUSTER.name}&quot;
  node_group_name = &quot;node_sping_boot&quot;
  node_role_arn   = &quot;${aws_iam_role.eks_nodes_role.arn}&quot;
  subnet_ids      = [
      &quot;${aws_subnet.unir_subnet_cluster_1.id}&quot;,&quot;${aws_subnet.unir_subnet_cluster_2.id}&quot;
  ]
  scaling_config {
    desired_size = 1
    max_size     = 5
    min_size     = 1
  }
# instance_types is mediumt3 by default
# Ensure that IAM Role permissions are created before and deleted after EKS Node Group handling.
# Otherwise, EKS will not be able to properly delete EC2 Instances and Elastic Network Interfaces.
  depends_on = [
    &quot;aws_iam_role_policy_attachment.AmazonEKSWorkerNodePolicy&quot;,
    &quot;aws_iam_role_policy_attachment.AmazonEKS_CNI_Policy&quot;,
    &quot;aws_iam_role_policy_attachment.AmazonEC2ContainerRegistryReadOnly&quot;,
  ]
}

output &quot;eks_cluster_endpoint&quot; {
  value = &quot;${aws_eks_cluster.CLUSTER.endpoint}&quot;
}

output &quot;eks_cluster_certificat_authority&quot; {
    value = &quot;${aws_eks_cluster.CLUSTER.certificate_authority}&quot;
}
</code></pre>
<p><strong>securityAndGroups.tf</strong></p>
<pre><code>resource &quot;aws_iam_role&quot; &quot;eks_cluster_role&quot; {
  name = &quot;eks-cluster-${var.SUFFIX}&quot;

  assume_role_policy = &lt;&lt;POLICY
{
  &quot;Version&quot;: &quot;2012-10-17&quot;,
  &quot;Statement&quot;: [
    {
      &quot;Effect&quot;: &quot;Allow&quot;,
      &quot;Principal&quot;: {
        &quot;Service&quot;: &quot;eks.amazonaws.com&quot;
      },
      &quot;Action&quot;: &quot;sts:AssumeRole&quot;
    }
  ]
}
POLICY
}


resource &quot;aws_iam_role&quot; &quot;eks_nodes_role&quot; {
  name = &quot;eks-node-${var.SUFFIX}&quot;

  assume_role_policy = &lt;&lt;POLICY
{
  &quot;Version&quot;: &quot;2012-10-17&quot;,
  &quot;Statement&quot;: [
    {
      &quot;Effect&quot;: &quot;Allow&quot;,
      &quot;Principal&quot;: {
        &quot;Service&quot;: &quot;ec2.amazonaws.com&quot;
      },
      &quot;Action&quot;: &quot;sts:AssumeRole&quot;
    }
  ]
}
POLICY
}


resource &quot;aws_iam_role_policy_attachment&quot; &quot;AmazonEKSClusterPolicy&quot; {
  policy_arn = &quot;arn:aws:iam::aws:policy/AmazonEKSClusterPolicy&quot;
  role       = &quot;${aws_iam_role.eks_cluster_role.name}&quot;
}

resource &quot;aws_iam_role_policy_attachment&quot; &quot;AmazonEKSServicePolicy&quot; {
  policy_arn = &quot;arn:aws:iam::aws:policy/AmazonEKSServicePolicy&quot;
  role       = &quot;${aws_iam_role.eks_cluster_role.name}&quot;
}

resource &quot;aws_iam_role_policy_attachment&quot; &quot;AmazonEKSWorkerNodePolicy&quot; {
  policy_arn = &quot;arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy&quot;
  role       = &quot;${aws_iam_role.eks_nodes_role.name}&quot;
}

resource &quot;aws_iam_role_policy_attachment&quot; &quot;AmazonEKS_CNI_Policy&quot; {
  policy_arn = &quot;arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy&quot;
  role       = &quot;${aws_iam_role.eks_nodes_role.name}&quot;
}

resource &quot;aws_iam_role_policy_attachment&quot; &quot;AmazonEC2ContainerRegistryReadOnly&quot; {
  policy_arn = &quot;arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly&quot;
  role       = &quot;${aws_iam_role.eks_nodes_role.name}&quot;
}
</code></pre>
<p><strong>VPCAndRouting.tf</strong> to create my routing, VPC, and Subnets</p>
<pre><code>resource &quot;aws_vpc&quot; &quot;unir_shop_vpc_dev&quot; {
  cidr_block = &quot;${var.NET_CIDR_BLOCK}&quot;
  enable_dns_hostnames = true
  enable_dns_support = true
  tags = {
    Name = &quot;UNIR-VPC-SHOP-${var.SUFFIX}&quot;
    Environment = &quot;${var.SUFFIX}&quot;
  }
}
resource &quot;aws_route_table&quot; &quot;route&quot; {
  vpc_id = &quot;${aws_vpc.unir_shop_vpc_dev.id}&quot;
  route {
    cidr_block = &quot;0.0.0.0/0&quot;
    gateway_id = &quot;${aws_internet_gateway.unir_gat_shop_dev.id}&quot;
  }
  tags = {
    Name = &quot;UNIR-RoutePublic-${var.SUFFIX}&quot;
    Environment = &quot;${var.SUFFIX}&quot;
  }
}

