<p>I'm trying to create an EKS cluster with terraform and configure it thorugh kubectl and istio basic following this guides:</p>
<p><a href="https://rtfm.co.ua/en/aws-elastic-kubernetes-service-running-alb-ingress-controller/" rel="nofollow noreferrer">alb-ingress-controller</a></p>
<p><a href="https://rtfm.co.ua/en/istio-external-aws-application-loadbalancer-and-istio-ingress-gateway/" rel="nofollow noreferrer">istio-alb</a></p>
<p>However when trying to deploy the alb, it does not create any alb on aws.</p>
<p>Ruunning <code>kubectl get ingress -n istio-system</code>, I get:</p>
<pre><code>NAME   CLASS    HOSTS   ADDRESS   PORTS   AGE
alb    &lt;none&gt;   *                 80      4s
</code></pre>
<p>I'm unable to debug it as I can't find any log telling me why the alb is not deployed. Does anynone came across the same issue? Or does anyone have any clues on how to pin-point the issue?</p>
<p>Follow config files used:</p>
<p>ingress-alb.yaml</p>
<pre><code>    ---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: alb
  namespace: istio-system
  annotations:
    # create AWS Application LoadBalancer
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/certificate-arn: &quot;***&quot;
    alb.ingress.kubernetes.io/listen-ports: '[{&quot;HTTP&quot;: 80}, {&quot;HTTPS&quot;:443}]'
    alb.ingress.kubernetes.io/actions.ssl-redirect: '{&quot;Type&quot;: &quot;redirect&quot;, &quot;RedirectConfig&quot;: { &quot;Protocol&quot;: &quot;HTTPS&quot;, &quot;Port&quot;: &quot;443&quot;, &quot;StatusCode&quot;: &quot;HTTP_301&quot;}}'
    external-dns.alpha.kubernetes.io/hostname: &quot;****&quot;
spec:
  rules:
    - http:
        paths:
          - path: /*
            backend:
              serviceName: ssl-redirect
              servicePort: use-annotation
          - path: /*
            backend:
              serviceName: istio-ingressgateway
              servicePort: 80
</code></pre>
<p><code>kubectl -n istio-system get svc istio-ingressgateway</code></p>
<pre><code>NAME                   TYPE       CLUSTER-IP      EXTERNAL-IP   PORT(S)                                      AGE
istio-ingressgateway   NodePort   **************   &lt;none&gt;        15021:30012/TCP,80:31684/TCP,443:30689/TCP   132m
</code></pre>
<p>eks_cluster.tf</p>
<pre><code>data &quot;aws_eks_cluster&quot; &quot;eks&quot; {
  name = module.eks_cluster.cluster_id
}

data &quot;aws_eks_cluster_auth&quot; &quot;eks&quot; {
  name = module.eks_cluster.cluster_id
}
provider &quot;kubernetes&quot; {
  host                   = data.aws_eks_cluster.eks.endpoint
  cluster_ca_certificate = base64decode(data.aws_eks_cluster.eks.certificate_authority[0].data)
  token                  = data.aws_eks_cluster_auth.eks.token
}
module &quot;eks_cluster&quot; {
  source          = &quot;terraform-aws-modules/eks/aws&quot;

  cluster_version = &quot;1.18&quot;
  cluster_name    = var.eks.cluster_name
  vpc_id          = *****
  subnets         = *****
  cluster_endpoint_private_access = true
  enable_irsa     = true
  

  worker_groups = [
    {
      name = &quot;worker-group-1&quot;
      instance_type = &quot;t3a.medium&quot;
      asg_min_size = 1
      asg_max_size  = 3
      asg_desired_capacity = 2
      root_volume_type = &quot;gp3&quot;
      root_volume_size = 20
    }
  ]

  map_users = [{
    userarn   = &quot;***&quot;
    username  = &quot;****&quot;
    groups = [&quot;****&quot;]
  }]
}
</code></pre>

<p>I managed to make ALB working with following</p>
<pre><code>EKS - 1.22
aws-load-balancer-controller - v2.4.1 
istioctl - 1.14.2
</code></pre>
<p>First I modified istio-ingressgateway service type from load balancer to node port.</p>
<pre><code>istioctl install --set profile=default --set values.gateways.istio-ingressgateway.type=NodePort -y
</code></pre>
<p>Then create ingress. Here is my ingress. I only configured to support port 80</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: istio-alb
  namespace: istio-system
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/listen-ports: '[{&quot;HTTP&quot;: 80}]'
    alb.ingress.kubernetes.io/subnets: subnet-aaaaaaa, subnet-bbbbbbbb, subnet-cccccc
    alb.ingress.kubernetes.io/security-groups: sg-xxxxxxxxxx
    alb.ingress.kubernetes.io/healthcheck-path: /healthz/ready
    alb.ingress.kubernetes.io/healthcheck-port: &quot;32560&quot;
spec:
  rules:
    - http:
        paths:
          - backend:
              service:
                name: istio-ingressgateway
                port:
                  number: 80
            pathType: ImplementationSpecific
</code></pre>
<p>I believe adding security group annotation will solve your issue.</p>
