search

kubernetes-sigs / aws-load-balancer-controller

A Kubernetes controller for Elastic Load Balancers
https://kubernetes-sigs.github.io/aws-load-balancer-controller/
Apache License 2.0
3.82k stars 1.41k forks source link

FailedNetworkReconciling targetGroupBinding expect exactly one securityGroup tagged with kubernetes.io/cluster/<cluster_name> #3731

Open sriramsm04 opened 1 month ago

sriramsm04 commented 1 month ago

targetGroupBinding failing when both cluster_security_group_tags and node_security_group_tags have the tag kubernetes.io/cluster/

Like NLB, we want to select additional tag for the controller to look for the security group if it is possible

AWS Load Balancer controller version - 2.6.2 Kubernetes version - 1.29 EKS platform version - eks.7

We are using terraform EKS blueprints to bring up our EKS cluster with both cluster and node SG. Eventually EKS is creating the kubernetes.io/cluster/ to both the SGs. We are using aws-load-balancer-controller add-on to create ALB and targetType as IP so while trying to add the backend SG's id to the cluster/node SG, it is failing to do so in identifying to which SG to add.

M00nF1sh commented 3 weeks ago

/kind feature I think we can solve this by always use the first one when multiple SG with cluster tag detected. However, this requires code change. Is possible to remove the cluster tag on the another sg of your node group?