This message was deleted.

For others that might struggle with the same issue. As

publicAccessCidrs

limits the Kubernetes API server endpoint access to the specified CIDR blocks, If those blocks do not allow access from within the VPC, the nodes can’t join the cluster. To allow access to the Kubernetes API from inside VPC you can set

endpointPrivateAccess

to

true

. More details in https://docs.aws.amazon.com/eks/latest/APIReference/API_VpcConfigRequest.html

I found that using

node_associate_public_ip_address=False

prevented the nodes from either being created or joining the cluster, not sure which. That was while allowing the default values for

endpoint_private_access

(default false) and

endpoint_public_access

(default true).