Answers: <p>The load balancer will connect to the default security group by default. This security group has a source of itself, which basically means that it blocks everything.</p>
  <p>Add the inbound rule of all traffic from &quot;Anywhere-IPv4&quot; to ensure that all traffic can access the load balancer.</p>
  
Answers: CC BY-SA 4.0
Answers: 2022-10-22T11:08:57.590Z
Answers: 2022-10-22T11:08:57.590Z
Answers: froxpotatoes
Answers: <p>Check Security Groups again. Ensure, that SG used for Kubernetes service is open for your ALB SG (the best practice clearly said, you shouldn't use defasults, please, create a new one).</p>
  <p>ALB must have Target Group. Check events for this TG, you will see the messages, you should see errors if any.</p>
  
Answers: CC BY-SA 4.0
Answers: 2022-11-27T15:52:25.377Z
Answers: 2022-11-27T15:52:25.377Z
Answers: Pawel Piwosz
Body: <p>I am following a tutorial to set Kubernetes with an ingress managed service. The cluster is,</p>
  <ul>
  <li>1 controller</li>
  <li>2 worker Kubernetes cluster</li>
  <li>kubeadm built</li>
  <li>running Kubernetes v1.25.3 (latest at the time of writing)</li>
  <li>running weave-net</li>
  <li>running ingress-nginx</li>
  <li>EC2, <em>not</em> EKS</li>
  </ul>
  <p>I am just expecting to see the nginx default page when I access the AWS Application Load Balancer, ALB, DNS name - nothing fancy.</p>
  <p>I first used this helm chart to deploy nginx-ingress, as per the &quot;<a href="https://kubernetes.github.io/ingress-nginx/deploy/#quick-start" rel="nofollow noreferrer">Quick start</a>&quot; docs.</p>
  <pre><code>helm upgrade --install ingress-nginx ingress-nginx \
    --repo https://kubernetes.github.io/ingress-nginx \
    --namespace ingress-nginx --create-namespace
  </code></pre>
  <p>I then deployed the following in the <code>default</code> namespace.</p>
  <p>ingress.yaml</p>
  <pre><code>---
  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    name: my-app-ingress
    namespace: default
  spec:
    ingressClassName: nginx
    rules:
    - host: ***alb***.elb.amazonaws.com
      http:
        paths:
        - backend:
            service:
              name: nginx-service
              port:
                number: 8080
          path: /
          pathType: Exact
  </code></pre>
  <p>service.yaml</p>
  <pre><code>---
  apiVersion: v1
  kind: Service
  metadata:
    name: nginx-service
    labels:
      app: nginx
      svc: test-nginx
  spec:
    selector:
      app: nginx
    ports:
      - protocol: TCP
        port: 8080
        targetPort: 80
  </code></pre>
  <p>deployment.yaml</p>
  <pre><code>---
  apiVersion: v1
  kind: Service
  metadata:
    name: nginx-service
    labels:
      app: nginx
      svc: test-nginx
  spec:
    selector:
      app: nginx
    ports:
      - protocol: TCP
        port: 8080
        targetPort: 80
  
