<p>I deployed a EKS cluster to AWS via terraform. There are two fargate profile, one for <code>kube-system</code> the other is <code>default</code>. After create the cluster, all pods under <code>kube-system</code> are pending. And the error is:</p>
<pre><code>$ kubectl get pods -A
NAMESPACE     NAME                       READY   STATUS    RESTARTS   AGE
kube-system   coredns-6db676b456-694w8   0/1     Pending   0          3m43s
kube-system   coredns-6db676b456-tddtd   0/1     Pending   0          3m43s
kube-system   coredns-b8f47f545-7wzm8    0/1     Pending   0          78m

$ kubectl describe --namespace kube-system pod coredns-6db676b456-694w8
Warning  FailedScheduling  21s (x3 over 92s)  default-scheduler  no nodes available to schedule pods

</code></pre>
<p>It seems the fargate is not scheculed to these pods. What did I do wrong? Below is the full terrform configuration:</p>
<pre><code>resource &quot;aws_eks_cluster&quot; &quot;elk&quot; {
  name     = &quot;elk&quot;
  role_arn = aws_iam_role.elk.arn
  version  = 1.20

  vpc_config {
    subnet_ids = [module.vpc.private_subnets[0], module.vpc.private_subnets[1]]
  }

  # Ensure that IAM Role permissions are created before and deleted after EKS Cluster handling.
  # Otherwise, EKS will not be able to properly delete EKS managed EC2 infrastructure such as Security Groups.
  depends_on = [
    aws_iam_role_policy_attachment.elk-AmazonEKSClusterPolicy,
    aws_iam_role_policy_attachment.elk-AmazonEKSVPCResourceController,
  ]
}

output &quot;endpoint&quot; {
  value = aws_eks_cluster.elk.endpoint
}

output &quot;kubeconfig-certificate-authority-data&quot; {
  value = aws_eks_cluster.elk.certificate_authority[0].data
}

# Fargate

resource &quot;aws_eks_fargate_profile&quot; &quot;elk&quot; {
  cluster_name           = aws_eks_cluster.elk.name
  fargate_profile_name   = &quot;elk_profile&quot;
  pod_execution_role_arn = aws_iam_role.fargate_profile.arn
  subnet_ids             = [module.vpc.private_subnets[0], module.vpc.private_subnets[1]]

  selector {
    namespace = &quot;default&quot;
  }
}

resource &quot;aws_eks_fargate_profile&quot; &quot;kube_system&quot; {
  cluster_name           = aws_eks_cluster.elk.name
  fargate_profile_name   = &quot;kube_system_profile&quot;
  pod_execution_role_arn = aws_iam_role.fargate_profile.arn
  subnet_ids             = [module.vpc.private_subnets[0], module.vpc.private_subnets[1]]

  selector {
    namespace = &quot;kube-system&quot;
  }
}

# IAM Role

resource &quot;aws_iam_role&quot; &quot;elk&quot; {
  name = &quot;eks-cluster-elk&quot;

  assume_role_policy = &lt;&lt;POLICY
{
  &quot;Version&quot;: &quot;2012-10-17&quot;,
  &quot;Statement&quot;: [
    {
      &quot;Effect&quot;: &quot;Allow&quot;,
      &quot;Principal&quot;: {
        &quot;Service&quot;: &quot;eks.amazonaws.com&quot;
      },
      &quot;Action&quot;: &quot;sts:AssumeRole&quot;
    }
  ]
}
POLICY
}

resource &quot;aws_iam_role_policy_attachment&quot; &quot;elk-AmazonEKSClusterPolicy&quot; {
  policy_arn = &quot;arn:aws:iam::aws:policy/AmazonEKSClusterPolicy&quot;
  role       = aws_iam_role.elk.name
}

# Optionally, enable Security Groups for Pods
# Reference: https://docs.aws.amazon.com/eks/latest/userguide/security-groups-for-pods.html
resource &quot;aws_iam_role_policy_attachment&quot; &quot;elk-AmazonEKSVPCResourceController&quot; {
  policy_arn = &quot;arn:aws:iam::aws:policy/AmazonEKSVPCResourceController&quot;
  role       = aws_iam_role.elk.name
}

# IAM role for service account

data &quot;tls_certificate&quot; &quot;elk&quot; {
  url = aws_eks_cluster.elk.identity[0].oidc[0].issuer
}

resource &quot;aws_iam_openid_connect_provider&quot; &quot;elk&quot; {
  client_id_list  = [&quot;sts.amazonaws.com&quot;]
  thumbprint_list = [data.tls_certificate.elk.certificates[0].sha1_fingerprint]
  url             = aws_eks_cluster.elk.identity[0].oidc[0].issuer
}

data &quot;aws_iam_policy_document&quot; &quot;elk_assume_role_policy&quot; {
  statement {
    actions = [&quot;sts:AssumeRoleWithWebIdentity&quot;]
    effect  = &quot;Allow&quot;

    condition {
      test     = &quot;StringEquals&quot;
      variable = &quot;${replace(aws_iam_openid_connect_provider.elk.url, &quot;https://&quot;, &quot;&quot;)}:sub&quot;
      values   = [&quot;system:serviceaccount:kube-system:aws-node&quot;]
    }

    principals {
      identifiers = [aws_iam_openid_connect_provider.elk.arn]
      type        = &quot;Federated&quot;
    }
  }
}

# resource &quot;aws_iam_role&quot; &quot;elk&quot; {
#   assume_role_policy = data.aws_iam_policy_document.elk_assume_role_policy.json
#   name               = &quot;elk&quot;
# }

# IAM role for fargate profile

resource &quot;aws_iam_role&quot; &quot;fargate_profile&quot; {
  name = &quot;eks-fargate-profile&quot;

  assume_role_policy = jsonencode({
    Statement = [{
      Action = &quot;sts:AssumeRole&quot;
      Effect = &quot;Allow&quot;
      Principal = {
        Service = &quot;eks-fargate-pods.amazonaws.com&quot;
      }
    }]
    Version = &quot;2012-10-17&quot;
  })
}

resource &quot;aws_iam_role_policy_attachment&quot; &quot;AmazonEKSFargatePodExecutionRolePolicy&quot; {
  policy_arn = &quot;arn:aws:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy&quot;
  role       = aws_iam_role.fargate_profile.name
}
</code></pre>

Joey Yi Zhao
<p>It is possible that you need to patch the CoreDNS deployment. By default it is configured to only run on worker nodes and not on Fargate. See the &quot;(Optional) Update CoreDNS&quot; section in this <a href="https://docs.aws.amazon.com/eks/latest/userguide/fargate-getting-started.html" rel="nofollow noreferrer">doc page</a></p>
