I created an EKS cluster following https://github.com/pulumi/pulumi-eks/blob/master/nodejs/eks/examples/nodegroup/index.ts and got:

error: unable to recognize "/tmp/tmp-6861Tmql3TRQ88g0.tmp": Get <https://2B657DC438F30EA7CB5A8D2297BABFA3.sk1.us-west-2.eks.amazonaws.com/api?timeout=32s>: dial tcp 52.36.238.179:443: i/o timeout
 
    error: update failed
 
  pulumi-nodejs:dynamic:Resource (k8s-cluster-dev-vpc-cni):
    error: Plan apply failed: Command failed: kubectl apply -f /tmp/tmp-6861Tmql3TRQ88g0.tmp
    error: unable to recognize "/tmp/tmp-6861Tmql3TRQ88g0.tmp": Get <https://2B657DC438F30EA7CB5A8D2297BABFA3.sk1.us-west-2.eks.amazonaws.com/api?timeout=32s>: dial tcp 52.36.238.179:443: i/o timeout
 
  kubernetes:core:ConfigMap (k8s-cluster-dev-nodeAccess):
    error: Plan apply failed: Get <https://2B657DC438F30EA7CB5A8D2297BABFA3.sk1.us-west-2.eks.amazonaws.com/api?timeout=32s>: dial tcp 52.89.83.215:443: i/o timeout

Here's what I did:

const eksRole1 = iam.createRole(`eks-role`);
const eksInstanceProfile = new aws.iam.InstanceProfile("eks-instance-profile", {role: eksRole1});

const nodePolicy = new aws.iam.Policy("eks-node-policy", {
    namePrefix: `eks-node-${env}-`,
    policy: JSON.stringify({
        "Version": "2012-10-17",
        "Statement": [{
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt",
                "pricing:*"
            ],
            "Resource": "*"
        }]
    })
});

new aws.iam.RolePolicyAttachment("eks-node-role-assignment", {
    policyArn: nodePolicy.arn,
    role: eksRole1
});


eksCluster = new eks.Cluster(`k8s-cluster-${env}`, {
    vpcId: vpc.id,
    subnetIds: vpc.publicSubnetIds,
    deployDashboard: false,
    skipDefaultNodeGroup: true,
    instanceRoles: [eksRole1]
});

eksCluster.createNodeGroup(`k8s-${env}-ng`, {
    instanceType: "t2.medium",
    desiredCapacity: 2,
    minSize: 1,
    maxSize: 2,
    instanceProfile: eksInstanceProfile,
});

Guessing the example code is missing something necessary.

It sometimes cannot connect to api-server in the first run, I have seen this sometimes as well, generally the second run succeeds

Weird. Is there an issue for this?

Yes - see https://github.com/pulumi/pulumi-eks/issues/65. cc @creamy-potato-29402