  </code></pre>
  <pre><code>k get svc -A
  </code></pre>
  <pre><code>NAMESPACE       NAME                                 TYPE           CLUSTER-IP       EXTERNAL-IP   PORT(S)                      AGE
  default         demo                                 ClusterIP      *****            &lt;none&gt;        80/TCP                       7h53m
  default         kubernetes                           ClusterIP      *****            &lt;none&gt;        443/TCP                      2d6h
  default         nginx-service                        ClusterIP      *****            &lt;none&gt;        8080/TCP                     26h
  ingress-nginx   ingress-nginx-controller             LoadBalancer   *****            &lt;pending&gt;     80:32573/TCP,443:32512/TCP   35h
  ingress-nginx   ingress-nginx-controller-admission   ClusterIP      *****            &lt;none&gt;        443/TCP                      35h
  kube-system     kube-dns                             ClusterIP      *****            &lt;none&gt;        53/UDP,53/TCP,9153/TCP       2d6h
  </code></pre>
  <p>Two AWS security groups are in effect, one for the controller and one for the workers. Both these security groups have ports 6783 - 6784 open as required by ingress-nginx.</p>
  <p>The ALB is set with the following.</p>
  <ul>
  <li>same Availability Zones as the worker nodes</li>
  <li>default (open) security group</li>
  <li>Listener protocol:port = HTTP:80</li>
  <li>same VPC as the EC2 instances.</li>
  <li>Scheme = internet-facing</li>
  <li>IP address type = ipv4</li>
  </ul>
  <p>The target group for this ALB is set as follows.</p>
  <ul>
  <li>both worker nodes</li>
  <li>Protocol : Port = HTTP: 32573</li>
  <li>Protocol version = HTTP1</li>
  <li>same VPC as the EC2 instances.</li>
  <li>Health path = /</li>
  </ul>
  <p>On the assumption that the target group would block traffic to &quot;unhealthy&quot; nodes, I previously deployed a separate service directly on a different <code>NodePort</code>, rather than via <code>Ingress</code>, to fudge the health check to <em>Healthy</em>, but this made no difference.</p>
  <p>I have,</p>
  <ul>
  <li>double checked that I have followed the steps in the tutorial <em>exactly</em></li>
  <li>looked through the logs but cannot find anything that would suggest an error.</li>
  <li>terminated all the pods.</li>
  <li>restarted the nodes.</li>
  </ul>
  <p>When I run</p>
  <pre><code>k logs ingress-nginx-controller-***** -n ingress-nginx
  </code></pre>
  <p>It returns</p>
  <pre><code>-------------------------------------------------------------------------------
  NGINX Ingress controller
    Release:       v1.4.0
    Build:         50be2bf95fd1ef480420e2aa1d6c5c7c138c95ea
    Repository:    https://github.com/kubernetes/ingress-nginx
    nginx version: nginx/1.19.10
  
