<p>I'm trying to deploy a simple tutorial app to a new fargate based kubernetes cluster.</p>
<p>Unfortunately I'm stuck on ImagePullBackOff for the coredns pod:</p>
<pre><code>Events:
  Type     Reason           Age                  From               Message
  ----     ------           ----                 ----               -------
  Warning  LoggingDisabled  5m51s                fargate-scheduler  Disabled logging because aws-logging configmap was not found. configmap &quot;aws-logging&quot; not found
  Normal   Scheduled        4m11s                fargate-scheduler  Successfully assigned kube-system/coredns-86cb968586-mcdpj to fargate-ip-172-31-55-205.eu-central-1.compute.internal
  Warning  Failed           100s                 kubelet            Failed to pull image &quot;602401143452.dkr.ecr.eu-central-1.amazonaws.com/eks/coredns:v1.8.0-eksbuild.1&quot;: rpc error: code = Unknown desc = failed to pull and unpack image &quot;602

401143452.dkr.ecr.eu-central-1.amazonaws.com/eks/coredns:v1.8.0-eksbuild.1&quot;: failed to resolve reference &quot;602401143452.dkr.ecr.eu-central-1.amazonaws.com/eks/coredns:v1.8.0-eksbuild.1&quot;: failed to do request: Head &quot;https://602401143452.dkr.

ecr.eu-central-1.amazonaws.com/v2/eks/coredns/manifests/v1.8.0-eksbuild.1&quot;: dial tcp 3.122.9.124:443: i/o timeout
  Warning  Failed           100s                 kubelet            Error: ErrImagePull
  Normal   BackOff          99s                  kubelet            Back-off pulling image &quot;602401143452.dkr.ecr.eu-central-1.amazonaws.com/eks/coredns:v1.8.0-eksbuild.1&quot;
  Warning  Failed           99s                  kubelet            Error: ImagePullBackOff
  Normal   Pulling          87s (x2 over 4m10s)  kubelet            Pulling image &quot;602401143452.dkr.ecr.eu-central-1.amazonaws.com/eks/coredns:v1.8.0-eksbuild.1&quot;
</code></pre>
<p>While googling I found <a href="https://aws.amazon.com/premiumsupport/knowledge-center/eks-ecr-troubleshooting/" rel="nofollow noreferrer">https://aws.amazon.com/premiumsupport/knowledge-center/eks-ecr-troubleshooting/</a>
It contains a following list:</p>
<pre><code>To resolve this error, confirm the following:

 - The subnet for your worker node has a route to the internet. Check the route table associated with your subnet.
 - The security group associated with your worker node allows outbound internet traffic.
 - The ingress and egress rule for your network access control lists (ACLs) allows access to the internet.
</code></pre>
<p>Since I've created both my private subnets as well as their NAT Gateways manually I tried to locate an issue here but couldn't find anything. They as well as security groups and ACLs look fine to me.</p>
<p><a href="https://i.stack.imgur.com/jPHGO.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/jPHGO.png" alt="enter image description here" /></a></p>
<p>I even added the AmazonEC2ContainerRegistryReadOnly to my EKS role but after issuing command <code>kubectl rollout restart -n kube-system deployment coredns</code> the result is unfortunately the same: <em><strong>ImagePullBackOff</strong></em></p>
<p>Unfortunately I've runned out of ideas and I'm stuck. Any help that would help me troubleshoot this would be greatly appreciated. ~Thanks</p>
<hr />
<p>edit&gt;</p>
<p>After creating new cluster via *<strong>eksctl</strong> as @mreferre suggested in his comment I get RBAC error with link: <a href="https://docs.aws.amazon.com/eks/latest/userguide/troubleshooting_iam.html#security-iam-troubleshoot-cannot-view-nodes-or-workloads" rel="nofollow noreferrer">https://docs.aws.amazon.com/eks/latest/userguide/troubleshooting_iam.html#security-iam-troubleshoot-cannot-view-nodes-or-workloads</a><br />
<a href="https://i.stack.imgur.com/ZuHBu.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/ZuHBu.png" alt="RBAC error" /></a></p>
<p>I'm not sure what is going on since I already have
<a href="https://i.stack.imgur.com/S3shu.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/S3shu.png" alt="Full policy on my IAM user" /></a></p>
<hr />
<p>edit&gt;&gt;</p>
<p>The cluster created via AWS Console ( web interface ) doesn't have the <strong>configmap aws-auth</strong> I've retrieved the configmap below using command <code>kubectl edit configmap aws-auth -n kube-system</code></p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
data:
  mapRoles: |
    - groups:
      - system:bootstrappers
      - system:nodes
      - system:node-proxier
      rolearn: arn:aws:iam::370179080679:role/eksctl-tutorial-cluster-FargatePodExecutionRole-1J605HWNTGS2Q
      username: system:node:{{SessionName}}
kind: ConfigMap
metadata:
  creationTimestamp: &quot;2021-04-08T18:42:59Z&quot;
  name: aws-auth
  namespace: kube-system
  resourceVersion: &quot;918&quot;
  selfLink: /api/v1/namespaces/kube-system/configmaps/aws-auth
  uid: d9a21964-a8bf-49e9-800f-650320b7444e
</code></pre>

sebastian_t
<p>Creating an answer to sum up the discussion in the comment that deemed to be acceptable. The most common (and arguably easier) way to setup an EKS cluster with Fargate support is to use <a href="https://docs.aws.amazon.com/eks/latest/userguide/getting-started-eksctl.html" rel="nofollow noreferrer">EKSCTL</a> and setup the cluster using <code>eksctl create cluster --fargate</code>. This will build all the plumbing for you and you will get a cluster with no EC2 instances nor managed node groups with the two <code>CoreDNS</code> pods deployed on two Fargate instances. Note that when you deploy EKSCTL via the command line you may end up using different roles/users between your CLI and console. This may result in access denied issues. Best course of action would be to use a non-root user to login into the AWS console and use <a href="https://aws.amazon.com/cloudshell/" rel="nofollow noreferrer">CloudShell</a> to deploy with EKSCTL (CloudShell will inherit the same console user identity). {More info in the comments}</p>
