A DevOps engineer successfully creates an Amazon Elastic Kubernetes Service (Amazon EKS) cluster that includes managed node groups. When the DevOps engineer tries to add node groups to the cluster, th

Question

Options

• AEnsure that the EKS cluster's VPC subnets do not overlap with the 172.17.0.0/16 CIDR range.
• BUse kubectl to update the kubeconfig file to use the credentials that created the cluster.
• CRun the AWSSupport-TroubleshootEKSWorkerNode runbook.
• DCreate an AWS Identity and Access Management (IAM) OpenID Connect (OIDC) provider for the

• A
  3% (1)
• B
  5% (2)
• C
  81% (30)
• D
  11% (4)

Explanation

Explanation

Running the AWSSupport-TroubleshootEKSWorkerNode runbook (Option C) is the correct first troubleshooting step because it is an AWS Systems Manager automation document specifically designed to diagnose exactly this type of error - worker nodes failing to join an EKS cluster. It systematically checks common root causes such as IAM role permissions, security group configurations, and network connectivity, saving engineers significant manual investigation time.

Why the distractors are wrong:

• Option A (VPC subnet CIDR overlap with 172.17.0.0/16) relates to pod networking conflicts with Docker's default bridge network, which is a separate issue unrelated to nodes failing to join the cluster.
• Option B (updating kubeconfig) addresses authentication issues for the engineer accessing the cluster via kubectl, not a problem with EC2 worker nodes registering themselves with the control plane.
• Option D (creating an OIDC provider) is needed for service accounts using IAM Roles for Service Accounts (IRSA), which is unrelated to node group joining failures.

Memory Tip

Think of it this way: when AWS gives you a specific error about a specific AWS service, there's often a dedicated AWS runbook for it - always look for the purpose-built automation tool before manually troubleshooting. "AWS made the problem, AWS made the fix."

No community discussion yet for this question.