{"id":837,"date":"2021-10-26T13:16:25","date_gmt":"2021-10-26T05:16:25","guid":{"rendered":"https:\/\/vinta.ws\/code\/?p=837"},"modified":"2026-02-18T01:20:34","modified_gmt":"2026-02-17T17:20:34","slug":"amazon-eks-setup-aws-load-balancer-controller-for-kubernetes-ingress","status":"publish","type":"post","link":"https:\/\/vinta.ws\/code\/amazon-eks-setup-aws-load-balancer-controller-for-kubernetes-ingress.html","title":{"rendered":"Amazon EKS: Setup aws-load-balancer-controller for Kubernetes Ingress"},"content":{"rendered":"<p>AWS Load Balancer Controller replaces the functionality of the AWS ALB Ingress Controller.<\/p>\n<h2>Install aws-load-balancer-controller<\/h2>\n<h3>Create an IAM OIDC provider for your cluster<\/h3>\n<pre class=\"line-numbers\"><code class=\"language-bash\">eksctl utils associate-iam-oidc-provider --profile=perp \n  --region ap-northeast-1 \n  --cluster perp-staging \n  --approve<\/code><\/pre>\n<p>ref:<br \/>\n<a href=\"https:\/\/docs.aws.amazon.com\/eks\/latest\/userguide\/enable-iam-roles-for-service-accounts.html\">https:\/\/docs.aws.amazon.com\/eks\/latest\/userguide\/enable-iam-roles-for-service-accounts.html<\/a><\/p>\n<h3>Create a Kubernetes ServiceAccount for the Controller<\/h3>\n<pre class=\"line-numbers\"><code class=\"language-bash\">curl -o iam_policy.json https:\/\/raw.githubusercontent.com\/kubernetes-sigs\/aws-load-balancer-controller\/v2.3.0\/docs\/install\/iam_policy.json\n\naws iam create-policy --profile=perp \n  --policy-name AWSLoadBalancerControllerIAMPolicy \n  --policy-document file:\/\/iam_policy.json\n\neksctl create iamserviceaccount --profile=perp \n  --cluster=perp-staging \n  --namespace=kube-system \n  --name=aws-load-balancer-controller \n  --attach-policy-arn=arn:aws:iam::XXX:policy\/AWSLoadBalancerControllerIAMPolicy \n  --override-existing-serviceaccounts \n  --approve<\/code><\/pre>\n<p>re:<br \/>\n<a href=\"https:\/\/docs.aws.amazon.com\/eks\/latest\/userguide\/aws-load-balancer-controller.html\">https:\/\/docs.aws.amazon.com\/eks\/latest\/userguide\/aws-load-balancer-controller.html<\/a><br \/>\n<a href=\"https:\/\/kubernetes-sigs.github.io\/aws-load-balancer-controller\/v2.3\/deploy\/installation\/\">https:\/\/kubernetes-sigs.github.io\/aws-load-balancer-controller\/v2.3\/deploy\/installation\/<\/a><\/p>\n<h3>Deploy aws-load-balancer-controller<\/h3>\n<pre class=\"line-numbers\"><code class=\"language-bash\">helm repo add eks https:\/\/aws.github.io\/eks-charts\n\nhelm ls -A\n\nhelm upgrade -i \n  aws-load-balancer-controller eks\/aws-load-balancer-controller \n  -n kube-system \n  --set clusterName=perp-staging \n  --set serviceAccount.create=false \n  --set serviceAccount.name=aws-load-balancer-controller \n  --set region=ap-northeast-1 \n  --set vpcId=vpc-XXX<\/code><\/pre>\n<p>ref:<br \/>\n<a href=\"https:\/\/docs.aws.amazon.com\/eks\/latest\/userguide\/aws-load-balancer-controller.html#helm-v3-or-later\">https:\/\/docs.aws.amazon.com\/eks\/latest\/userguide\/aws-load-balancer-controller.html#helm-v3-or-later<\/a><br \/>\n<a href=\"https:\/\/kubernetes-sigs.github.io\/aws-load-balancer-controller\/v2.3\/deploy\/installation\/\">https:\/\/kubernetes-sigs.github.io\/aws-load-balancer-controller\/v2.3\/deploy\/installation\/<\/a><br \/>\n<a href=\"https:\/\/kubernetes-sigs.github.io\/aws-load-balancer-controller\/v2.3\/deploy\/configurations\/\">https:\/\/kubernetes-sigs.github.io\/aws-load-balancer-controller\/v2.3\/deploy\/configurations\/<\/a><br \/>\n<a href=\"https:\/\/github.com\/aws\/eks-charts\/tree\/master\/stable\/aws-load-balancer-controller\">https:\/\/github.com\/aws\/eks-charts\/tree\/master\/stable\/aws-load-balancer-controller<\/a><\/p>\n<h2>Create