This message was deleted.

Here is the eks creation code:

eks_cluster = eks.Cluster(
    resource_name=cluster_name,
    vpc_id=vpc_id,
    cluster_security_group=cluster_security_group,
    desired_capacity=desired_cluster_size,
    enabled_cluster_log_types=cluster_log_types,
    # Public subnets will be used for load balancers
    public_subnet_ids=public_subnet_ids,
    # Private subnets will be used for worker nodes
    private_subnet_ids=private_subnet_ids,
    # Do not give worker nodes a public IP address
    node_associate_public_ip_address=False,
    # Change configuration values to change any of the following settings
    name=cluster_name,
    skip_default_node_group=True,
    storage_classes={
        storage_class["name"]: storage_class["args"]
        for storage_class in storage_classes
    },
    tags={"Name": f"{name_tag}-eks"},
    version=eks_version,
    # Uncomment the next two lines for private cluster (VPN access required)
    endpoint_private_access=True,
    endpoint_public_access=False
)

yes, but you need to have the ability to contact the API for the kubernetes cluster from where your Pulumi program runs

confirmed, able to access from my laptop:

$ telnet <http://a5f09297feecd3b9c32ca.gr7.ca-central-1.eks.amazonaws.com|a5f09297feecd3b9c32ca.gr7.ca-central-1.eks.amazonaws.com> 443
Trying 10.36.2.223...
Connected to <http://a5f09297feecd3b9c32ca.gr7.ca-central-1.eks.amazonaws.com|a5f09297feecd3b9c32ca.gr7.ca-central-1.eks.amazonaws.com>.
Escape character is '^]'.

can you

kubectl

it?

unable to, same issue

$ KUBECONFIG=~/.kube/eks-works.yaml kubectl get nodes
Unable to connect to the server: net/http: TLS handshake timeout

do you use a http proxy?

none, that i'm aware. I'm on a company vpn connection though

can you show me

cluster_security_group

definition?

sure, from code or aws_console?

hmm 🤔 well, the issue here is that the eks provider uses kubectl to make some changes, and ultimately there’s either a network error or a proxy intercepting. I imagine you’ll get the same response if you try to

curl

the k8s api too. i’d double check your network connectivity (I know the telnet works, so something may be amiss elsewhere)

yeah curl fails too

$ curl -k -v <https://a5f09297feecd3b9c32ca.gr7.ca-central-1.eks.amazonaws.com>
*   Trying 10.36.2.223:443...
* Connected to <http://a5f09297feecd3b9c32ca.gr7.ca-central-1.eks.amazonaws.com|a5f09297feecd3b9c32ca.gr7.ca-central-1.eks.amazonaws.com> (10.36.2.223) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* OpenSSL SSL_connect: Connection reset by peer in connection to <http://a5f09297feecd3b9c32ca.gr7.ca-central-1.eks.amazonaws.com:443|a5f09297feecd3b9c32ca.gr7.ca-central-1.eks.amazonaws.com:443> 
* Closing connection 0
* TLSv1.0 (OUT), TLS header, Unknown (21):
* TLSv1.3 (OUT), TLS alert, decode error (562):
curl: (35) OpenSSL SSL_connect: Connection reset by peer in connection to <http://a5f09297feecd3b9c32ca.gr7.ca-central-1.eks.amazonaws.com:443|a5f09297feecd3b9c32ca.gr7.ca-central-1.eks.amazonaws.com:443>

can you check your security group in the console and make sure that rule applied?

looks like they were:

hmm 🤔

i even opened up ephemeral ports (0-65535), based on a colleagues suggestion, but still the issue persists. I'm using a AWS vpn connection, via a transit gateway.

Check your NACLs as well, especially if TGW is in play.

@cuddly-computer-18851 - thanks, I did, as I'm able to connect locally via telnet.