AWS EKS私有集群中Fargate节点上的CoreDNS Pod无法拉取镜像问题求助

我通过AWS控制台创建了一个私有EKS集群，之后按照官方文档配置了Fargate。完成配置后，在AWS控制台的集群Compute标签下能正常看到Fargate节点，但运行在这些节点上的CoreDNS Pod却一直卡在拉取镜像的环节，状态异常。

先给大家看看我执行kubectl get pods -n kube-system的输出：

$ kubectl get pods -n kube-system

NAME                       READY   STATUS             RESTARTS   AGE
coredns-58488c5db-j8l9f    0/1     Pending            0          2d2h
coredns-7c969d8cd7-7xztr   0/1     ImagePullBackOff   0          3h30m
coredns-7c969d8cd7-mh6z2   0/1     ImagePullBackOff   0          3h30m

另外我还发现一个异常点：kube-system命名空间下的kube-dns没有端点：

kubectl -n kube-system get endpoints kube-dns

NAME       ENDPOINTS   AGE
kube-dns               2d2h

下面是其中一个异常CoreDNS Pod的详细描述：

Containers:
  coredns:
    Container ID:
    Image:         602401143452.dkr.ecr.us-east-1.amazonaws.com/eks/coredns:v1.10.1-eksbuild.2
    Image ID:
    Ports:         53/UDP, 53/TCP, 9153/TCP
    Host Ports:    0/UDP, 0/TCP, 0/TCP
    Args:
      -conf
      /etc/coredns/Corefile
    State:          Waiting
      Reason:       ImagePullBackOff
    Ready:          False
    Restart Count:  0
    Limits:
      memory:  170Mi
    Requests:
      cpu:        100m
      memory:     70Mi
    Liveness:     http-get http://:8080/health delay=60s timeout=5s period=10s #success=1 #failure=5
    Readiness:    http-get http://:8080/health delay=0s timeout=1s period=10s #success=1 #failure=3
    Environment:  <none>
    Mounts:
      /etc/coredns from config-volume (ro)
      /tmp from tmp (rw)
      /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-9mhnd (ro)
Conditions:
  Type              Status
  Initialized       True
  Ready             False
  ContainersReady   False
  PodScheduled      True
Volumes:
  tmp:
    Type:       EmptyDir (a temporary directory that shares a pod's lifetime)
    Medium:
    SizeLimit:  <unset>
  config-volume:
    Type:      ConfigMap (a volume populated by a ConfigMap)
    Name:      coredns
    Optional:  false
  kube-api-access-9mhnd:
    Type:                    Projected (a volume that contains injected data from multiple sources)
    TokenExpirationSeconds:  3607
    ConfigMapName:           kube-root-ca.crt
    ConfigMapOptional:       <nil>
    DownwardAPI:             true
QoS Class:                   Burstable
Node-Selectors:              <none>
Tolerations:                 CriticalAddonsOnly op=Exists
                             node-role.kubernetes.io/master:NoSchedule
                             node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
                             node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
  Type     Reason   Age                    From     Message
  ----     ------   ----                   ----     -------
  Warning  Failed   45m (x5 over 4h40m)    kubelet  Failed to pull image "602401143452.dkr.ecr.us-east-1.amazonaws.com/eks/coredns:v1.10.1-eksbuild.2": failed to pull and unpack image "602401143452.dkr.ecr.us-east-1.amazonaws.com/eks/coredns:v1.10.1-eksbuild.2": failed to resolve reference "602401143452.dkr.ecr.us-east-1.amazonaws.com/eks/coredns:v1.10.1-eksbuild.2": failed to do request: Head "https://602401143452.dkr.ecr.us-east-1.amazonaws.com/v2/eks/coredns/manifests/v1.10.1-eksbuild.2": dial tcp 54.211.105.2:443: i/o timeout
  Warning  Failed   25m (x10 over 4h42m)   kubelet  Failed to pull image "602401143452.dkr.ecr.us-east-1.amazonaws.com/eks/coredns:v1.10.1-eksbuild.2": failed to pull and unpack image "602401143452.dkr.ecr.us-east-1.amazonaws.com/eks/coredns:v1.10.1-eksbuild.2": failed to resolve reference "602401143452.dkr.ecr.us-east-1.amazonaws.com/eks/coredns:v1.10.1-eksbuild.2": failed to do request: Head "https://602401143452.dkr.ecr.us-east-1.amazonaws.com/v2/eks/coredns/manifests/v1.10.1-eksbuild.2": dial tcp 34.198.77.233:443: i/o timeout
  Normal   BackOff  10m (x915 over 4h43m)  kubelet  Back-off pulling image "602401143452.dkr.ecr.us-east-1.amazonaws.com/eks/coredns:v1.10.1-eksbuild.2"
  Warning  Failed   5m9s (x10 over 4h34m)  kubelet  Failed to pull image "602401143452.dkr.ecr.us-east-1.amazonaws.com/eks/coredns:v1.10.1-eksbuild.2": failed to pull and unpack image "602401143452.dkr.ecr.us-east-1.amazonaws.com/eks/coredns:v1.10.1-eksbuild.2": failed to resolve reference "602401143452.dkr.ecr.us-east-1.amazonaws.com/eks/coredns:v1.10.1-eksbuild.2": failed to do request: Head "https://602401143452.dkr.ecr.us-east-1.amazonaws.com/v2/eks/coredns/manifests/v1.10.1-eksbuild.2": dial tcp 52.207.2.251:443: i/o timeout
  Normal   Pulling  5s (x47 over 4h45m)    kubelet  Pulling image "602401143452.dkr.ecr.us-east-1.amazonaws.com/eks/coredns:v1.10.1-eksbuild.2"

从事件日志里能看到是连接ECR仓库超时了，但我实在搞不懂为什么会这样。有没有大佬能帮我分析下问题出在哪？我不想重新创建集群，太折腾了😭

备注：内容来源于stack exchange，提问作者432i