Bottlerocket instance fails to start in eu-central-1

[cyrus-mc]

I am attempting to build out a new EKS cluster in eu-central-1. When starting Bottlerocket nodes they are failing with

[  304.843157] sundog[1209]: Setting generator 'pluto private-dns-name' failed with exit code 1 - stderr: Timed out retrieving private DNS name from EC2: deadline has elapsed
[FAILED] Failed to start User-specified setting generators.

See 'systemctl status sundog.service' for details.

[DEPEND] Dependency failed for Applies settings to create config files.

[DEPEND] Dependency failed for Bottlerocket initial configuration complete.

[DEPEND] Dependency failed for Isolates configured.target.

[DEPEND] Dependency failed for Send signal to CloudFormation Stack.

[DEPEND] Dependency failed for Sets the hostname.

From what I can tell sundog pulls metadata from the metadata service, so it appears there is some sort of communication issue with that. VPC and cluster are provisioned via IaC which was used in us-east-1 so the setup should be the same. VPC is configured with necessary egress rules, security groups all egress, etc, etc. I spun up a Amazon Linux AMI and from within that instance I can successfully hit the metadata service.

At this point, given the instance won't start I am not sure what additional troubleshooting I can do. Any pointers would be appreciated.

[yeazelm]

Can you confirm the Instance Role you provided the instance has EC2 DescribeInstances permissions and that the EC2 API is available to the instance? This error usually shows up when the instance can't use the EC2 API to get its private DNS name for connecting to the cluster.

[cyrus-mc]

Screenshot shows the IAM role attached to the node. It has the standard IAM policies required for an EKS node attached.

[cyrus-mc]

Good point on the EC2 API. I was focused on the metadata service. It appears I have an egress to the internet issue that is the culprit here. Much appreciated.

[cyrus-mc]

User error. I was missing a route in the transit gatewa.