<p>For my Peering Connection, I went to:</p>
<p>&quot;Actions&quot; -&gt; &quot;Edit DNS Settings&quot; -&gt; &quot;Allow accepter VPC (<code>vpc-&lt;id&gt;</code>) to resolve DNS of requester VPC (vpc-<code>&lt;id-default&gt;</code>) hosts to private IP&quot;</p>
<p>and checked it. (It was unchecked before). I had to wait a little while before this took effect.</p>

CC BY-SA 4.0
2020-12-16T18:31:16.650Z
2020-12-19T08:44:26.290Z
2020-12-19T08:44:26.290Z
Zachary Delano
<p>I have two K8s clusters in the same VPC that I want to connect to an MySQL
Aurora RDS cluster. One of the clusters can reach the RDS cluster just fine.
The other, however, cannot. I'll call these <code>eks-cluster-working</code> and
<code>eks-cluster-broken</code>.</p>
<p>I have a security group allowing traffic to the cluster:</p>
<div class="s-table-container">
<table class="s-table">
<thead>
<tr>
<th>Type</th>
<th>Protocol</th>
<th>Port range</th>
<th>Source</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>MYSQL/Aurora</td>
<td>TCP</td>
<td><code>3306</code></td>
<td><code>sg-1</code> (eks-cluster-sg-working)</td>
<td>This rule works</td>
</tr>
<tr>
<td>MYSQL/Aurora</td>
<td>TCP</td>
<td><code>3306</code></td>
<td><code>sg-2</code> (eks-cluster-sg-broken)</td>
<td>This one does not</td>
</tr>
</tbody>
</table>
</div>
<p>Both <code>eks-cluster-working</code> and <code>eks-cluster-broken</code> have the same default
security groups that AWS creates when making an EKS cluster and they are both
on the same K8s version (1.18). The one exception is that <code>eks-cluster-working</code>
has an extra security group for the load balancer service since it's hosting a
web service and the other one (<code>eks-cluster-broken</code>) is not. Both clusters
have outbound traffic rules that can reach <code>0.0.0.0/0</code>.</p>
<p>I have zero firewalls, firewall policies and network firewall rule groups set
up in the region the clusters are hosted in.</p>
<p>This is the Terraform configuration I have set up for peering from my VPCs
to the default VPC.</p>
<pre><code>resource &quot;aws_vpc_peering_connection&quot; &quot;default_to_environment&quot; {
  count       = local.num_environment_vpcs
  peer_vpc_id = data.aws_vpc.environment[count.index].id
  auto_accept = true
  vpc_id      = var.vpc_default_id

  tags = {
    Name      = &quot;Peer from default to ${data.aws_vpc.environment[count.index].tags[&quot;Name&quot;]}&quot;
    tf_module = &quot;vpc&quot;
  }
}

resource &quot;aws_route_table&quot; &quot;r&quot; {
  vpc_id = var.vpc_default_id

  # route = local.route_table_routes

  route {
    cidr_block = &quot;0.0.0.0/0&quot;
    gateway_id = &quot;igw-&lt;number&gt;&quot;
  }

  dynamic route {
    for_each = [for r in local.route_table_routes : {
      cidr_block                = r.cidr_block
      vpc_peering_connection_id = r.vpc_peering_connection_id
    }]
    content {
      cidr_block                = route.value.cidr_block
      vpc_peering_connection_id = route.value.vpc_peering_connection_id
    }
  }

  tags = {
    Name = &quot;default to environment VPCs&quot;
  }
}
</code></pre>
<h2>Expected result</h2>
<p>I expect <code>eks-cluster-broken</code> to be able to connect to the RDS cluster just
like <code>eks-cluster-working</code> can.</p>
<h2>Question</h2>
<p>What can cause this? Any suggestions as to how to go about debugging this?</p>

<amazon-web-services><kubernetes><networking>
K8s cluster in peered VPC can't reach RDS cluster
Zachary Delano
# K8s cluster in peered VPC can't reach RDS cluster

(Asked by: username_0 on 2020-12-15)

I have two K8s clusters in the same VPC that I want to connect to an MySQL
Aurora RDS cluster. One of the clusters can reach the RDS cluster just fine.
The other, however, cannot. I'll call these eks-cluster-working and
eks-cluster-broken.
I have a security group allowing traffic to the cluster:




Type
Protocol
Port range
Source
Description




MYSQL/Aurora
TCP
3306
sg-1 (eks-cluster-sg-working)
This rule works


MYSQL/Aurora
TCP
3306
sg-2 (eks-cluster-sg-broken)
This one does not




Both eks-cluster-working and eks-cluster-broken have the same default
security groups that AWS creates when making an EKS cluster and they are both
on the same K8s version (1.18). The one exception is that eks-cluster-working
has an extra security group for the load balancer service since it's hosting a
web service and the other one (eks-cluster-broken) is not. Both clusters
have outbound traffic rules that can reach 0.0.0.0/0.
I have zero firewalls, firewall policies and network firewall rule groups set
up in the region the clusters are hosted in.
This is the Terraform configuration I have set up for peering from my VPCs
to the default VPC.
resource "aws_vpc_peering_connection" "default_to_environment" {
  count       = local.num_environment_vpcs
  peer_vpc_id = data.aws_vpc.environment[count.index].id
  auto_accept = true
  vpc_id      = var.vpc_default_id

  tags = {
    Name      = "Peer from default to ${data.aws_vpc.environment[count.index].tags["Name"]}"
    tf_module = "vpc"
  }
}

resource "aws_route_table" "r" {
  vpc_id = var.vpc_default_id

  # route = local.route_table_routes

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = "igw-"
  }

  dynamic route {
    for_each = [for r in local.route_table_routes : {
      cidr_block                = r.cidr_block
      vpc_peering_connection_id = r.vpc_peering_connection_id
    }]
    content {
      cidr_block                = route.value.cidr_block
      vpc_peering_connection_id = route.value.vpc_peering_connection_id
    }
  }

  tags = {
    Name = "default to environment VPCs"
  }
}

Expected result
I expect eks-cluster-broken to be able to connect to the RDS cluster just
like eks-cluster-working can.
Question
What can cause this? Any suggestions as to how to go about debugging this?

**Tags:** amazon-web-services, kubernetes, networking


---

## 1 answers

### Answer by username_0 on 2020-12-16. Score: 4 | Accepted answer

For my Peering Connection, I went to:

"Actions" -> "Edit DNS Settings" -> "Allow accepter VPC (`vpc-`) to resolve DNS of requester VPC (vpc-) hosts to private IP"

and checked it. (It was unchecked before). I had to wait a little while before this took effect.


---

