<p>I have a problem <strong>deploying with Terraform a node group in an EKS cluster</strong>. The error looks like one plugin is having problems but I do not know how to resolve it.</p>
<p>If I see the EC2 in the AWS console (web), I can see the instance of the cluster  but I have this error in the cluster.</p>
<p>The error was shown in  my <strong>pipeline</strong>:</p>
<blockquote>
<p>Error: waiting for EKS Node Group (UNIR-API-REST-CLUSTER-DEV:node_sping_boot) creation: NodeCreationFailure: Instances failed to join the kubernetes cluster. Resource IDs: [i-05ed58f8101240dc8]<br />
on EKS.tf line 17, in resource &quot;aws_eks_node_group&quot; &quot;nodes&quot;:<br />
17: resource &quot;aws_eks_node_group&quot; &quot;nodes&quot;<br />
2020-06-01T00:03:50.576Z [DEBUG] plugin: plugin process exited: path=/home/ubuntu/.jenkins/workspace/shop_infraestucture_generator_pipline/shop-proyect-dev/.terraform/plugins/linux_amd64/terraform-provider-aws_v2.64.0_x4 pid=13475<br />
2020-06-01T00:03:50.576Z [DEBUG] plugin: plugin exited</p>
</blockquote>
<p>And the error is printed in <strong>AWS console</strong>:</p>
<p><a href="https://i.stack.imgur.com/Q7wUm.png" rel="nofollow noreferrer">Link</a></p>
<p>This is the code in  Terraform  I use to create my project:</p>
<p><strong>EKS.tf</strong> for creating the cluster and de nodes</p>
<pre><code>resource &quot;aws_eks_cluster&quot; &quot;CLUSTER&quot; {
  name     = &quot;UNIR-API-REST-CLUSTER-${var.SUFFIX}&quot;
  role_arn = &quot;${aws_iam_role.eks_cluster_role.arn}&quot;
  vpc_config {
    subnet_ids = [
      &quot;${aws_subnet.unir_subnet_cluster_1.id}&quot;,&quot;${aws_subnet.unir_subnet_cluster_2.id}&quot;
    ]
  }
  depends_on = [
    &quot;aws_iam_role_policy_attachment.AmazonEKSWorkerNodePolicy&quot;,
    &quot;aws_iam_role_policy_attachment.AmazonEKS_CNI_Policy&quot;,
    &quot;aws_iam_role_policy_attachment.AmazonEC2ContainerRegistryReadOnly&quot;,
  ]
}


resource &quot;aws_eks_node_group&quot; &quot;nodes&quot; {
  cluster_name    = &quot;${aws_eks_cluster.CLUSTER.name}&quot;
  node_group_name = &quot;node_sping_boot&quot;
  node_role_arn   = &quot;${aws_iam_role.eks_nodes_role.arn}&quot;
  subnet_ids      = [
      &quot;${aws_subnet.unir_subnet_cluster_1.id}&quot;,&quot;${aws_subnet.unir_subnet_cluster_2.id}&quot;
  ]
  scaling_config {
    desired_size = 1
    max_size     = 5
    min_size     = 1
  }
# instance_types is mediumt3 by default
# Ensure that IAM Role permissions are created before and deleted after EKS Node Group handling.
# Otherwise, EKS will not be able to properly delete EC2 Instances and Elastic Network Interfaces.
  depends_on = [
    &quot;aws_iam_role_policy_attachment.AmazonEKSWorkerNodePolicy&quot;,
    &quot;aws_iam_role_policy_attachment.AmazonEKS_CNI_Policy&quot;,
    &quot;aws_iam_role_policy_attachment.AmazonEC2ContainerRegistryReadOnly&quot;,
  ]
}

output &quot;eks_cluster_endpoint&quot; {
  value = &quot;${aws_eks_cluster.CLUSTER.endpoint}&quot;
}

output &quot;eks_cluster_certificat_authority&quot; {
    value = &quot;${aws_eks_cluster.CLUSTER.certificate_authority}&quot;
}
</code></pre>
<p><strong>securityAndGroups.tf</strong></p>
<pre><code>resource &quot;aws_iam_role&quot; &quot;eks_cluster_role&quot; {
  name = &quot;eks-cluster-${var.SUFFIX}&quot;

