<p>I create cluster with <code>kops</code> utility on AWS EC2. Right now I am trying to configure <a href="https://github.com/kubernetes/ingress-nginx" rel="nofollow noreferrer">ingress-nginx</a> controller so it routes all traffic in my cluster. I need it handles HTTP, HTTPS and WebSocket connections. Based on this <a href="https://kubernetes.github.io/ingress-nginx/deploy/#aws" rel="nofollow noreferrer">guide</a> I made all required things:</p>

<pre class="lang-sh prettyprint-override"><code>kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/nginx-0.28.0/deploy/static/mandatory.yaml
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/nginx-0.28.0/deploy/static/provider/aws/service-l4.yaml
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/nginx-0.28.0/deploy/static/provider/aws/patch-configmap-l4.yaml
</code></pre>

<p>When I am trying to get all items in <code>ingress-nginx</code> namespace with <code>kubectl -n ingress-nginx get all</code>:</p>

<pre><code>NAME                    TYPE           CLUSTER-IP    EXTERNAL-IP                                                                 PORT(S)                      AGE
service/ingress-nginx   LoadBalancer   100.71.94.9   a7d3fe1383e344c1d8cb2de671xxxxxx-810xxxxxx.eu-central-1.elb.amazonaws.com   80:32389/TCP,443:31803/TCP   16m
</code></pre>

<p>When I open AWS console -> EC2 Instances -> Load Balancer, I can see that ELB has been created, but there <code>OutOfService</code> status on each node under "Instances" tab. So I can't get reach my ELB URL: <code>a7d3fe1383e344c1d8cb2de671xxxxxx-810xxxxxx.eu-central-1.elb.amazonaws.com</code>:</p>

<p><a href="https://i.stack.imgur.com/Y94Ta.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Y94Ta.jpg" alt="AWS Console - Load Balancers - ELB &quot;Instances&quot; tab "></a></p>

<p>There is some more details about service using <code>kubectl -n ingress-nginx describe service/ingress-nginx</code></p>

<pre><code>Name:                     ingress-nginx
Namespace:                ingress-nginx
Labels:                   app.kubernetes.io/name=ingress-nginx
                          app.kubernetes.io/part-of=ingress-nginx
Annotations:              kubectl.kubernetes.io/last-applied-configuration:
                            {"apiVersion":"v1","kind":"Service","metadata":{"annotations":{"service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout":"60"...
                          service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: 60
                          service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: *
Selector:                 app.kubernetes.io/name=ingress-nginx,app.kubernetes.io/part-of=ingress-nginx
Type:                     LoadBalancer
IP:                       100.71.94.9
LoadBalancer Ingress:     a7d3fe1383e344c1d8cb2de671xxxxxx-810xxxxxx.eu-central-1.elb.amazonaws.com
Port:                     http  80/TCP
TargetPort:               http/TCP
NodePort:                 http  32389/TCP
Endpoints:                &lt;none&gt;
Port:                     https  443/TCP
TargetPort:               https/TCP
NodePort:                 https  31803/TCP
Endpoints:                &lt;none&gt;
Session Affinity:         None
External Traffic Policy:  Cluster
Events:
  Type    Reason                Age   From                Message
  ----    ------                ----  ----                -------
  Normal  EnsuringLoadBalancer  15m   service-controller  Ensuring load balancer
  Normal  EnsuredLoadBalancer   15m   service-controller  Ensured load balancer
</code></pre>

<p>Am I missed something?</p>

<p><strong>UPD #1</strong></p>

<p>If I do the same things in EKS cluster, everything works well and ingress-controller appears on each node. Any ideas..?</p>

<p>You need to add security group on the EC2 instances(kubernetes worker nodes) where you have the nginx deployed to allow port 80 and 443 for the security group that was created for ELB. </p>

<p>Edit:</p>

<p>The endpoints section of the <code>service/ingress-nginx</code> service does not have IPs of the nginx pods. Hence when ELB sends a health check request but the request can not reach the pods so health check fails and ELB marks the backend as outofservice.</p>
