title: Error deploying EKS node-group with terraform
body: <p>I have a problem <strong>deploying with Terraform a node group in an EKS cluster</strong>. The error looks like one plugin is having problems but I do not know how to resolve it.</p>
  <p>If I see the EC2 in the AWS console (web), I can see the instance of the cluster  but I have this error in the cluster.</p>
  <p>The error was shown in  my <strong>pipeline</strong>:</p>
  <blockquote>
  <p>Error: waiting for EKS Node Group (UNIR-API-REST-CLUSTER-DEV:node_sping_boot) creation: NodeCreationFailure: Instances failed to join the kubernetes cluster. Resource IDs: [i-05ed58f8101240dc8]<br />
  on EKS.tf line 17, in resource &quot;aws_eks_node_group&quot; &quot;nodes&quot;:<br />
  17: resource &quot;aws_eks_node_group&quot; &quot;nodes&quot;<br />
  2020-06-01T00:03:50.576Z [DEBUG] plugin: plugin process exited: path=/home/ubuntu/.jenkins/workspace/shop_infraestucture_generator_pipline/shop-proyect-dev/.terraform/plugins/linux_amd64/terraform-provider-aws_v2.64.0_x4 pid=13475<br />
  2020-06-01T00:03:50.576Z [DEBUG] plugin: plugin exited</p>
  </blockquote>
  <p>And the error is printed in <strong>AWS console</strong>:</p>
  <p><a href="https://i.stack.imgur.com/Q7wUm.png" rel="nofollow noreferrer">Link</a></p>
  <p>This is the code in  Terraform  I use to create my project:</p>
  <p><strong>EKS.tf</strong> for creating the cluster and de nodes</p>
  <pre><code>resource &quot;aws_eks_cluster&quot; &quot;CLUSTER&quot; {
    name     = &quot;UNIR-API-REST-CLUSTER-${var.SUFFIX}&quot;
    role_arn = &quot;${aws_iam_role.eks_cluster_role.arn}&quot;
    vpc_config {
      subnet_ids = [
        &quot;${aws_subnet.unir_subnet_cluster_1.id}&quot;,&quot;${aws_subnet.unir_subnet_cluster_2.id}&quot;
      ]
    }
    depends_on = [
      &quot;aws_iam_role_policy_attachment.AmazonEKSWorkerNodePolicy&quot;,
      &quot;aws_iam_role_policy_attachment.AmazonEKS_CNI_Policy&quot;,
      &quot;aws_iam_role_policy_attachment.AmazonEC2ContainerRegistryReadOnly&quot;,
    ]
  }
  
  
  resource &quot;aws_eks_node_group&quot; &quot;nodes&quot; {
    cluster_name    = &quot;${aws_eks_cluster.CLUSTER.name}&quot;
    node_group_name = &quot;node_sping_boot&quot;
    node_role_arn   = &quot;${aws_iam_role.eks_nodes_role.arn}&quot;
    subnet_ids      = [
        &quot;${aws_subnet.unir_subnet_cluster_1.id}&quot;,&quot;${aws_subnet.unir_subnet_cluster_2.id}&quot;
    ]
    scaling_config {
      desired_size = 1
      max_size     = 5
      min_size     = 1
    }
  # instance_types is mediumt3 by default
  # Ensure that IAM Role permissions are created before and deleted after EKS Node Group handling.
  # Otherwise, EKS will not be able to properly delete EC2 Instances and Elastic Network Interfaces.
    depends_on = [
      &quot;aws_iam_role_policy_attachment.AmazonEKSWorkerNodePolicy&quot;,
      &quot;aws_iam_role_policy_attachment.AmazonEKS_CNI_Policy&quot;,
      &quot;aws_iam_role_policy_attachment.AmazonEC2ContainerRegistryReadOnly&quot;,
    ]
  }
  
  output &quot;eks_cluster_endpoint&quot; {
    value = &quot;${aws_eks_cluster.CLUSTER.endpoint}&quot;
  }
  
