AWS Load Balancer Controller not creating ALB — Ingress stuck with no address | Today I Fixed

The problem: Applied an Ingress resource on EKS with kubernetes.io/ingress.class: alb annotation. The Ingress was created but ADDRESS stayed empty forever. No ALB appeared in the AWS console.

The fix:

bash

# Check AWS Load Balancer Controller logs first
kubectl logs -n kube-system deployment/aws-load-balancer-controller | tail -30
 
# Error found:
# "failed to build model: ingress: my-namespace/my-ingress: couldn't auto-discover subnets"
 
# Issue 1: Subnets missing required tags
# Public subnets need this tag for internet-facing ALB:
# Key: kubernetes.io/role/elb
# Value: 1
 
# Tag your public subnets via AWS CLI:
aws ec2 create-tags \
  --resources subnet-abc123 subnet-def456 \
  --tags Key=kubernetes.io/role/elb,Value=1
 
# For internal ALB, tag private subnets:
# Key: kubernetes.io/role/internal-elb
# Value: 1
 
# Also required on subnets (and VPC):
# Key: kubernetes.io/cluster/<cluster-name>
# Value: shared   (or "owned" if only this cluster uses it)

bash

# Issue 2: Controller IAM role missing permissions
# Check if controller has IAM role annotation:
kubectl get serviceaccount aws-load-balancer-controller -n kube-system -o yaml \
  | grep eks.amazonaws.com/role-arn
 
# If missing: attach the AWSLoadBalancerControllerIAMPolicy to the controller's role
# Download the policy:
curl -O https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.8.0/docs/install/iam_policy.json
 
aws iam create-policy \
  --policy-name AWSLoadBalancerControllerIAMPolicy \
  --policy-document file://iam_policy.json

Why it happens: The AWS Load Balancer Controller discovers subnets automatically by looking for specific tags. Without kubernetes.io/role/elb=1 on public subnets, the controller can't find where to create the ALB and silently skips creation. The controller logs are the only place this error is reported — the Ingress object itself shows no error message.