<p>I am not able to see any log output when deploying a very simple Pod:</p>

<p>myconfig.yaml:</p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: counter
spec:
  containers:
  - name: count
    image: busybox
    args: [/bin/sh, -c,
            'i=0; while true; do echo "$i: $(date)"; i=$((i+1)); sleep 1; done']
</code></pre>

<p>then</p>

<pre><code>kubectl apply -f myconfig.yaml
</code></pre>

<p>This was taken from this official tutorial: <a href="https://kubernetes.io/docs/concepts/cluster-administration/logging/#basic-logging-in-kubernetes" rel="nofollow noreferrer">https://kubernetes.io/docs/concepts/cluster-administration/logging/#basic-logging-in-kubernetes</a> </p>

<p>The pod appears to be running fine:</p>

<pre><code>kubectl describe pod counter
Name:         counter
Namespace:    default
Node:         ip-10-0-0-43.ec2.internal/10.0.0.43
Start Time:   Tue, 20 Nov 2018 12:05:07 -0500
Labels:       &lt;none&gt;
Annotations:  kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"v1","kind":"Pod","metadata":{"annotations":{},"name":"counter","namespace":"default"},"spec":{"containers":[{"args":["/bin/sh","-c","i=0...
Status:       Running
IP:           10.0.0.81
Containers:
  count:
    Container ID:  docker://d2dfdb8644b5a6488d9d324c8c8c2d4637a460693012f35a14cfa135ab628303
    Image:         busybox
    Image ID:      docker-pullable://busybox@sha256:2a03a6059f21e150ae84b0973863609494aad70f0a80eaeb64bddd8d92465812
    Port:          &lt;none&gt;
    Host Port:     &lt;none&gt;
    Args:
      /bin/sh
      -c
      i=0; while true; do echo "$i: $(date)"; i=$((i+1)); sleep 1; done
    State:          Running
      Started:      Tue, 20 Nov 2018 12:05:08 -0500
    Ready:          True
    Restart Count:  0
    Environment:    &lt;none&gt;
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-r6tr6 (ro)
Conditions:
  Type           Status
  Initialized    True 
  Ready          True 
  PodScheduled   True 
Volumes:
  default-token-r6tr6:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  default-token-r6tr6
    Optional:    false
QoS Class:       BestEffort
Node-Selectors:  &lt;none&gt;
Tolerations:     node.kubernetes.io/not-ready:NoExecute for 300s
                 node.kubernetes.io/unreachable:NoExecute for 300s
Events:
  Type    Reason                 Age   From                                Message
  ----    ------                 ----  ----                                -------
  Normal  Scheduled              16m   default-scheduler                   Successfully assigned counter to ip-10-0-0-43.ec2.internal
  Normal  SuccessfulMountVolume  16m   kubelet, ip-10-0-0-43.ec2.internal  MountVolume.SetUp succeeded for volume "default-token-r6tr6"
  Normal  Pulling                16m   kubelet, ip-10-0-0-43.ec2.internal  pulling image "busybox"
  Normal  Pulled                 16m   kubelet, ip-10-0-0-43.ec2.internal  Successfully pulled image "busybox"
  Normal  Created                16m   kubelet, ip-10-0-0-43.ec2.internal  Created container
  Normal  Started                16m   kubelet, ip-10-0-0-43.ec2.internal  Started container
</code></pre>

<p>Nothing appears when running:</p>

<pre><code>kubectl logs counter --follow=true
</code></pre>

<p>I followed Seenickode's comment and i got it working. </p>

<p>I found the new cloudformation template for 1.10.11 or 1.11.5 (current version in aws) useful to compare with my stack.</p>

<p>Here is what i learned:</p>

<ol>
<li>Allowed ports 1025 - 65535 from cluster security group to worker nodes.</li>
<li>Allowed port 443 Egress from Control Plane to Worker Nodes. </li>
</ol>

<p>Then the kubectl logs started to work.</p>

<p>Sample Cloudformation template updates here:</p>

<pre><code>  NodeSecurityGroupFromControlPlaneIngress:
    Type: AWS::EC2::SecurityGroupIngress
    DependsOn: NodeSecurityGroup
    Properties:
      Description: Allow worker Kubelets and pods to receive communication from the cluster control plane
      GroupId: !Ref NodeSecurityGroup
      SourceSecurityGroupId: !Ref ControlPlaneSecurityGroup
      IpProtocol: tcp
      FromPort: 1025
      ToPort: 65535
</code></pre>

<p>Also</p>

<pre><code>  ControlPlaneEgressToNodeSecurityGroupOn443:
    Type: AWS::EC2::SecurityGroupEgress
    DependsOn: NodeSecurityGroup
    Properties:
      Description: Allow the cluster control plane to communicate with pods running extension API servers on port 443
      GroupId:
        Ref: ControlPlaneSecurityGroup
      DestinationSecurityGroupId:
        Ref: NodeSecurityGroup
      IpProtocol: tcp
      FromPort: 443
      ToPort: 443
</code></pre>