  output &quot;eks_cluster_certificat_authority&quot; {
      value = &quot;${aws_eks_cluster.CLUSTER.certificate_authority}&quot;
  }
  </code></pre>
  <p><strong>securityAndGroups.tf</strong></p>
  <pre><code>resource &quot;aws_iam_role&quot; &quot;eks_cluster_role&quot; {
    name = &quot;eks-cluster-${var.SUFFIX}&quot;
  
    assume_role_policy = &lt;&lt;POLICY
  {
    &quot;Version&quot;: &quot;2012-10-17&quot;,
    &quot;Statement&quot;: [
      {
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Principal&quot;: {
          &quot;Service&quot;: &quot;eks.amazonaws.com&quot;
        },
        &quot;Action&quot;: &quot;sts:AssumeRole&quot;
      }
    ]
  }
  POLICY
  }
  
  
  resource &quot;aws_iam_role&quot; &quot;eks_nodes_role&quot; {
    name = &quot;eks-node-${var.SUFFIX}&quot;
  
    assume_role_policy = &lt;&lt;POLICY
  {
    &quot;Version&quot;: &quot;2012-10-17&quot;,
    &quot;Statement&quot;: [
      {
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Principal&quot;: {
          &quot;Service&quot;: &quot;ec2.amazonaws.com&quot;
        },
        &quot;Action&quot;: &quot;sts:AssumeRole&quot;
      }
    ]
  }
  POLICY
  }
  
  
  resource &quot;aws_iam_role_policy_attachment&quot; &quot;AmazonEKSClusterPolicy&quot; {
    policy_arn = &quot;arn:aws:iam::aws:policy/AmazonEKSClusterPolicy&quot;
    role       = &quot;${aws_iam_role.eks_cluster_role.name}&quot;
  }
  
  resource &quot;aws_iam_role_policy_attachment&quot; &quot;AmazonEKSServicePolicy&quot; {
    policy_arn = &quot;arn:aws:iam::aws:policy/AmazonEKSServicePolicy&quot;
    role       = &quot;${aws_iam_role.eks_cluster_role.name}&quot;
  }
  
  resource &quot;aws_iam_role_policy_attachment&quot; &quot;AmazonEKSWorkerNodePolicy&quot; {
    policy_arn = &quot;arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy&quot;
    role       = &quot;${aws_iam_role.eks_nodes_role.name}&quot;
  }
  
  resource &quot;aws_iam_role_policy_attachment&quot; &quot;AmazonEKS_CNI_Policy&quot; {
    policy_arn = &quot;arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy&quot;
    role       = &quot;${aws_iam_role.eks_nodes_role.name}&quot;
  }
  
  resource &quot;aws_iam_role_policy_attachment&quot; &quot;AmazonEC2ContainerRegistryReadOnly&quot; {
    policy_arn = &quot;arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly&quot;
    role       = &quot;${aws_iam_role.eks_nodes_role.name}&quot;
  }
  </code></pre>
  <p><strong>VPCAndRouting.tf</strong> to create my routing, VPC, and Subnets</p>
  <pre><code>resource &quot;aws_vpc&quot; &quot;unir_shop_vpc_dev&quot; {
    cidr_block = &quot;${var.NET_CIDR_BLOCK}&quot;
    enable_dns_hostnames = true
    enable_dns_support = true
    tags = {
      Name = &quot;UNIR-VPC-SHOP-${var.SUFFIX}&quot;
      Environment = &quot;${var.SUFFIX}&quot;
    }
  }
  resource &quot;aws_route_table&quot; &quot;route&quot; {
    vpc_id = &quot;${aws_vpc.unir_shop_vpc_dev.id}&quot;
    route {
      cidr_block = &quot;0.0.0.0/0&quot;
      gateway_id = &quot;${aws_internet_gateway.unir_gat_shop_dev.id}&quot;
    }
    tags = {
      Name = &quot;UNIR-RoutePublic-${var.SUFFIX}&quot;
      Environment = &quot;${var.SUFFIX}&quot;
    }
  }
  
