Kubernetes Ingress External IP Stuck Pending: Fix in 5 Minutes

kubectl get svc myapp -n production
# NAME    TYPE           EXTERNAL-IP   PORT(S)
# myapp   LoadBalancer   <pending>     80:31234/TCP
 
kubectl get ingress myapp -n production
# NAME    CLASS   HOSTS   ADDRESS   PORTS   AGE
# myapp   nginx   *                 80      10m    ← empty ADDRESS

kubectl describe svc myapp -n production | grep -A 10 Events:
kubectl describe ingress myapp -n production | grep -A 10 Events:

kubectl get nodes -o wide
# If this is a bare-metal or on-prem cluster (kubeadm, k3s without a
# cloud provider), there is NOTHING that knows how to provision a
# real external load balancer — LoadBalancer type will stay pending forever

apiVersion: metallb.io/v1beta1
kind: IPAddressPool
metadata:
  name: default-pool
  namespace: metallb-system
spec:
  addresses:
    - 192.168.1.240-192.168.1.250

kubectl apply -f metallb-config.yaml
# Existing pending Services should get an IP assigned shortly after MetalLB is running

kubectl get pods -A | grep -i ingress
# If nothing shows up, no ingress controller is even installed —
# the Ingress resource exists but nothing is watching it

# Example: ingress-nginx via Helm
helm install ingress-nginx ingress-nginx/ingress-nginx \
  --namespace ingress-nginx --create-namespace

kubectl describe svc myapp -n production
# Events:
#   Warning  SyncLoadBalancerFailed  ... could not find any suitable
#   subnets for creating the ELB

# Check subnet tags — required for the controller to discover them
aws ec2 describe-subnets --filters "Name=vpc-id,Values=vpc-0abc123" \
  --query 'Subnets[*].[SubnetId,Tags]'

aws ec2 create-tags --resources subnet-0abc123 \
  --tags Key=kubernetes.io/role/elb,Value=1    # public subnets for internet-facing LBs
aws ec2 create-tags --resources subnet-0def456 \
  --tags Key=kubernetes.io/role/internal-elb,Value=1   # private subnets for internal LBs

# Also check the controller's own logs for IAM permission errors
kubectl logs -n kube-system deployment/aws-load-balancer-controller | grep -i "denied\|forbidden"

aws service-quotas get-service-quota --service-code elasticloadbalancing \
  --quota-code L-53DA6B97    # Application Load Balancers per region

kubectl get ingress myapp -n production -o jsonpath='{.spec.ingressClassName}'
# nginx
 
kubectl get ingressclass
# NAME      CONTROLLER
# alb                     ← only "alb" is actually installed, "nginx" was requested but doesn't exist

spec:
  ingressClassName: alb    # Match to what's actually running in the cluster

# This annotation is AWS-specific — has zero effect on GKE or AKS,
# and the Service will just stay pending with no clear error
metadata:
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-type: "nlb"

# Confirm which cloud you're actually on before trusting copy-pasted annotations
kubectl get nodes -o jsonpath='{.items[0].spec.providerID}'
# aws:///us-east-1a/i-0abc123    ← confirms AWS, so AWS-specific annotations are correct here

kubectl describe svc myapp -n production | grep -A 10 Events:      # actual error from the controller
kubectl get pods -A | grep -i ingress                               # confirm a controller exists at all
kubectl get ingressclass                                             # confirm the requested class exists
kubectl logs -n kube-system deployment/aws-load-balancer-controller  # (if applicable) controller-side errors