AWS Builder Center

Builder Center

Exposing Kubernetes Apps on AWS with Ingress and the AWS Load Balancer Controller

Using AWS Load Balancer

Running apps on Amazon EKS is the easy part. The next question is how to get traffic from the internet to your pods. In Kubernetes, that's the job of an Ingress, and on AWS the best-supported way to use one is the AWS Load Balancer Controller.

What is an Ingress?

An Ingress is a Kubernetes resource that defines HTTP/HTTPS routing rules, such as "send /api to service A and / to service B." It doesn't do anything on its own. A controller watches for Ingress resources and builds the actual infrastructure.

How AWS handles it

The AWS Load Balancer Controller runs in your EKS cluster and turns Kubernetes resources into AWS resources:
  • Ingress becomes an Application Load Balancer (ALB)
  • Service of type LoadBalancer becomes a Network Load Balancer (NLB)
Because the ALB is a managed AWS service, you get Layer 7 routing, TLS termination with AWS Certificate Manager (ACM), and integration with AWS WAF without running your own proxy pods.

Setting it up

  1. Create an EKS cluster.
  2. Give the controller IAM permissions, using EKS Pod Identity or IAM Roles for Service Accounts (IRSA).
  3. Install the controller with Helm:
bash
1
2
3
4
5
6
helm repo add eks https://aws.github.io/eks-charts
helm install aws-load-balancer-controller eks/aws-load-balancer-controller \
-n kube-system \
--set clusterName=my-cluster \
--set serviceAccount.create=false \
--set serviceAccount.name=aws-load-balancer-controller

Example Ingress

yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: my-app
annotations:
alb.ingress.kubernetes.io/scheme: internet-facing
alb.ingress.kubernetes.io/target-type: ip
alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:region:account:certificate/id
spec:
ingressClassName: alb
rules:
- http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: my-app
port:
number: 80
Apply it, and within a minute or two the controller provisions an ALB and registers your pods as targets.

Tips

  • Use target-type: ip so the ALB sends traffic straight to pod IPs, skipping an extra hop through the nodes.
  • Share one ALB across multiple Ingresses with the alb.ingress.kubernetes.io/group.name annotation to save cost.
  • Automate DNS with ExternalDNS and Amazon Route 53 so hostnames update when your Ingress changes.
  • Add AWS WAF to the ALB for protection against common web attacks.

Wrapping up

The AWS Load Balancer Controller lets you manage ALBs and NLBs with the same YAML you use for the rest of your workloads. Combined with ACM, Route 53, and WAF, it gives you a secure, production-ready entry point to your EKS apps with very little setup.
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article