<p>I have 2 EKS clusters, in 2 different AWS accounts and with, I might assume, different firewalls (which I don't have access to). The first one (Dev) is all right, however, with the same configuration, UAT cluster pods is struggling to resolve DNS. The Nodes can resolve and seems to be all right.</p>

<p>1) ping 8.8.8.8 works</p>

<pre><code>--- 8.8.8.8 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3003ms
</code></pre>

<p>2) I can ping the IP of google (and others), but not the actual dns names.</p>

<p>Our configuration:</p>

<ol>
<li>configured with Terraform.</li>
<li>The worker nodes and control plane SG are the same than the dev ones. I believe those are fine.</li>
<li>Added 53 TCP and 53 UDP on inbound + outbound NACl (just to be sure 53 was really open...). Added 53 TCP and 53 UDP outbound from Worker Nodes.</li>
<li>We are using <code>ami-059c6874350e63ca9</code> with 1.14 kubernetes version.</li>
</ol>

<p>I am unsure if the problem is a firewall somewhere, coredns, my configuration that needs to be updated or an "stupid mistake". Any help would be appreciated.</p>

shrimpy
<p>Note that this issue may present itself in many forms (e.g. DNS not resolving is just one possible case). The <code>terraform-awk-eks</code> module exposes a terraform input to create the necessary security group rules that allow these inter worker-group/node-group communications: <code>worker_create_cluster_primary_security_group_rules</code>. More information in this <code>terraform-awk-eks</code> issue <a href="https://github.com/terraform-aws-modules/terraform-aws-eks/issues/1089" rel="nofollow noreferrer">https://github.com/terraform-aws-modules/terraform-aws-eks/issues/1089</a></p>
<p>When the input is enabled, terraform creates the following security group rules:</p>
<pre><code>  # module.eks.module.eks.aws_security_group_rule.cluster_primary_ingress_workers[0] will be created                                                                                                                                                                                                                           
  + resource &quot;aws_security_group_rule&quot; &quot;cluster_primary_ingress_workers&quot; {                                                                                                                                                                                                                                                     
      + description              = &quot;Allow pods running on workers to send communication to cluster primary security group (e.g. Fargate pods).&quot;                                                                                                                                                                                
      + from_port                = 0                                                                                                                                                                                                                                                                                           
      + id                       = (known after apply)                                                                                                                                                                                                                                                                         
      + protocol                 = &quot;-1&quot;                                                                                                                                                                                                                                                                                        
      + security_group_id        = &quot;sg-03bb33d3318e4aa03&quot;                                                                                                                                                                                                                                                                      
      + self                     = false                                                                                                                                                                                                                                                                                       
      + source_security_group_id = &quot;sg-0fffc4d49a499a1d8&quot;                                                                                                                                                                                                                                                                      
      + to_port                  = 65535                                                                                                                                                                                                                                                                                       
      + type                     = &quot;ingress&quot;                                                                                                                                                                                                                                                                                   
    }                                                                                                                                                                                                                                                                                                                          
                                                                                                                                                                                                                                                                                                                               
  # module.eks.module.eks.aws_security_group_rule.workers_ingress_cluster_primary[0] will be created                                                                                                                                                                                                                           
  + resource &quot;aws_security_group_rule&quot; &quot;workers_ingress_cluster_primary&quot; {                                                                                                                                                                                                                                                     
      + description              = &quot;Allow pods running on workers to receive communication from cluster primary security group (e.g. Fargate pods).&quot;                                                                                                                                                                           
      + from_port                = 0                                                                                                                                                                                                                                                                                           
      + id                       = (known after apply)                                                                                                                                                                                                                                                                         
      + protocol                 = &quot;-1&quot;                                                                                                                                                                                                                                                                                        
      + security_group_id        = &quot;sg-0fffc4d49a499a1d8&quot;                                                                                                                                                                                                                                                                      
      + self                     = false
      + source_security_group_id = &quot;sg-03bb33d3318e4aa03&quot;
      + to_port                  = 65535
      + type                     = &quot;ingress&quot;
    }
</code></pre>
