- Newest
- Most votes
- Most comments
Looks like the ingress controller did not create the ALB for some reason. For troubleshooting further I suggest to look at:
kubectl describe ing lab-ingress -n containers-lab
- examine the logs of the ingress controller pods (usually they are running on
kube-system
namespace)
One possible reason can be that the ingress controller does not have the necessary permissions to create the load balancer. The logs will help you determine if this is the case.
thanks for your reply. i found the following error message from ingress controller pod, but not sure if that is the root cause.
{"level":"error","ts":"2024-07-18T03:30:47Z","msg":"Reconciler error","controller":"ingress","object":{"name":"lab-ingress","namespace":"containers-lab"},"namespace":"containers-lab","name":"lab-ingress","reconcileID":"a428e91b-8edd-4679-b3c0-a4c11e97582b","error":"AccessDenied: User: arn:aws:sts::654654314383:assumed-role/AmazonEKSLoadBalancerControllerRole/1721273359055840536 is not authorized to perform: elasticloadbalancing:AddTags on resource: arn:aws:elasticloadbalancing:ap-southeast-2:654654314383:targetgroup/k8s-containe-labservi-11117e6551/* because no identity-based policy allows the elasticloadbalancing:AddTags action\n\tstatus code: 403, request id: 1baec434-ccca-4493-956e-0882739effe7"}
could you please provide advice or direction, thanks!
i changed the --attach-policy-arn to a higher priviledge policy, and delete the old iamserviceaccount, recreate a new one. now i can see the ingress's address now. eksctl create iamserviceaccount --name iampolicy-sa --namespace containers-lab --cluster eks-lab-cluster --role-name "eksRole4serviceaccount1" --attach-policy-arn arn:aws:iam::$ACCOUNT_NUMBER:policy/eks-lab-read-policy --approve --override-existing-serviceaccounts
Relevant content
- asked 2 years ago
- asked 3 months ago
This definitely does look like the root cause. the Role
AmazonEKSLoadBalancerControllerRole
that the ingress controller assumes is missing theelasticloadbalancing:AddTags
action in it's IAM policy (and perhaps more actions). Please go over the documentation here https://docs.aws.amazon.com/eks/latest/userguide/lbc-manifest.html#lbc-iam and make sure that policy assigned to the role is exactly as mentioned (https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.7.2/docs/install/iam_policy.json)