  data &quot;aws_availability_zones&quot; &quot;available&quot; {
    state = &quot;available&quot;
  }
  resource &quot;aws_subnet&quot; &quot;unir_subnet_aplications&quot; {
    vpc_id = &quot;${aws_vpc.unir_shop_vpc_dev.id}&quot;
    cidr_block = &quot;${var.SUBNET_CIDR_APLICATIONS}&quot;
    availability_zone = &quot;${var.ZONE_SUB}&quot;
    depends_on = [&quot;aws_internet_gateway.unir_gat_shop_dev&quot;]
    map_public_ip_on_launch = true
    tags = {
      Name = &quot;UNIR-SUBNET-APLICATIONS-${var.SUFFIX}&quot;
      Environment = &quot;${var.SUFFIX}&quot;
    }
  }
  
  resource &quot;aws_subnet&quot; &quot;unir_subnet_cluster_1&quot; {
    vpc_id = &quot;${aws_vpc.unir_shop_vpc_dev.id}&quot;
    cidr_block = &quot;${var.SUBNET_CIDR_CLUSTER_1}&quot;
    map_public_ip_on_launch = true
    availability_zone = &quot;${var.ZONE_SUB_CLUSTER_2}&quot;
    tags = {
      &quot;kubernetes.io/cluster/UNIR-API-REST-CLUSTER-${var.SUFFIX}&quot; = &quot;shared&quot;
    }
  }
  
  resource &quot;aws_subnet&quot; &quot;unir_subnet_cluster_2&quot; {
    vpc_id = &quot;${aws_vpc.unir_shop_vpc_dev.id}&quot;
    cidr_block = &quot;${var.SUBNET_CIDR_CLUSTER_2}&quot;
    availability_zone = &quot;${var.ZONE_SUB_CLUSTER_1}&quot;
    map_public_ip_on_launch = true
    tags = {
      &quot;kubernetes.io/cluster/UNIR-API-REST-CLUSTER-${var.SUFFIX}&quot; = &quot;shared&quot;
    }
  
  }
  
  resource &quot;aws_internet_gateway&quot; &quot;unir_gat_shop_dev&quot; {
    vpc_id = &quot;${aws_vpc.unir_shop_vpc_dev.id}&quot;
    tags = {
      Environment = &quot;${var.SUFFIX}&quot;
      Name = &quot;UNIR-publicGateway-${var.SUFFIX}&quot;
    }
  }
  </code></pre>
  <p>My variables:</p>
  <pre><code>SUFFIX=&quot;DEV&quot;
  ZONE=&quot;eu-west-1&quot;
  TERRAFORM_USER_ID=
  TERRAFORM_USER_PASS=
  ZONE_SUB=&quot;eu-west-1b&quot;
  ZONE_SUB_CLUSTER_1=&quot;eu-west-1a&quot;
  ZONE_SUB_CLUSTER_2=&quot;eu-west-1c&quot;
  NET_CIDR_BLOCK=&quot;172.15.0.0/24&quot;
  SUBNET_CIDR_APLICATIONS=&quot;172.15.0.0/27&quot;
  SUBNET_CIDR_CLUSTER_1=&quot;172.15.0.32/27&quot;
  SUBNET_CIDR_CLUSTER_2=&quot;172.15.0.64/27&quot;
  SUBNET_CIDR_CLUSTER_3=&quot;172.15.0.128/27&quot;
  SUBNET_CIDR_CLUSTER_4=&quot;172.15.0.160/27&quot;
  SUBNET_CIDR_CLUSTER_5=&quot;172.15.0.192/27&quot;
  SUBNET_CIDR_CLUSTER_6=&quot;172.15.0.224/27&quot;
  MONGO_SSH_KEY=
  KIBANA_SSH_KEY=
  CLUSTER_SSH_KEY=
  </code></pre>
  <p>Will be more logs necesary?</p>