<p>I'm struggling to expose my app over the Internet when deployed to AWS EKS.</p>

<p>I have created a deployment and a service, I can see both of these running when using kubectl. I can see that the app has successfully connected to an external database as it runs a script on startup that initialises said database.</p>

<p>My issue is arising when trying to access the app over the internet. I have tried accessing the cluster endpoint and I am getting this error:</p>

<pre><code>{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {

  },
  "status": "Failure",
  "message": "forbidden: User "system:anonymous" cannot get path "/"",
  "reason": "Forbidden",
  "details": {

  },
  "code": 403
}
</code></pre>

<p>However, if I access the "/readyz" path I get "ok" returned.
"/version" returns the following:</p>

<pre><code>{
  "major": "1",
  "minor": "16+",
  "gitVersion": "v1.16.8-eks-e16311",
  "gitCommit": "e163110a04dcb2f39c3325af96d019b4925419eb",
  "gitTreeState": "clean",
  "buildDate": "2020-03-27T22:37:12Z",
  "goVersion": "go1.13.8",
  "compiler": "gc",
  "platform": "linux/amd64"
}
</code></pre>

<p>My deployment.yml file contains the following:</p>

<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: client
  labels:
    app: client
spec:
  replicas: 1
  selector:
    matchLabels:
      app: client
  template:
    metadata:
      labels:
        app: client
    spec:
      containers:
      - name: client
        image: image/repo
        ports:
        - containerPort: 80
        imagePullPolicy: Always
</code></pre>

<p>My service.yml:</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  name: client
  labels:
    run: client
spec:
  type: LoadBalancer
  ports:
    - name: "80"
      port: 80
      targetPort: 80
      protocol: TCP
  selector:
    run: client
</code></pre>

<p>I can see the Load Balancer has been created in the AWS console and I have tried updating the security group of the LB to be able to talk to the cluster endpoint. The LB dashboard is showing the one attached instance is 'OutOfService' and also under the monitoring tab, I can see one Unhealthy Host.</p>

<p>I've tried accessing the Load Balancer endpoint as provided in the EC2 area of the console (this matches what is returned from <code>kubectl get services</code> as the <code>EXTERNAL-IP</code> of the LB service) and I'm getting an empty response from there.</p>

<pre><code>curl XXXXXXX.eu-west-2.elb.amazonaws.com:80
curl: (52) Empty reply from server
</code></pre>

<p>This is the same when accessing in a web browser.</p>

<p>I seem to be going round in circles with this one any help at all would be greatly appreciated.</p>

<blockquote>
  <p>I've tried accessing the Load Balancer endpoint</p>
</blockquote>

<p>You are accessing the <strong>EKS</strong> URL, which is the kubernetes apiserver endpoint, and not the LoadBalancer that was (hopefully) created for your <code>client</code> <code>Service</code></p>

<p>You will want to <code>kubectl get -o wide svc client</code> and if it was successful in provisioning a LoadBalancer for you, then its URL will appear in the output. You can get more details about that situation by <code>kubectl describe svc client</code>, which will include any events that affected it during provisioning</p>