  -------------------------------------------------------------------------------
  
  W1021 13:49:00.607448       7 client_config.go:617] Neither --kubeconfig nor --master was specified.  Using the inClusterConfig.  This might not work.
  I1021 13:49:00.607678       7 main.go:209] &quot;Creating API client&quot; host=&quot;https://10.96.0.1:443&quot;
  I1021 13:49:00.613511       7 main.go:253] &quot;Running in Kubernetes cluster&quot; major=&quot;1&quot; minor=&quot;25&quot; git=&quot;v1.25.3&quot; state=&quot;clean&quot; commit=&quot;434bfd82814af038ad94d62ebe59b133fcb50506&quot; platform=&quot;linux/amd64&quot;
  I1021 13:49:00.776507       7 main.go:104] &quot;SSL fake certificate created&quot; file=&quot;/etc/ingress-controller/ssl/default-fake-certificate.pem&quot;
  I1021 13:49:00.788407       7 ssl.go:533] &quot;loading tls certificate&quot; path=&quot;/usr/local/certificates/cert&quot; key=&quot;/usr/local/certificates/key&quot;
  I1021 13:49:00.807812       7 nginx.go:260] &quot;Starting NGINX Ingress controller&quot;
  I1021 13:49:00.820423       7 event.go:285] Event(v1.ObjectReference{Kind:&quot;ConfigMap&quot;, Namespace:&quot;ingress-nginx&quot;, Name:&quot;ingress-nginx-controller&quot;, UID:&quot;f4d537f7-2b89-4fe5-a9ed-c064533b08a2&quot;, APIVersion:&quot;v1&quot;, ResourceVersion:&quot;96138&quot;, FieldPath:&quot;&quot;}): type: 'Normal' reason: 'CREATE' ConfigMap ingress-nginx/ingress-nginx-controller
  I1021 13:49:01.910567       7 store.go:430] &quot;Found valid IngressClass&quot; ingress=&quot;default/my-app-ingress&quot; ingressclass=&quot;nginx&quot;
  I1021 13:49:01.910942       7 event.go:285] Event(v1.ObjectReference{Kind:&quot;Ingress&quot;, Namespace:&quot;default&quot;, Name:&quot;my-app-ingress&quot;, UID:&quot;9111168a-9dc8-4cf8-a0f6-fe871c3ada61&quot;, APIVersion:&quot;networking.k8s.io/v1&quot;, ResourceVersion:&quot;245885&quot;, FieldPath:&quot;&quot;}): type: 'Normal' reason: 'Sync' Scheduled for sync
  I1021 13:49:02.009443       7 nginx.go:303] &quot;Starting NGINX process&quot;
  I1021 13:49:02.009750       7 leaderelection.go:248] attempting to acquire leader lease ingress-nginx/ingress-controller-leader...
  I1021 13:49:02.010156       7 nginx.go:323] &quot;Starting validation webhook&quot; address=&quot;:8443&quot; certPath=&quot;/usr/local/certificates/cert&quot; keyPath=&quot;/usr/local/certificates/key&quot;
  I1021 13:49:02.010553       7 controller.go:168] &quot;Configuration changes detected, backend reload required&quot;
  I1021 13:49:02.015673       7 status.go:84] &quot;New leader elected&quot; identity=&quot;ingress-nginx-controller-567c84f6f-8s5zv&quot;
  I1021 13:49:02.081076       7 controller.go:185] &quot;Backend successfully reloaded&quot;
  I1021 13:49:02.081398       7 controller.go:196] &quot;Initial sync, sleeping for 1 second&quot;
  I1021 13:49:02.081913       7 event.go:285] Event(v1.ObjectReference{Kind:&quot;Pod&quot;, Namespace:&quot;ingress-nginx&quot;, Name:&quot;ingress-nginx-controller-567c84f6f-52k47&quot;, UID:&quot;fa2b26ad-0594-4e43-927a-11a9def12467&quot;, APIVersion:&quot;v1&quot;, ResourceVersion:&quot;249556&quot;, FieldPath:&quot;&quot;}): type: 'Normal' reason: 'RELOAD' NGINX reload triggered due to a change in configuration
  I1021 13:49:43.652768       7 leaderelection.go:258] successfully acquired lease ingress-nginx/ingress-controller-leader
  I1021 13:49:43.652910       7 status.go:84] &quot;New leader elected&quot; identity=&quot;ingress-nginx-controller-567c84f6f-52k47&quot;
  W1021 14:22:31.247404       7 controller.go:1112] Service &quot;default/demo&quot; does not have any active Endpoint.
  I1021 14:22:31.283535       7 admission.go:149] processed ingress via admission controller {testedIngressLength:2 testedIngressTime:0.036s renderingIngressLength:2 renderingIngressTime:0s admissionTime:25.8kBs testedConfigurationSize:0.036}
  I1021 14:22:31.283727       7 main.go:100] &quot;successfully validated configuration, accepting&quot; ingress=&quot;default/demo&quot;
  I1021 14:22:31.289380       7 store.go:430] &quot;Found valid IngressClass&quot; ingress=&quot;default/demo&quot; ingressclass=&quot;nginx&quot;
  I1021 14:22:31.289790       7 event.go:285] Event(v1.ObjectReference{Kind:&quot;Ingress&quot;, Namespace:&quot;default&quot;, Name:&quot;demo&quot;, UID:&quot;50962ac3-d7f1-45bc-8e73-7baf6337331b&quot;, APIVersion:&quot;networking.k8s.io/v1&quot;, ResourceVersion:&quot;252977&quot;, FieldPath:&quot;&quot;}): type: 'Normal' reason: 'Sync' Scheduled for sync
