A company is migrating a microservices application from Amazon EC2 to Amazon Elastic Kubernetes Service (Amazon EKS). The EKS control plane must have endpoint private access = true and endpoint public access = false. The data plane nodes are placed in private subnets, but nodes are failing to join the cluster. Which solution will allow nodes to join the cluster?

When an Amazon EKS control plane has endpoint public access = false and endpoint private access = true, nodes in private subnets require a private connection to communicate with the control plane. Interface VPC endpoints (powered by AWS PrivateLink) provide this secure and private connectivity within your VPC, allowing the nodes to access the EKS control plane API without traversing the public internet. Granting IAM permissions to AmazonEKSNodeRole is necessary for nodes to interact with AWS services, but it doesn't resolve network connectivity issues to the EKS control plane itself. Recreating nodes in a public subnet would expose them to the internet, which contradicts the requirement for private access. Allowing outbound traffic in the security group is generally required, but it's insufficient if there's no private route to the control plane.