使用Amazon EKS部署AWS Enclaves时节点创建超时求助

按照AWS Enclaves + EKS教程操作，执行eksctl create cluster -f cluster_nitro_config.yaml时，集群主体创建完成，但托管节点组卡在CloudFormation栈等待阶段，最终报错：

2023-03-18 23:38:53 [!]  1 error(s) occurred and cluster hasn't been created properly, you may wish to check CloudFormation console
2023-03-18 23:38:53 [ℹ]  to cleanup resources, run 'eksctl delete cluster --region=eu-central-1 --name=ne-cluster'
2023-03-18 23:38:53 [✖]  exceeded max wait time for StackCreateComplete waiter
Error: failed to create cluster "ne-cluster"

CloudFormation控制台返回核心错误：

Resource handler returned message: "[Issue(Code=NodeCreationFailure, Message=Instances failed to join the kubernetes cluster, ResourceIds=[i-00bf11cb814138f64])] (Service: null, Status Code: 0, Request ID: null)" (RequestToken: 5772ff82-596e-3e57-eb8f-c7ae277f0df2, HandlerErrorCode: GeneralServiceException)

使用的配置 #

1. 启动模板配置（lt_nitro_config.json） #

{
    "ImageId": "ami-0499632f10efc5a62",
    "InstanceType": "m5.xlarge",
    "TagSpecifications": [{
        "ResourceType": "instance",
        "Tags": [{
            "Key":"Name",
            "Value":"webserver"
        }]
    }],
    "UserData":"TUlNRS1WZXJzaW9uOiAxLjAKQ29udGVudC1UeXBlOiBtdWx0aXBhcnQvbWl4ZWQ7IGJvdW5kYXJ5PSI9PU1ZQk9VTkRBUlk9PSIKCi0tPT1NWUJPVU5EQVJZPT0KQ29udGVudC1UeXBlOiB0ZXh0L3gtc2hlbGxzY3JpcHQ7IGNoYXJzZXQ9InVzLWFzY2lpIgoKIyEvYmluL2Jhc2ggLWUKcmVhZG9ubHkgTkVfQUxMT0NBVE9SX1NQRUNfUEFUSD0iL2V0Yy9uaXRyb19lbmNsYXZlcy9hbGxvY2F0b3IueWFtbCIKIyBOb2RlIHJlc291cmNlcyB0aGF0IHdpbGwgYmUgYWxsb2NhdGVkIGZvciBOaXRybyBFbmNsYXZlcwpyZWFkb25seSBDUFVfQ09VTlQ9MgpyZWFkb25seSBNRU1PUllfTUlCPTc2OAoKIyBUaGlzIHN0ZXAgYmVsb3cgaXMgbmVlZGVkIHRvIGluc3RhbGwgbml0cm8tZW5jbGF2ZXMtYWxsb2NhdG9yIHNlcnZpY2UuCmFtYXpvbi1saW51eC1leHRyYXMgaW5zdGFsbCBhd3Mtbml0cm8tZW5jbGF2ZXMtY2xpIC15CgojIFVwZGF0ZSBlbmNsYXZlJ3MgYWxsb2NhdG9yIHNwZWNpZmljYXRpb246IGFsbG9jYXRvci55YW1sCnNlZCAtaSAicy9jcHVfY291bnQ6LiovY3B1X2NvdW50OiAkQ1BVX0NPVU5UL2ciICRORV9BTExPQ0FUT1JfU1BFQ19QQVRICnNlZCAtaSAicy9tZW1vcnlfbWliOi4qL21lbW9yeV9taWI6ICRNRU1PUllfTUlCL2ciICRORV9BTExPQ0FUT1JfU1BFQ19QQVRICiMgUmVzdGFydCB0aGUgbml0cm8tZW5jbGF2ZXMtYWxsb2NhdG9yIHNlcnZpY2UgdG8gdGFrZSBjaGFuZ2VzIGVmZmVjdC4Kc3lzdGVtY3RsIHJlc3RhcnQgbml0cm8tZW5jbGF2ZXMtYWxsb2NhdG9yLnNlcnZpY2UKZWNobyAiTkUgdXNlciBkYXRhIHNjcmlwdCBoYXMgZmluaXNoZWQgc3VjY2Vzc2Z1bGx5LiIKLS09PU1ZQk9VTkRBUlk9PQ=="
 }

创建启动模板的命令：

aws ec2 create-launch-template \
    --launch-template-name TemplateForEnclaveServer \
    --version-description WebVersion1 \
    --tag-specifications 'ResourceType=launch-template,Tags=[{Key=purpose,Value=production}]' \
    --launch-template-data file://lt_nitro_config.json

