<p>I have created a private EKS cluster using Terraform EKS module, but the Node group failed to join the group.
The auth config seems to be correct.</p>
<pre><code>data:
  mapRoles: |
    - groups:
      - system:bootstrappers
      - system:nodes
      rolearn: arn:aws:iam::accountId:role/eks-node-role
      username: system:node:{{EC2PrivateDNSName}}
</code></pre>
<p>However when i check the control plane log, i am seeing, seems like the private dns name is not correctly populated when authenticate with EKS, what could be the reason for that?
How does the Node retrieve the privateDNSName? We are working in a restricted VPC environment, I am suspecting it might be some incorrect security group configuration.</p>
<pre><code>annotations.authorization.k8s.io/decision   
forbid
annotations.authorization.k8s.io/reason 
unknown node for user &quot;system:node:&quot;
</code></pre>

user2501711
<p>Make sure to create the proper node IAM role: <a href="https://docs.aws.amazon.com/eks/latest/userguide/create-node-role.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/eks/latest/userguide/create-node-role.html</a></p>
<p>Then follow the usual steps to troubleshoot node join failure. It always helps me to find the issue: <a href="https://docs.aws.amazon.com/eks/latest/userguide/troubleshooting.html#worker-node-fail" rel="nofollow noreferrer">https://docs.aws.amazon.com/eks/latest/userguide/troubleshooting.html#worker-node-fail</a></p>
