经过几天的调试，以下是问题所在：我允许节点之间的所有流量，但all traffic是TCP，而不是UDP。
这基本上是AWS中的一行：在工作节点SG中，添加入站规则从/到工作节点端口53协议DNS（UDP）。
如果你使用terraform，它应该看起来像这样：

resource "aws_security_group_rule" "eks-node-ingress-cluster-dns" {
  description = "Allow pods DNS"
  from_port                = 53
  protocol                 = 17
  security_group_id        = "${aws_security_group.SG-eks-WorkerNodes.id}"
  source_security_group_id = "${aws_security_group.SG-eks-WorkerNodes.id}"  
  to_port                  = 53
  type                     = "ingress"
}

请注意，此问题可能以多种形式出现（例如，DNS不解析只是一种可能的情况）。terraform-awk-eks模块公开一个terraform输入，以创建允许这些工作组/节点组间通信的必要安全组规则：worker_create_cluster_primary_security_group_rules.本期terraform-awk-eks中的更多信息https://github.com/terraform-aws-modules/terraform-aws-eks/issues/1089
启用输入后，terraform将创建以下安全组规则：

# module.eks.module.eks.aws_security_group_rule.cluster_primary_ingress_workers[0] will be created                                                                                                                                                                                                                           
  + resource "aws_security_group_rule" "cluster_primary_ingress_workers" {                                                                                                                                                                                                                                                     
      + description              = "Allow pods running on workers to send communication to cluster primary security group (e.g. Fargate pods)."                                                                                                                                                                                
      + from_port                = 0                                                                                                                                                                                                                                                                                           
      + id                       = (known after apply)                                                                                                                                                                                                                                                                         
      + protocol                 = "-1"                                                                                                                                                                                                                                                                                        
      + security_group_id        = "sg-03bb33d3318e4aa03"                                                                                                                                                                                                                                                                      
      + self                     = false                                                                                                                                                                                                                                                                                       
      + source_security_group_id = "sg-0fffc4d49a499a1d8"                                                                                                                                                                                                                                                                      
      + to_port                  = 65535                                                                                                                                                                                                                                                                                       
      + type                     = "ingress"                                                                                                                                                                                                                                                                                   
    }                                                                                                                                                                                                                                                                                                                          
                                                                                                                                                                                                                                                                                                                               
  # module.eks.module.eks.aws_security_group_rule.workers_ingress_cluster_primary[0] will be created                                                                                                                                                                                                                           
  + resource "aws_security_group_rule" "workers_ingress_cluster_primary" {                                                                                                                                                                                                                                                     
      + description              = "Allow pods running on workers to receive communication from cluster primary security group (e.g. Fargate pods)."                                                                                                                                                                           
      + from_port                = 0                                                                                                                                                                                                                                                                                           
      + id                       = (known after apply)                                                                                                                                                                                                                                                                         
      + protocol                 = "-1"                                                                                                                                                                                                                                                                                        
      + security_group_id        = "sg-0fffc4d49a499a1d8"                                                                                                                                                                                                                                                                      
      + self                     = false
      + source_security_group_id = "sg-03bb33d3318e4aa03"
      + to_port                  = 65535
      + type                     = "ingress"
    }

我在尝试创建一个同时使用AWS托管EC2示例和fargate的集群时遇到了这个问题。在我的案例中，解决方案很简单：

module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "~>19.16"

  create_cluster_security_group = false
  create_node_security_group    = false

  ...

这就是为什么它的工作原理。terraform-aws-eks模块为node和cluster创建了自己的安全组，但默认情况下，在fargate上启动的pod不使用这两个组。相反，fargate pod是通过集群的主要安全组启动的，该安全组由EKS创建。该安全组只允许来自其内部的流量，因此来自terraform创建的群集和节点安全组的流量将被阻止。由于CoreDNS默认运行在ec2示例上，因此此默认配置会阻止fargate pod访问集群的DNS。