2. EKS集群配置（cluster_nitro_config.yaml） #

apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig

metadata:
  name: ne-cluster
  region: eu-central-1

managedNodeGroups:
  - name: managed-ng-1
    launchTemplate:
      id: lt-04c4d2c58e20db555
      version: "1" # optional (uses the default launch template version if unspecified)
    minSize: 1
    desiredCapacity: 1

排查与解决建议 #

1. 检查UserData的完整性 #

你的UserData是Base64编码格式，先解码查看具体内容：

echo "TUlNRS1WZXJzaW9uOiAxLjAKQ29udGVudC1UeXBlOiBtdWx0aXBhcnQvbWl4ZWQ7IGJvdW5kYXJ5PSI9PU1ZQk9VTkRBUlk9PSIKCi0tPT1NWUJPVU5EQVJZPT0KQ29udGVudC1UeXBlOiB0ZXh0L3gtc2hlbGxzY3JpcHQ7IGNoYXJzZXQ9InVzLWFzY2lpIgoKIyEvYmluL2Jhc2ggLWUKcmVhZG9ubHkgTkVfQUxMT0NBVE9SX1NQRUNfUEFUSD0iL2V0Yy9uaXRyb19lbmNsYXZlcy9hbGxvY2F0b3IueWFtbCIKIyBOb2RlIHJlc291cmNlcyB0aGF0IHdpbGwgYmUgYWxsb2NhdGVkIGZvciBOaXRybyBFbmNsYXZlcwpyZWFkb25seSBDUFVfQ09VTlQ9MgpyZWFkb25seSBNRU1PUllfTUlCPTc2OAoKIyBUaGlzIHN0ZXAgYmVsb3cgaXMgbmVlZGVkIHRvIGluc3RhbGwgbml0cm8tZW5jbGF2ZXMtYWxsb2NhdG9yIHNlcnZpY2UuCmFtYXpvbi1saW51eC1leHRyYXMgaW5zdGFsbCBhd3Mtbml0cm8tZW5jbGF2ZXMtY2xpIC15CgojIFVwZGF0ZSBlbmNsYXZlJ3MgYWxsb2NhdG9yIHNwZWNpZmljYXRpb246IGFsbG9jYXRvci55YW1sCnNlZCAtaSAicy9jcHVfY291bnQ6LiovY3B1X2NvdW50OiAkQ1BVX0NPVU5UL2ciICRORV9BTExPQ0FUT1JfU1BFQ19QQVRICnNlZCAtaSAicy9tZW1vcnlfbWliOi4qL21lbW9yeV9taWI6ICRNRU1PUllfTUlCL2ciICRORV9BTExPQ0FUT1JfU1BFQ19QQVRICiMgUmVzdGFydCB0aGUgbml0cm8tZW5jbGF2ZXMtYWxsb2NhdG9yIHNlcnZpY2UgdG8gdGFrZSBjaGFuZ2VzIGVmZmVjdC4Kc3lzdGVtY3RsIHJlc3RhcnQgbml0cm8tZW5jbGF2ZXMtYWxsb2NhdG9yLnNlcnZpY2UKZWNobyAiTkUgdXNlciBkYXRhIHNjcmlwdCBoYXMgZmluaXNoZWQgc3VjY2Vzc2Z1bGx5LiIKLS09PU1ZQk9VTkRBUlk9PQ==" | base64 -d

解码后可以看到，当前脚本仅配置了Nitro Enclave相关参数，缺少EKS节点加入集群必须的引导逻辑（比如调用/etc/eks/bootstrap.sh注册节点），这是节点无法加入集群的核心原因。需要在UserData末尾添加EKS节点引导脚本。

2. 确认AMI的兼容性 #

检查使用的ami-0499632f10efc5a62是否为包含EKS节点组件（kubelet、aws-iam-authenticator等）的Nitro Enclave专用AMI。如果是纯Nitro Enclave基础AMI，需要在UserData中添加安装EKS组件的步骤，或者更换为官方的EKS + Nitro Enclave兼容AMI。

3. 验证节点IAM角色权限 #

托管节点组使用的IAM角色必须附加以下托管策略：

• AmazonEKSWorkerNodePolicy
• AmazonEC2ContainerRegistryReadOnly
• AmazonEKS_CNI_Policy
  缺少这些权限会导致节点无法与EKS API通信，无法完成注册。

4. 检查网络连通性 #

• 节点实例所在安全组必须允许出站访问EKS集群API端点的443端口
• 如果集群启用了私有访问，需确认VPC端点配置正常；如果是公网访问，需确认节点有公网出口权限

5. 查看节点系统日志 #

通过EC2控制台找到实例i-00bf11cb814138f64，查看/var/log/cloud-init-output.log和/var/log/messages日志文件，里面会记录节点尝试加入集群时的具体错误（比如组件缺失、权限不足、API访问失败等），是定位问题的关键依据。

内容的提问来源于stack exchange，提问作者Denis