Unable to select active EKS cluster during enrollment despite API authentication mode enabled

[spiffaz]

When attempting to enroll an EKS cluster through the Teleport Cloud portal, the cluster appears in the list as active but remains greyed out and unselectable. The cluster has API authentication mode enabled and all required IAM permissions are configured.
Relevant details:

Authentication modes: API, ConfigMap

IAM policy attached to role:
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "eks:ListClusters", "eks:DescribeCluster", "eks:ListAccessEntries", "eks:CreateAccessEntry", "eks:DeleteAccessEntry", "eks:AssociateAccessPolicy", "eks:TagResource" ], "Resource": "*" } ] }

Teleport version is Teleport cloud

What could be missing and how can I fix this?

[webvictim]

@GavinFrazar might be able to make a suggestion here.

[GavinFrazar]

You have to hover over the EKS cluster to see a tooltip explaining why it's greyed out (we should make that tooltip more obvious).

That said, I'm guessing you need to enable public endpoint access.
Go to AWS console > EKS > your cluster > Networking, then:

1. Click "manage endpoint access"
2. select the "public and private" option
3. expand the "advanced settings"
4. click "add source"
5. add "0.0.0.0/0" as a source CIDR block
6. click "save changes"

This allows public API endpoint access from 0.0.0.0/0 (i.e anywhere, but still requires auth of course) so that your Teleport Cloud instance can reach it and install the Teleport kube agent (Teleport Cloud does not publish our IP ranges, that's why we say use 0.0.0.0/0, sorry)

Once the Teleport kube agent is installed you don't need the public endpoint access anymore, so you can modify your cluster to only allow private API endpoint access again.

If you don't want to open up public endpoint access, then you have to install the teleport kube agent yourself with helm.
There's a guided enrollment wizard for that too, but it's called "Self-Hosted".

We also have a docs guide for doing it:
https://goteleport.com/docs/enroll-resources/kubernetes-access/register-clusters/iam-joining/