Amazon-eks-ami: SSH to EKS Worker Nodes

[itskarthikholla]

Is is possible to do SSH to Worker nodes in EKS?

I tried to login with root/admin/ec2-user no luck. I created worker nodes using EKS guide with

US East (N. Virginia) (us-east-1) | ami-0c24db5df6badc35a

Can you also tell me what is the username one should use for ssh ?

[mattclegg]

Is is possible to do SSH to Worker nodes in EKS?

Yes

Can you also tell me what is the username one should use for ssh ?

ec2-user

You will need to assign a key pair tothe EC2 instance.

[itskarthikholla]

I am not able to login with ec2-user . can anyone confirm ec2-user is working with aws-eks-ami for worker nodes ?

[max-rocket-internet]

Yes it works. You need to use the key that is specified in the launch configuration. If there is no key in the LC then you will not be able to login via SSH at all.

[itskarthikholla]

@max-rocket-internet Thanks for the info. Which AMI version are you using ? I tried in US East (N. Virginia) (us-east-1) | ami-0c24db5df6badc35a

[mattclegg]

I honestly don't think the problem is with the AMI but more likely an issue with your Lauch or Network configuration.

It might be easier if you post the error you are getting? Or a brief description of your network i.e. are you trying to connect to a public IP?

[micahhausler]

I can confirm that the user is ec2-user. In order to SSH into an instance, you'll need:

• To launch your instance in a public subnet. The default EKS CloudFormation templates use a public subnet.
• To specify an SSH key in the launch configuration
• To open a security group rule on the node security group allowing your IP to SSH into the node.
• Use the private key corresponding to the SSH public key you're using on the instance.

Can you confirm you've done all of the above?

[micahhausler]

Closing after 7 days of no reply

[dragonknight88]

I can confirm that the user is ec2-user. In order to SSH into an instance, you'll need:

• To launch your instance in a public subnet. The default EKS CloudFormation templates use a public subnet.
• To specify an SSH key in the launch configuration
• To open a security group rule on the node security group allowing your IP to SSH into the node.
• Use the private key corresponding to the SSH public key you're using on the instance.

Can you confirm you've done all of the above?

What if the worker node is on the private instance? Does worker node need the public ip associated regardless on public/private subnet?

[JessieAMorris]

You'll want to create a bastion host that is in a public subnet that can route to your private subnets. So you would SSH into the bastion host and then SSH from the bastion host to an EKS node.

[whereisaaron]

For private nodes youe need a bastion as @JessieAMorris suggests, or VPN or internally routed access to the EKS private subnets.

There is a also the alternative option of installing the the AWS SSM agent in workers, which works a lot like kubectl exec, it uses IAM credentials and tunnels access via AWS API to execute commends and run shells on instances. See #127.

[0lmi]

It's also reasonable to check if "Key pair name" is set in related Launch template. If the cluster was created by eksctl (checked with 0.19.0-rc.1 version) without --ssh-access and --ssh-public-key options then it can be the reason of failing to ssh to nodes.