  W1021 14:22:31.290058       7 controller.go:1112] Service &quot;default/demo&quot; does not have any active Endpoint.
  I1021 14:22:31.290210       7 controller.go:168] &quot;Configuration changes detected, backend reload required&quot;
  I1021 14:22:31.366582       7 controller.go:185] &quot;Backend successfully reloaded&quot;
  I1021 14:22:31.367273       7 event.go:285] Event(v1.ObjectReference{Kind:&quot;Pod&quot;, Namespace:&quot;ingress-nginx&quot;, Name:&quot;ingress-nginx-controller-567c84f6f-52k47&quot;, UID:&quot;fa2b26ad-0594-4e43-927a-11a9def12467&quot;, APIVersion:&quot;v1&quot;, ResourceVersion:&quot;249556&quot;, FieldPath:&quot;&quot;}): type: 'Normal' reason: 'RELOAD' NGINX reload triggered due to a change in configuration
  I1021 14:25:34.757766       7 controller.go:168] &quot;Configuration changes detected, backend reload required&quot;
  I1021 14:25:34.827908       7 controller.go:185] &quot;Backend successfully reloaded&quot;
  I1021 14:25:34.828291       7 event.go:285] Event(v1.ObjectReference{Kind:&quot;Pod&quot;, Namespace:&quot;ingress-nginx&quot;, Name:&quot;ingress-nginx-controller-567c84f6f-52k47&quot;, UID:&quot;fa2b26ad-0594-4e43-927a-11a9def12467&quot;, APIVersion:&quot;v1&quot;, ResourceVersion:&quot;249556&quot;, FieldPath:&quot;&quot;}): type: 'Normal' reason: 'RELOAD' NGINX reload triggered due to a change in configuration
  I1021 14:25:41.191636       7 admission.go:149] processed ingress via admission controller {testedIngressLength:1 testedIngressTime:0.036s renderingIngressLength:1 renderingIngressTime:0s admissionTime:22.1kBs testedConfigurationSize:0.036}
  I1021 14:25:41.191800       7 main.go:100] &quot;successfully validated configuration, accepting&quot; ingress=&quot;default/my-app-ingress&quot;
  I1021 14:25:41.195876       7 event.go:285] Event(v1.ObjectReference{Kind:&quot;Ingress&quot;, Namespace:&quot;default&quot;, Name:&quot;my-app-ingress&quot;, UID:&quot;9111168a-9dc8-4cf8-a0f6-fe871c3ada61&quot;, APIVersion:&quot;networking.k8s.io/v1&quot;, ResourceVersion:&quot;253276&quot;, FieldPath:&quot;&quot;}): type: 'Normal' reason: 'Sync' Scheduled for sync
  I1021 20:40:45.084934       7 admission.go:149] processed ingress via admission controller {testedIngressLength:1 testedIngressTime:0.049s renderingIngressLength:1 renderingIngressTime:0s admissionTime:22.1kBs testedConfigurationSize:0.049}
  I1021 20:40:45.085124       7 main.go:100] &quot;successfully validated configuration, accepting&quot; ingress=&quot;default/my-app-ingress&quot;
  I1021 20:40:45.088698       7 controller.go:168] &quot;Configuration changes detected, backend reload required&quot;
  I1021 20:40:45.088779       7 event.go:285] Event(v1.ObjectReference{Kind:&quot;Ingress&quot;, Namespace:&quot;default&quot;, Name:&quot;my-app-ingress&quot;, UID:&quot;9111168a-9dc8-4cf8-a0f6-fe871c3ada61&quot;, APIVersion:&quot;networking.k8s.io/v1&quot;, ResourceVersion:&quot;287850&quot;, FieldPath:&quot;&quot;}): type: 'Normal' reason: 'Sync' Scheduled for sync
  I1021 20:40:45.183140       7 controller.go:185] &quot;Backend successfully reloaded&quot;
  I1021 20:40:45.184054       7 event.go:285] Event(v1.ObjectReference{Kind:&quot;Pod&quot;, Namespace:&quot;ingress-nginx&quot;, Name:&quot;ingress-nginx-controller-567c84f6f-52k47&quot;, UID:&quot;fa2b26ad-0594-4e43-927a-11a9def12467&quot;, APIVersion:&quot;v1&quot;, ResourceVersion:&quot;249556&quot;, FieldPath:&quot;&quot;}): type: 'Normal' reason: 'RELOAD' NGINX reload triggered due to a change in configuration
  </code></pre>
  <p>I notice that the following appears in the logs for the weave-net pods.</p>
  <pre><code>k logs weave-net-*w1* -n kube-system
  </code></pre>
  <p>Where <code>*w1*</code> is the pod running on worker node1.</p>
  <pre><code>INFO: 2022/10/21 13:49:27.195158 -&gt;[*controller*:6783] error during connection attempt: dial tcp :0-&gt;*controller*:6783: connect: connection refused
  </code></pre>
  <p>Where <code>*controller*</code> is the IP address of the control node.</p>
  <p>After all of the above, when I navigate to the ALB DNS address, I just get,</p>
  <p><code>internal error - server connection terminated</code></p>
  <p>This is clearly a PEBKAC, but what am I missing?</p>
  
