EKS worknode on k8s version: 1.27 cannot join cluster conrtoller.

Question

Hello all,

I try to join the worker node into the cluster controller by assign an IAM permission for the worker node with my user account such as below.
`
 "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"    
 "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"    
 "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"    
 "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"   
`

For other addons supports into cluster show status like below.

```
Amazon EBS CSI Driver [ Degraded ]
Amazon VPC CNI [Active]
```

I access into worker node show an error on ` /var/log/messages` as below.

> csi_plugin.go:913] Failed to contact API server when waiting for CSINode publishing: csinodes.storage.k8s.io "ip-10-0-12-152.ap-southeast-1.compute.internal" is forbidden: User "system:node:ip-10-0-12-152.ap-southeast-1.compute.internal" cannot get resource "csinodes" in API group "storage.k8s.io" at the cluster scope

Answer

Have you looked at the Cluster Node IAM roles that are required? Here's the [documentation on IAM Roles ](https://docs.aws.amazon.com/eks/latest/userguide/create-node-role.html)for Nodes. Make sure it has the three listed.

EKS worknode on k8s version: 1.27 cannot join cluster conrtoller.

Relevant content