  assume_role_policy = &lt;&lt;POLICY
{
  &quot;Version&quot;: &quot;2012-10-17&quot;,
  &quot;Statement&quot;: [
    {
      &quot;Effect&quot;: &quot;Allow&quot;,
      &quot;Principal&quot;: {
        &quot;Service&quot;: &quot;eks.amazonaws.com&quot;
      },
      &quot;Action&quot;: &quot;sts:AssumeRole&quot;
    }
  ]
}
POLICY
}


resource &quot;aws_iam_role&quot; &quot;eks_nodes_role&quot; {
  name = &quot;eks-node-${var.SUFFIX}&quot;

  assume_role_policy = &lt;&lt;POLICY
{
  &quot;Version&quot;: &quot;2012-10-17&quot;,
  &quot;Statement&quot;: [
    {
      &quot;Effect&quot;: &quot;Allow&quot;,
      &quot;Principal&quot;: {
        &quot;Service&quot;: &quot;ec2.amazonaws.com&quot;
      },
      &quot;Action&quot;: &quot;sts:AssumeRole&quot;
    }
  ]
}
POLICY
}


resource &quot;aws_iam_role_policy_attachment&quot; &quot;AmazonEKSClusterPolicy&quot; {
  policy_arn = &quot;arn:aws:iam::aws:policy/AmazonEKSClusterPolicy&quot;
  role       = &quot;${aws_iam_role.eks_cluster_role.name}&quot;
}

resource &quot;aws_iam_role_policy_attachment&quot; &quot;AmazonEKSServicePolicy&quot; {
  policy_arn = &quot;arn:aws:iam::aws:policy/AmazonEKSServicePolicy&quot;
  role       = &quot;${aws_iam_role.eks_cluster_role.name}&quot;
}

resource &quot;aws_iam_role_policy_attachment&quot; &quot;AmazonEKSWorkerNodePolicy&quot; {
  policy_arn = &quot;arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy&quot;
  role       = &quot;${aws_iam_role.eks_nodes_role.name}&quot;
}

resource &quot;aws_iam_role_policy_attachment&quot; &quot;AmazonEKS_CNI_Policy&quot; {
  policy_arn = &quot;arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy&quot;
  role       = &quot;${aws_iam_role.eks_nodes_role.name}&quot;
}

resource &quot;aws_iam_role_policy_attachment&quot; &quot;AmazonEC2ContainerRegistryReadOnly&quot; {
  policy_arn = &quot;arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly&quot;
  role       = &quot;${aws_iam_role.eks_nodes_role.name}&quot;
}
</code></pre>
<p><strong>VPCAndRouting.tf</strong> to create my routing, VPC, and Subnets</p>
<pre><code>resource &quot;aws_vpc&quot; &quot;unir_shop_vpc_dev&quot; {
  cidr_block = &quot;${var.NET_CIDR_BLOCK}&quot;
  enable_dns_hostnames = true
  enable_dns_support = true
  tags = {
    Name = &quot;UNIR-VPC-SHOP-${var.SUFFIX}&quot;
    Environment = &quot;${var.SUFFIX}&quot;
  }
}
resource &quot;aws_route_table&quot; &quot;route&quot; {
  vpc_id = &quot;${aws_vpc.unir_shop_vpc_dev.id}&quot;
  route {
    cidr_block = &quot;0.0.0.0/0&quot;
    gateway_id = &quot;${aws_internet_gateway.unir_gat_shop_dev.id}&quot;
  }
  tags = {
    Name = &quot;UNIR-RoutePublic-${var.SUFFIX}&quot;
    Environment = &quot;${var.SUFFIX}&quot;
  }
}

data &quot;aws_availability_zones&quot; &quot;available&quot; {
  state = &quot;available&quot;
}
resource &quot;aws_subnet&quot; &quot;unir_subnet_aplications&quot; {
  vpc_id = &quot;${aws_vpc.unir_shop_vpc_dev.id}&quot;
  cidr_block = &quot;${var.SUBNET_CIDR_APLICATIONS}&quot;
  availability_zone = &quot;${var.ZONE_SUB}&quot;
  depends_on = [&quot;aws_internet_gateway.unir_gat_shop_dev&quot;]
  map_public_ip_on_launch = true
  tags = {
    Name = &quot;UNIR-SUBNET-APLICATIONS-${var.SUFFIX}&quot;
    Environment = &quot;${var.SUFFIX}&quot;
  }
}