data &quot;aws_availability_zones&quot; &quot;available&quot; {
  state = &quot;available&quot;
}
resource &quot;aws_subnet&quot; &quot;unir_subnet_aplications&quot; {
  vpc_id = &quot;${aws_vpc.unir_shop_vpc_dev.id}&quot;
  cidr_block = &quot;${var.SUBNET_CIDR_APLICATIONS}&quot;
  availability_zone = &quot;${var.ZONE_SUB}&quot;
  depends_on = [&quot;aws_internet_gateway.unir_gat_shop_dev&quot;]
  map_public_ip_on_launch = true
  tags = {
    Name = &quot;UNIR-SUBNET-APLICATIONS-${var.SUFFIX}&quot;
    Environment = &quot;${var.SUFFIX}&quot;
  }
}

resource &quot;aws_subnet&quot; &quot;unir_subnet_cluster_1&quot; {
  vpc_id = &quot;${aws_vpc.unir_shop_vpc_dev.id}&quot;
  cidr_block = &quot;${var.SUBNET_CIDR_CLUSTER_1}&quot;
  map_public_ip_on_launch = true
  availability_zone = &quot;${var.ZONE_SUB_CLUSTER_2}&quot;
  tags = {
    &quot;kubernetes.io/cluster/UNIR-API-REST-CLUSTER-${var.SUFFIX}&quot; = &quot;shared&quot;
  }
}

resource &quot;aws_subnet&quot; &quot;unir_subnet_cluster_2&quot; {
  vpc_id = &quot;${aws_vpc.unir_shop_vpc_dev.id}&quot;
  cidr_block = &quot;${var.SUBNET_CIDR_CLUSTER_2}&quot;
  availability_zone = &quot;${var.ZONE_SUB_CLUSTER_1}&quot;
  map_public_ip_on_launch = true
  tags = {
    &quot;kubernetes.io/cluster/UNIR-API-REST-CLUSTER-${var.SUFFIX}&quot; = &quot;shared&quot;
  }

}

resource &quot;aws_internet_gateway&quot; &quot;unir_gat_shop_dev&quot; {
  vpc_id = &quot;${aws_vpc.unir_shop_vpc_dev.id}&quot;
  tags = {
    Environment = &quot;${var.SUFFIX}&quot;
    Name = &quot;UNIR-publicGateway-${var.SUFFIX}&quot;
  }
}
</code></pre>
<p>My variables:</p>
<pre><code>SUFFIX=&quot;DEV&quot;
ZONE=&quot;eu-west-1&quot;
TERRAFORM_USER_ID=
TERRAFORM_USER_PASS=
ZONE_SUB=&quot;eu-west-1b&quot;
ZONE_SUB_CLUSTER_1=&quot;eu-west-1a&quot;
ZONE_SUB_CLUSTER_2=&quot;eu-west-1c&quot;
NET_CIDR_BLOCK=&quot;172.15.0.0/24&quot;
SUBNET_CIDR_APLICATIONS=&quot;172.15.0.0/27&quot;
SUBNET_CIDR_CLUSTER_1=&quot;172.15.0.32/27&quot;
SUBNET_CIDR_CLUSTER_2=&quot;172.15.0.64/27&quot;
SUBNET_CIDR_CLUSTER_3=&quot;172.15.0.128/27&quot;
SUBNET_CIDR_CLUSTER_4=&quot;172.15.0.160/27&quot;
SUBNET_CIDR_CLUSTER_5=&quot;172.15.0.192/27&quot;
SUBNET_CIDR_CLUSTER_6=&quot;172.15.0.224/27&quot;
MONGO_SSH_KEY=
KIBANA_SSH_KEY=
CLUSTER_SSH_KEY=
</code></pre>
<p>Will be more logs necesary?</p>

<p>There is also a quick way to troubleshoot such issues. You could use &quot;AWSSupport-TroubleshootEKSWorkerNode&quot; Runbook. This Runbook is designed to help troubleshooting EKS worker node that failed to join an EKS cluster.
You need to go to AWS Systems Manager -&gt; Automation -&gt; Select the Runbook -&gt; Execute the Runbook with ClusterName and Instance-id.</p>
<p>This is pretty helpful in troubleshooting and provides a nice summary at the end of the execution.</p>
<p>You could also refer the documentation <a href="https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-awssupport-troubleshooteksworkernode.html" rel="nofollow noreferrer">here</a>.</p>