Comments: CC BY-SA 4.0
Comments: 2022-11-29T05:08:24.650Z
Comments: There’s a lot of open steps in this question. Have you verified that new pods in the cluster can access the nginx-service.default:8080 and the alb, and are you running external-dns?
Comments: benjimin
Comments: CC BY-SA 4.0
Comments: 2022-12-27T18:21:25.873Z
Comments: If you have an ALB why not use alb ingress controller instead of involving nginx controller?
Comments: benjimin
Tags: <kubernetes><amazon-web-services><amazon-ec2><ingress-nginx>
Title: Why is my AWS Application Load Balancer not exposing my Kubernetes service?
UserDisplayName: froxpotatoes
ThreadText: # Why is my AWS Application Load Balancer not exposing my Kubernetes service?
  
  (Asked by: username_0 on 2022-10-21)
  
  I am following a tutorial to set Kubernetes with an ingress managed service. The cluster is,
  
  * 1 controller
  * 2 worker Kubernetes cluster
  * kubeadm built
  * running Kubernetes v1.25.3 (latest at the time of writing)
  * running weave-net
  * running ingress-nginx
  * EC2, *not* EKS
  
  I am just expecting to see the nginx default page when I access the AWS Application Load Balancer, ALB, DNS name - nothing fancy.
  
  I first used this helm chart to deploy nginx-ingress, as per the "[Quick start](https://kubernetes.github.io/ingress-nginx/deploy/#quick-start)" docs.
  
  ```
  helm upgrade --install ingress-nginx ingress-nginx \
    --repo https://kubernetes.github.io/ingress-nginx \
    --namespace ingress-nginx --create-namespace
  
  ```
  
  I then deployed the following in the `default` namespace.
  
  ingress.yaml
  
  ```
  ---
  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    name: my-app-ingress
    namespace: default
  spec:
    ingressClassName: nginx
    rules:
    - host: ***alb***.elb.amazonaws.com
      http:
        paths:
        - backend:
            service:
              name: nginx-service
              port:
                number: 8080
          path: /
          pathType: Exact
  
  ```
  
  service.yaml
  
  ```
  ---
  apiVersion: v1
  kind: Service
  metadata:
    name: nginx-service
    labels:
      app: nginx
      svc: test-nginx
  spec:
    selector:
      app: nginx
    ports:
      - protocol: TCP
        port: 8080
        targetPort: 80
  
  ```
  
  deployment.yaml
  
  ```
  ---
  apiVersion: v1
  kind: Service
  metadata:
    name: nginx-service
    labels:
      app: nginx
      svc: test-nginx
  spec:
    selector:
      app: nginx
    ports:
      - protocol: TCP
        port: 8080
        targetPort: 80
  
  ```
  
  ```
  k get svc -A
  
  ```
  
  ```
  NAMESPACE       NAME                                 TYPE           CLUSTER-IP       EXTERNAL-IP   PORT(S)                      AGE
  default         demo                                 ClusterIP      *****            <none>        80/TCP                       7h53m
  default         kubernetes                           ClusterIP      *****            <none>        443/TCP                      2d6h
  default         nginx-service                        ClusterIP      *****            <none>        8080/TCP                     26h
  ingress-nginx   ingress-nginx-controller             LoadBalancer   *****            <pending>     80:32573/TCP,443:32512/TCP   35h
  ingress-nginx   ingress-nginx-controller-admission   ClusterIP      *****            <none>        443/TCP                      35h
  kube-system     kube-dns                             ClusterIP      *****            <none>        53/UDP,53/TCP,9153/TCP       2d6h
  
  ```
  
  Two AWS security groups are in effect, one for the controller and one for the workers. Both these security groups have ports 6783 - 6784 open as required by ingress-nginx.
  
  The ALB is set with the following.
  
  * same Availability Zones as the worker nodes
  * default (open) security group
  * Listener protocol:port = HTTP:80
  * same VPC as the EC2 instances.
  * Scheme = internet-facing
  * IP address type = ipv4
  
  The target group for this ALB is set as follows.
  
  * both worker nodes
  * Protocol : Port = HTTP: 32573
  * Protocol version = HTTP1
  * same VPC as the EC2 instances.
  * Health path = /
  
  On the assumption that the target group would block traffic to "unhealthy" nodes, I previously deployed a separate service directly on a different `NodePort`, rather than via `Ingress`, to fudge the health check to *Healthy*, but this made no difference.
  
  I have,
  
  * double checked that I have followed the steps in the tutorial *exactly*
  * looked through the logs but cannot find anything that would suggest an error.
  * terminated all the pods.
  * restarted the nodes.
  
  When I run
  
  ```
  k logs ingress-nginx-controller-***** -n ingress-nginx
  
  ```
  
  It returns
  
  ```
  -------------------------------------------------------------------------------
  NGINX Ingress controller
    Release:       v1.4.0
    Build:         50be2bf95fd1ef480420e2aa1d6c5c7c138c95ea
    Repository:    https://github.com/kubernetes/ingress-nginx
    nginx version: nginx/1.19.10
  
  -------------------------------------------------------------------------------
  
  W1021 13:49:00.607448       7 client_config.go:617] Neither --kubeconfig nor --master was specified.  Using the inClusterConfig.  This might not work.
  I1021 13:49:00.607678       7 main.go:209] "Creating API client" host="https://10.96.0.1:443"
  I1021 13:49:00.613511       7 main.go:253] "Running in Kubernetes cluster" major="1" minor="25" git="v1.25.3" state="clean" commit="434bfd82814af038ad94d62ebe59b133fcb50506" platform="linux/amd64"
  I1021 13:49:00.776507       7 main.go:104] "SSL fake certificate created" file="/etc/ingress-controller/ssl/default-fake-certificate.pem"
  I1021 13:49:00.788407       7 ssl.go:533] "loading tls certificate" path="/usr/local/certificates/cert" key="/usr/local/certificates/key"
  I1021 13:49:00.807812       7 nginx.go:260] "Starting NGINX Ingress controller"
  I1021 13:49:00.820423       7 event.go:285] Event(v1.ObjectReference{Kind:"ConfigMap", Namespace:"ingress-nginx", Name:"ingress-nginx-controller", UID:"f4d537f7-2b89-4fe5-a9ed-c064533b08a2", APIVersion:"v1", ResourceVersion:"96138", FieldPath:""}): type: 'Normal' reason: 'CREATE' ConfigMap ingress-nginx/ingress-nginx-controller
  I1021 13:49:01.910567       7 store.go:430] "Found valid IngressClass" ingress="default/my-app-ingress" ingressclass="nginx"
  I1021 13:49:01.910942       7 event.go:285] Event(v1.ObjectReference{Kind:"Ingress", Namespace:"default", Name:"my-app-ingress", UID:"9111168a-9dc8-4cf8-a0f6-fe871c3ada61", APIVersion:"networking.k8s.io/v1", ResourceVersion:"245885", FieldPath:""}): type: 'Normal' reason: 'Sync' Scheduled for sync
  I1021 13:49:02.009443       7 nginx.go:303] "Starting NGINX process"
  I1021 13:49:02.009750       7 leaderelection.go:248] attempting to acquire leader lease ingress-nginx/ingress-controller-leader...
  I1021 13:49:02.010156       7 nginx.go:323] "Starting validation webhook" address=":8443" certPath="/usr/local/certificates/cert" keyPath="/usr/local/certificates/key"
  I1021 13:49:02.010553       7 controller.go:168] "Configuration changes detected, backend reload required"
  I1021 13:49:02.015673       7 status.go:84] "New leader elected" identity="ingress-nginx-controller-567c84f6f-8s5zv"
  I1021 13:49:02.081076       7 controller.go:185] "Backend successfully reloaded"
  I1021 13:49:02.081398       7 controller.go:196] "Initial sync, sleeping for 1 second"
  I1021 13:49:02.081913       7 event.go:285] Event(v1.ObjectReference{Kind:"Pod", Namespace:"ingress-nginx", Name:"ingress-nginx-controller-567c84f6f-52k47", UID:"fa2b26ad-0594-4e43-927a-11a9def12467", APIVersion:"v1", ResourceVersion:"249556", FieldPath:""}): type: 'Normal' reason: 'RELOAD' NGINX reload triggered due to a change in configuration
  I1021 13:49:43.652768       7 leaderelection.go:258] successfully acquired lease ingress-nginx/ingress-controller-leader
  I1021 13:49:43.652910       7 status.go:84] "New leader elected" identity="ingress-nginx-controller-567c84f6f-52k47"
  W1021 14:22:31.247404       7 controller.go:1112] Service "default/demo" does not have any active Endpoint.
  I1021 14:22:31.283535       7 admission.go:149] processed ingress via admission controller {testedIngressLength:2 testedIngressTime:0.036s renderingIngressLength:2 renderingIngressTime:0s admissionTime:25.8kBs testedConfigurationSize:0.036}
  I1021 14:22:31.283727       7 main.go:100] "successfully validated configuration, accepting" ingress="default/demo"
  I1021 14:22:31.289380       7 store.go:430] "Found valid IngressClass" ingress="default/demo" ingressclass="nginx"
  I1021 14:22:31.289790       7 event.go:285] Event(v1.ObjectReference{Kind:"Ingress", Namespace:"default", Name:"demo", UID:"50962ac3-d7f1-45bc-8e73-7baf6337331b", APIVersion:"networking.k8s.io/v1", ResourceVersion:"252977", FieldPath:""}): type: 'Normal' reason: 'Sync' Scheduled for sync
  W1021 14:22:31.290058       7 controller.go:1112] Service "default/demo" does not have any active Endpoint.
  I1021 14:22:31.290210       7 controller.go:168] "Configuration changes detected, backend reload required"
  I1021 14:22:31.366582       7 controller.go:185] "Backend successfully reloaded"
  I1021 14:22:31.367273       7 event.go:285] Event(v1.ObjectReference{Kind:"Pod", Namespace:"ingress-nginx", Name:"ingress-nginx-controller-567c84f6f-52k47", UID:"fa2b26ad-0594-4e43-927a-11a9def12467", APIVersion:"v1", ResourceVersion:"249556", FieldPath:""}): type: 'Normal' reason: 'RELOAD' NGINX reload triggered due to a change in configuration
  I1021 14:25:34.757766       7 controller.go:168] "Configuration changes detected, backend reload required"
  I1021 14:25:34.827908       7 controller.go:185] "Backend successfully reloaded"
  I1021 14:25:34.828291       7 event.go:285] Event(v1.ObjectReference{Kind:"Pod", Namespace:"ingress-nginx", Name:"ingress-nginx-controller-567c84f6f-52k47", UID:"fa2b26ad-0594-4e43-927a-11a9def12467", APIVersion:"v1", ResourceVersion:"249556", FieldPath:""}): type: 'Normal' reason: 'RELOAD' NGINX reload triggered due to a change in configuration
  I1021 14:25:41.191636       7 admission.go:149] processed ingress via admission controller {testedIngressLength:1 testedIngressTime:0.036s renderingIngressLength:1 renderingIngressTime:0s admissionTime:22.1kBs testedConfigurationSize:0.036}
  I1021 14:25:41.191800       7 main.go:100] "successfully validated configuration, accepting" ingress="default/my-app-ingress"
  I1021 14:25:41.195876       7 event.go:285] Event(v1.ObjectReference{Kind:"Ingress", Namespace:"default", Name:"my-app-ingress", UID:"9111168a-9dc8-4cf8-a0f6-fe871c3ada61", APIVersion:"networking.k8s.io/v1", ResourceVersion:"253276", FieldPath:""}): type: 'Normal' reason: 'Sync' Scheduled for sync
  I1021 20:40:45.084934       7 admission.go:149] processed ingress via admission controller {testedIngressLength:1 testedIngressTime:0.049s renderingIngressLength:1 renderingIngressTime:0s admissionTime:22.1kBs testedConfigurationSize:0.049}
  I1021 20:40:45.085124       7 main.go:100] "successfully validated configuration, accepting" ingress="default/my-app-ingress"
  I1021 20:40:45.088698       7 controller.go:168] "Configuration changes detected, backend reload required"
  I1021 20:40:45.088779       7 event.go:285] Event(v1.ObjectReference{Kind:"Ingress", Namespace:"default", Name:"my-app-ingress", UID:"9111168a-9dc8-4cf8-a0f6-fe871c3ada61", APIVersion:"networking.k8s.io/v1", ResourceVersion:"287850", FieldPath:""}): type: 'Normal' reason: 'Sync' Scheduled for sync
  I1021 20:40:45.183140       7 controller.go:185] "Backend successfully reloaded"
  I1021 20:40:45.184054       7 event.go:285] Event(v1.ObjectReference{Kind:"Pod", Namespace:"ingress-nginx", Name:"ingress-nginx-controller-567c84f6f-52k47", UID:"fa2b26ad-0594-4e43-927a-11a9def12467", APIVersion:"v1", ResourceVersion:"249556", FieldPath:""}): type: 'Normal' reason: 'RELOAD' NGINX reload triggered due to a change in configuration
  
  ```
  
  I notice that the following appears in the logs for the weave-net pods.
  
  ```
  k logs weave-net-*w1* -n kube-system
  
  ```
  
  Where `*w1*` is the pod running on worker node1.
  
  ```
  INFO: 2022/10/21 13:49:27.195158 ->[*controller*:6783] error during connection attempt: dial tcp :0->*controller*:6783: connect: connection refused
  
  ```
  
  Where `*controller*` is the IP address of the control node.
  
  After all of the above, when I navigate to the ALB DNS address, I just get,
  
  `internal error - server connection terminated`
  
  This is clearly a PEBKAC, but what am I missing?
  
  **Tags:** kubernetes, amazon-web-services, amazon-ec2, ingress-nginx
  
  > **Comments:**
  > **username_1**: There’s a lot of open steps in this question. Have you verified that new pods in the cluster can access the nginx-service.default:8080 and the alb, and are you running external-dns?  
  > **username_1**: If you have an ALB why not use alb ingress controller instead of involving nginx controller?  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_0 on 2022-10-22. Score: 0
  
  The load balancer will connect to the default security group by default. This security group has a source of itself, which basically means that it blocks everything.
  
  Add the inbound rule of all traffic from "Anywhere-IPv4" to ensure that all traffic can access the load balancer.
  
  
  ---
  
  ### Answer by username_2 on 2022-11-27. Score: 0
  
  Check Security Groups again. Ensure, that SG used for Kubernetes service is open for your ALB SG (the best practice clearly said, you shouldn't use defasults, please, create a new one).
  
  ALB must have Target Group. Check events for this TG, you will see the messages, you should see errors if any.
  
  
  ---
  
  