When adding a new unmanaged node group, aws-node imagePullBackOff occurs

0

Hi I am trying to add a group of unmanaged nodes to an existing Cluster.

When I add it, the aws-network-policy-agent Image fails to pull with the following error.

Warning Failed 2m50s kubelet Failed to pull image "602401143452.dkr.ecr.eu-central-1.amazonaws.com/amazon/aws-network-policy-agent:v1.0.1-eksbuild.1 ": rpc error: code = DeadlineExceeded desc = failed to pull and unpack image "602401143452.dkr.ecr.eu-central-1.amazonaws.com/amazon/aws-network-policy-agent:v1.0.1-eksbuild.1": Failed to resolve reference "602401143452.dkr.ecr.eu-central-1.amazonaws.com/amazon/aws-network-policy-agent:v1.0.1-eksbuild.1": failed to do request: Head "https://602401143452.dkr.ecr.eu-central-1.amazonaws.com/v2/amazon/aws-network-policy-agent/manifests/v1.0.1-eksbuild.1": dial tcp 172.16.0.174:443: i/o timeout

First of all, I had a problem before. I was using vpc-cni v1.13.4-eksbuild.1, and at the time I was not getting the amazon-k8s-cni-init:v1.13.4-eksbuild.1 image pulled. So I upgraded to the latest version of vpc-cni, v1.14.0-eksbuild.3, and the amazon-k8s-cni-init:v1.14.0-eksbuild.3 image installed fine. ( After adding Node, I checked the ctr image list, and the v1.14.0-eksbuild.3 version was already installed )

However, the image for another container in the aws-node pod, aws-network-policy-agent:v1.0.1-eksbuild.1, does not pull. And the aws-network-policy-agent:v1.0.1-eksbuild.1 image is not there when I look at the ctr images list in Node.

A search suggests that there is a v1.0.2, but I don't know how to update to that version. I know that v1.0.2 is used in v1.14.1 version of vpc-cni, but when I look up eksctl, the latest version is v1.14.0-eksbuild.3.

How am I supposed to resolve this? Please excuse my lack of English, I used a translator :)

Current environment

  • Cluster version : 1.25
  • vpc-cni : v1.14.0-eksbuild.3
  • Instance type of node Group to add : 6a.2xlarge
sbyun
asked 8 months ago173 views
1 Answer
0

Check the availability of the image and verify that the aws-network-policy-agent:v1.0.1-eksbuild.1 image is present in the specified Amazon Elastic Container Registry (ECR) repository. Ensure that the image tag is accurate and exists in the repository. Additionally, since the error mentioned an I/O timeout, confirm that the nodes in your cluster have outbound internet access to pull container images. Check for any network restrictions or firewalls that may be preventing access to the ECR registry. After gathering this information, consider reaching out to AWS Support for more targeted assistance with your specific environment and versions

profile picture
EXPERT
answered 5 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions