When setting up Kubernetes on AWS, the `eksctl` utility is often a go-to choice due to its simplicity in handling the Amazon Elastic Kubernetes Service (EKS) resources. However, users sometimes encounter issues, such as the tool getting stuck on the "waiting for CloudFormation stack" stage during the cluster creation process. This hang-up can be quite perplexing, so let us dive into the potential causes and how to troubleshoot them.

Understanding CloudFormation and EKS

AWS CloudFormation is a service that provides a foundational framework for managing AWS resources. When you use `eksctl` to create a cluster, it leverages CloudFormation to set up the necessary infrastructure, such as VPCs, security groups, and the EKS control plane.

Common Causes for Being Stuck

1. Insufficient Permissions: The AWS user executing `eksctl` must have proper IAM permissions to create and manage CloudFormation stacks, VPC networking, EKS resources, etc.
2. Misconfigured VPC: If there's a networking misconfiguration, such as incorrect subnets or unavailable CIDRs, CloudFormation might fail or take longer to provision the resources.
3. Service Quotas: AWS service quotas might limit the creation of necessary resources, such as EC2 instances or EKS clusters in a given region.
4. Resource Availability: Sometimes, AWS regions have limited availability for specific instance types or resources, causing delays during creation.
5. Timeouts and Retries: CloudFormation might time out or retry multiple times if underlying resources are slow to respond or in a pending state.

Troubleshooting Steps

Verify Permissions

Ensure the IAM user or role has the necessary permissions:

• `eks:*` – Full control over EKS resources
• `cloudformation:*` – Manage CloudFormation resources
• `ec2:*` – Control over EC2 instances and networking resources

Consider attaching policies like `AmazonEKSClusterPolicy`, `AmazonEKSServicePolicy`, and `AmazonEC2ContainerRegistryReadOnly` to prevent permission issues.

Check VPC Configuration

Review the VPC setup to ensure:

• Subnets are public and appropriately tagged for EKS discovery.
• There's enough CIDR range to accommodate new subnets.
• The correct route tables and internet gateways are configured.

For example, with `eksctl`, you can specify the desired VPC with: