Answers: <p>For my Peering Connection, I went to:</p>
  <p>&quot;Actions&quot; -&gt; &quot;Edit DNS Settings&quot; -&gt; &quot;Allow accepter VPC (<code>vpc-&lt;id&gt;</code>) to resolve DNS of requester VPC (vpc-<code>&lt;id-default&gt;</code>) hosts to private IP&quot;</p>
  <p>and checked it. (It was unchecked before). I had to wait a little while before this took effect.</p>
  
Answers: CC BY-SA 4.0
Answers: 2020-12-16T18:31:16.650Z
Answers: 2020-12-19T08:44:26.290Z
Answers: 2020-12-19T08:44:26.290Z
Answers: Zachary Delano
Body: <p>I have two K8s clusters in the same VPC that I want to connect to an MySQL
  Aurora RDS cluster. One of the clusters can reach the RDS cluster just fine.
  The other, however, cannot. I'll call these <code>eks-cluster-working</code> and
  <code>eks-cluster-broken</code>.</p>
  <p>I have a security group allowing traffic to the cluster:</p>
  <div class="s-table-container">
  <table class="s-table">
  <thead>
  <tr>
  <th>Type</th>
  <th>Protocol</th>
  <th>Port range</th>
  <th>Source</th>
  <th>Description</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>MYSQL/Aurora</td>
  <td>TCP</td>
  <td><code>3306</code></td>
  <td><code>sg-1</code> (eks-cluster-sg-working)</td>
  <td>This rule works</td>
  </tr>
  <tr>
  <td>MYSQL/Aurora</td>
  <td>TCP</td>
  <td><code>3306</code></td>
  <td><code>sg-2</code> (eks-cluster-sg-broken)</td>
  <td>This one does not</td>
  </tr>
  </tbody>
  </table>
  </div>
  <p>Both <code>eks-cluster-working</code> and <code>eks-cluster-broken</code> have the same default
  security groups that AWS creates when making an EKS cluster and they are both
  on the same K8s version (1.18). The one exception is that <code>eks-cluster-working</code>
  has an extra security group for the load balancer service since it's hosting a
  web service and the other one (<code>eks-cluster-broken</code>) is not. Both clusters
  have outbound traffic rules that can reach <code>0.0.0.0/0</code>.</p>
  <p>I have zero firewalls, firewall policies and network firewall rule groups set
  up in the region the clusters are hosted in.</p>
  <p>This is the Terraform configuration I have set up for peering from my VPCs
  to the default VPC.</p>
  <pre><code>resource &quot;aws_vpc_peering_connection&quot; &quot;default_to_environment&quot; {
    count       = local.num_environment_vpcs
    peer_vpc_id = data.aws_vpc.environment[count.index].id
    auto_accept = true
    vpc_id      = var.vpc_default_id
  
    tags = {
      Name      = &quot;Peer from default to ${data.aws_vpc.environment[count.index].tags[&quot;Name&quot;]}&quot;
      tf_module = &quot;vpc&quot;
    }
  }
  
  resource &quot;aws_route_table&quot; &quot;r&quot; {
    vpc_id = var.vpc_default_id
  
    # route = local.route_table_routes
  
    route {
      cidr_block = &quot;0.0.0.0/0&quot;
      gateway_id = &quot;igw-&lt;number&gt;&quot;
    }
  
    dynamic route {
      for_each = [for r in local.route_table_routes : {
        cidr_block                = r.cidr_block
        vpc_peering_connection_id = r.vpc_peering_connection_id
      }]
      content {
        cidr_block                = route.value.cidr_block
        vpc_peering_connection_id = route.value.vpc_peering_connection_id
      }
    }
  
    tags = {
      Name = &quot;default to environment VPCs&quot;
    }
  }
  </code></pre>
  <h2>Expected result</h2>
  <p>I expect <code>eks-cluster-broken</code> to be able to connect to the RDS cluster just
  like <code>eks-cluster-working</code> can.</p>
  <h2>Question</h2>
  <p>What can cause this? Any suggestions as to how to go about debugging this?</p>
  
Tags: <amazon-web-services><kubernetes><networking>
Title: K8s cluster in peered VPC can't reach RDS cluster
UserDisplayName: Zachary Delano
ThreadText: # K8s cluster in peered VPC can't reach RDS cluster
  
  (Asked by: username_0 on 2020-12-15)
  
  I have two K8s clusters in the same VPC that I want to connect to an MySQL
  Aurora RDS cluster. One of the clusters can reach the RDS cluster just fine.
  The other, however, cannot. I'll call these `eks-cluster-working` and
  `eks-cluster-broken`.
  
  I have a security group allowing traffic to the cluster:
  
  | Type | Protocol | Port range | Source | Description |
  | --- | --- | --- | --- | --- |
  | MYSQL/Aurora | TCP | `3306` | `sg-1` (eks-cluster-sg-working) | This rule works |
  | MYSQL/Aurora | TCP | `3306` | `sg-2` (eks-cluster-sg-broken) | This one does not |
  
  Both `eks-cluster-working` and `eks-cluster-broken` have the same default
  security groups that AWS creates when making an EKS cluster and they are both
  on the same K8s version (1.18). The one exception is that `eks-cluster-working`
  has an extra security group for the load balancer service since it's hosting a
  web service and the other one (`eks-cluster-broken`) is not. Both clusters
  have outbound traffic rules that can reach `0.0.0.0/0`.
  
  I have zero firewalls, firewall policies and network firewall rule groups set
  up in the region the clusters are hosted in.
  
  This is the Terraform configuration I have set up for peering from my VPCs
  to the default VPC.
  
  ```
  resource "aws_vpc_peering_connection" "default_to_environment" {
    count       = local.num_environment_vpcs
    peer_vpc_id = data.aws_vpc.environment[count.index].id
    auto_accept = true
    vpc_id      = var.vpc_default_id
  
    tags = {
      Name      = "Peer from default to ${data.aws_vpc.environment[count.index].tags["Name"]}"
      tf_module = "vpc"
    }
  }
  
  resource "aws_route_table" "r" {
    vpc_id = var.vpc_default_id
  
    # route = local.route_table_routes
  
    route {
      cidr_block = "0.0.0.0/0"
      gateway_id = "igw-<number>"
    }
  
    dynamic route {
      for_each = [for r in local.route_table_routes : {
        cidr_block                = r.cidr_block
        vpc_peering_connection_id = r.vpc_peering_connection_id
      }]
      content {
        cidr_block                = route.value.cidr_block
        vpc_peering_connection_id = route.value.vpc_peering_connection_id
      }
    }
  
    tags = {
      Name = "default to environment VPCs"
    }
  }
  
  ```
  
  ## Expected result
  
  I expect `eks-cluster-broken` to be able to connect to the RDS cluster just
  like `eks-cluster-working` can.
  
  ## Question
  
  What can cause this? Any suggestions as to how to go about debugging this?
  
  **Tags:** amazon-web-services, kubernetes, networking
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2020-12-16. Score: 4 | Accepted answer
  
  For my Peering Connection, I went to:
  
  "Actions" -> "Edit DNS Settings" -> "Allow accepter VPC (`vpc-<id>`) to resolve DNS of requester VPC (vpc-`<id-default>`) hosts to private IP"
  
  and checked it. (It was unchecked before). I had to wait a little while before this took effect.
  
  
  ---
  
  