aws-load-balancer-controller: ALB Ingress is not getting created

Installed the ALB ingress on the EKS cluster, the chart got installed successfully, the issue is when creating the ingress of the application. I’m trying to install the sample app 2048, when doing so I’m getting error as below

Internal error occurred: failed calling webhook "vingress.elbv2.k8s.aws": Post "https://aws-load-balancer-webhook-service.kube-system.svc:443/validate-networking-v1beta1-ingress?timeout=10s": context deadline exceeded

I guess the IngressClass is not validating properly.

AWS Load Balancer controller version (v2.3.1)
Kubernetes version (1.21)
Using EKS (yes/no), if so version? yes (1.21)

About this issue

Original URL
State: closed
Created 2 years ago
Reactions: 9
Comments: 18

Commits related to this issue

Additional steps required for v18.x https://github.com/kubernetes-sigs/aws-load-balancer-controller/issues/2462 — committed to alexlogy/terraform-eks-cluster by alexlogy 2 years ago

Most upvoted comments

For people who are stumbling on this after upgrading the aws terraform eks module to version 18.x, the required configuration for the module to work with the load balancer controller is:

node_security_group_additional_rules = {
  ...
  ingress_allow_access_from_control_plane = {
    type                          = "ingress"
    protocol                      = "tcp"
    from_port                     = 9443
    to_port                       = 9443
    source_cluster_security_group = true
    description                   = "Allow access from control plane to webhook port of AWS load balancer controller"
  }
}

+156

DZDomi on Feb 7, 2022

node_security_group_additional_rules

after checking, investigating and suddenly discover this thread , I saw your comment @DZDomi and your solution works!

It need to open the port 9443 and works

Also thanks for share the Terraform code of the EKS module 😃

alexvaque on May 17, 2022

@GrigorievNick, for aws lb controller, you’d need to allow port 9443 for webhook access. Other application components might have different requirements, you’d need to figure out the optimum configuration based on your security requirements.

kishorj on Jan 31, 2022

@gitmaniak This is fixed, the reason for the failure is the service port number is not opened in the node security group. This piece of information is not captured anywhere in the documentation.

boopathykpm on Jan 25, 2022

@boopathykpm, error indicates that the k8s controlplane is not able to connect to the aws-load-balancer-controller pods running on your worker nodes. Could you ensure the cluster security group allows traffic between the k8s controlplane and the worker nodes? Please refer to issue #2460, the symptoms are the same.

kishorj on Jan 18, 2022