resource &quot;aws_subnet&quot; &quot;unir_subnet_cluster_1&quot; {
  vpc_id = &quot;${aws_vpc.unir_shop_vpc_dev.id}&quot;
  cidr_block = &quot;${var.SUBNET_CIDR_CLUSTER_1}&quot;
  map_public_ip_on_launch = true
  availability_zone = &quot;${var.ZONE_SUB_CLUSTER_2}&quot;
  tags = {
    &quot;kubernetes.io/cluster/UNIR-API-REST-CLUSTER-${var.SUFFIX}&quot; = &quot;shared&quot;
  }
}

resource &quot;aws_subnet&quot; &quot;unir_subnet_cluster_2&quot; {
  vpc_id = &quot;${aws_vpc.unir_shop_vpc_dev.id}&quot;
  cidr_block = &quot;${var.SUBNET_CIDR_CLUSTER_2}&quot;
  availability_zone = &quot;${var.ZONE_SUB_CLUSTER_1}&quot;
  map_public_ip_on_launch = true
  tags = {
    &quot;kubernetes.io/cluster/UNIR-API-REST-CLUSTER-${var.SUFFIX}&quot; = &quot;shared&quot;
  }

}

resource &quot;aws_internet_gateway&quot; &quot;unir_gat_shop_dev&quot; {
  vpc_id = &quot;${aws_vpc.unir_shop_vpc_dev.id}&quot;
  tags = {
    Environment = &quot;${var.SUFFIX}&quot;
    Name = &quot;UNIR-publicGateway-${var.SUFFIX}&quot;
  }
}
</code></pre>
<p>My variables:</p>
<pre><code>SUFFIX=&quot;DEV&quot;
ZONE=&quot;eu-west-1&quot;
TERRAFORM_USER_ID=
TERRAFORM_USER_PASS=
ZONE_SUB=&quot;eu-west-1b&quot;
ZONE_SUB_CLUSTER_1=&quot;eu-west-1a&quot;
ZONE_SUB_CLUSTER_2=&quot;eu-west-1c&quot;
NET_CIDR_BLOCK=&quot;172.15.0.0/24&quot;
SUBNET_CIDR_APLICATIONS=&quot;172.15.0.0/27&quot;
SUBNET_CIDR_CLUSTER_1=&quot;172.15.0.32/27&quot;
SUBNET_CIDR_CLUSTER_2=&quot;172.15.0.64/27&quot;
SUBNET_CIDR_CLUSTER_3=&quot;172.15.0.128/27&quot;
SUBNET_CIDR_CLUSTER_4=&quot;172.15.0.160/27&quot;
SUBNET_CIDR_CLUSTER_5=&quot;172.15.0.192/27&quot;
SUBNET_CIDR_CLUSTER_6=&quot;172.15.0.224/27&quot;
MONGO_SSH_KEY=
KIBANA_SSH_KEY=
CLUSTER_SSH_KEY=
</code></pre>
<p>Will be more logs necesary?</p>

<p>According to the AWS <a href="https://docs.aws.amazon.com/eks/latest/userguide/troubleshooting.html" rel="nofollow noreferrer">documentation</a>:</p>

<blockquote>
  <p>If you receive the error "Instances failed to join the kubernetes
  cluster" in the AWS Management Console, ensure that either the
  cluster's private endpoint access is enabled, or that you have
  correctly configured CIDR blocks for public endpoint access. For more
  information, see Amazon EKS cluster endpoint access control.</p>
</blockquote>

<p>I noticed that you are switching the availability zones for your subnets:</p>

<pre><code>resource "aws_subnet" "unir_subnet_cluster_1" {
  vpc_id = "${aws_vpc.unir_shop_vpc_dev.id}"
  cidr_block = "${var.SUBNET_CIDR_CLUSTER_1}"
  map_public_ip_on_launch = true
  availability_zone = "${var.ZONE_SUB_CLUSTER_2}"
</code></pre>

<p>You have assigned <code>var.ZONE_SUB_CLUSTER_2</code> to <code>unir_subnet_cluster_1</code> and <code>var.ZONE_SUB_CLUSTER_1</code> to <code>unir_subnet_cluster_2</code>. Maybe this could be a cause for the misconfiguration.</p>