an Ingress using ALB<\/h2>\n<pre class=\"line-numbers\"><code class=\"language-yaml\">apiVersion: networking.k8s.io\/v1\nkind: Ingress\nmetadata:\n  name: graph-node-ingress\n  annotations:\n    kubernetes.io\/ingress.class: alb\n    alb.ingress.kubernetes.io\/scheme: internet-facing\n    alb.ingress.kubernetes.io\/ssl-policy: ELBSecurityPolicy-FS-1-2-Res-2020-10\n    alb.ingress.kubernetes.io\/certificate-arn: YOUR_ACM_ARN\n    alb.ingress.kubernetes.io\/target-type: ip\n    alb.ingress.kubernetes.io\/target-group-attributes: stickiness.enabled=true,stickiness.lb_cookie.duration_seconds=60\n    alb.ingress.kubernetes.io\/load-balancer-attributes: idle_timeout.timeout_seconds=3600,deletion_protection.enabled=true\n    alb.ingress.kubernetes.io\/listen-ports: '[{\"HTTPS\": 443}]'\n    alb.ingress.kubernetes.io\/actions.graph-node-jsonrpc: &gt;\n      {\"type\": \"forward\", \"forwardConfig\": {\"targetGroups\": [\n        {\"serviceName\": \"graph-node\", \"servicePort\": 8000, \"weight\": 100}\n      ]}}\n    alb.ingress.kubernetes.io\/actions.graph-node-websocket: &gt;\n      {\"type\": \"forward\", \"forwardConfig\": {\"targetGroups\": [\n        {\"serviceName\": \"graph-node\", \"servicePort\": 8001, \"weight\": 100}\n      ]}}\nspec:\n  rules:\n  - host: \"subgraph-api.example.com\"\n    http:\n      paths:\n        - path: \/\n          pathType: Prefix\n          backend:\n            service:\n              name: graph-node-jsonrpc\n              port:\n                name: use-annotation\n  - host: \"subgraph-ws.example.com\"\n    http:\n      paths:\n        - path: \/\n          pathType: Prefix\n          backend:\n            service:\n              name: graph-node-websocket\n              port:\n                name: use-annotation<\/code><\/pre>\n<p>ref:<br \/>\n<a href=\"https:\/\/kubernetes-sigs.github.io\/aws-load-balancer-controller\/v2.3\/guide\/ingress\/annotations\/\">https:\/\/kubernetes-sigs.github.io\/aws-load-balancer-controller\/v2.3\/guide\/ingress\/annotations\/<\/a><\/p>\n<pre class=\"line-numbers\"><code class=\"language-bash\">kubectl apply -f graph-node-ingress.yaml -R<\/code><\/pre>\n<p>Then create Route 53 records for the above domains, and point them to the newly created ALB.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>AWS Load Balancer Controller replaces the functionality of the AWS ALB Ingress Controller.<\/p>\n","protected":false},"author":1,"featured_media":838,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[38,116],"tags":[136,123],"class_list":["post-837","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-about-devops","category-about-web-development","tag-aws-eks","tag-kubernetes"],"_links":{"self":[{"href":"https:\/\/vinta.ws\/code\/wp-json\/wp\/v2\/posts\/837","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vinta.ws\/code\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vinta.ws\/code\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vinta.ws\/code\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/vinta.ws\/code\/wp-json\/wp\/v2\/comments?post=837"}],"version-history":[{"count":0,"href":"https:\/\/vinta.ws\/code\/wp-json\/wp\/v2\/posts\/837\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vinta.ws\/code\/wp-json\/wp\/v2\/media\/838"}],"wp:attachment":[{"href":"https:\/\/vinta.ws\/code\/wp-json\/wp\/v2\/media?parent=837"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vinta.ws\/code\/wp-json\/wp\/v2\/categories?post=837"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vinta.ws\/code\/wp-json\/wp\/v2\/tags?post=837"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}