<p>I have an AKS cluster with a web application. I want to provision an nginx Ingress controller to expose the app to the internet and later enable TLS.</p>
<p>I have been following the official documentation</p>
<p><a href="https://learn.microsoft.com/en-us/azure/aks/ingress-basic" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/aks/ingress-basic</a></p>
<p>and</p>
<p><a href="https://learn.microsoft.com/en-us/azure/aks/ingress-static-ip" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/aks/ingress-static-ip</a></p>
<p>But I always end up with a pending nginx-ingress service with this error</p>
<pre><code>reason: SyncLoadBalancerFailed
message: &gt;-
  Error syncing load balancer: failed to ensure load balancer: instance not
  found
</code></pre>
<p><a href="https://i.stack.imgur.com/hA27b.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/hA27b.png" alt="enter image description here" /></a></p>
<p>I have seen</p>
<p><a href="https://stackoverflow.com/questions/55625051/how-to-fix-failed-to-ensure-load-balancer-error-for-nginx-ingress">How to fix &quot;failed to ensure load balancer&quot; error for nginx ingress</a></p>
<p>and googled the error but so far no luck</p>
<p>Does anyone know what could it be?</p>
<p>Or, is there some working example I can start from?</p>

<p>I believe you are using a static IP address with the NGINX Ingress controller service. This issue pops up if the cloud controller manager cannot find the static Azure Public Ip Address resource in the containing resource group mentioned in the NGINX Ingress Controller's service annotation (if no resource group is explicitly specified with a service annotation, it will look for the Azure Public IP Address resource in the <a href="https://learn.microsoft.com/en-us/azure/aks/faq#why-are-two-resource-groups-created-with-aks" rel="nofollow noreferrer">AKS cluster's node resource group</a>)</p>
<p>If you have created the static Azure Public IP Address resource in the node resource group then please ensure that the Azure Public IP address resource exists.</p>
<p>If you have created the static Azure Public IP Address resource in a different resource group, then:</p>
<ul>
<li><p>Please ensure the cluster identity used by the AKS cluster has delegated permissions to the other resource group, such as Network Contributor.</p>
<pre><code>az role assignment create \
  --assignee &lt;Client ID of cluster identity&gt; \
  --role &quot;Network Contributor&quot; \
  --scope /subscriptions/&lt;subscription id&gt;/resourceGroups/&lt;Public IP address resource group name&gt;
</code></pre>
<p><strong>Note:</strong> Your cluster identity can be a <a href="https://learn.microsoft.com/en-us/azure/aks/kubernetes-service-principal?tabs=azure-cli" rel="nofollow noreferrer">service principal</a> or a <a href="https://learn.microsoft.com/en-us/azure/aks/use-managed-identity" rel="nofollow noreferrer">managed identity</a>.</p>
</li>
<li><p>In the <code>helm install</code> command to deploy an NGINX Ingress Controller, please add the following argument:<br />
<code>--set controller.service.annotations.&quot;service\.beta\.kubernetes\.io/azure-load-balancer-resource-group&quot;=$PublicIpAddressResourceGroupName</code></p>
<p>Thus, if you are following <a href="https://learn.microsoft.com/en-us/azure/aks/ingress-static-ip#ip-and-dns-label" rel="nofollow noreferrer">this document</a> the helm install command should look something like:</p>
<pre><code># Use Helm to deploy an NGINX ingress controller
helm install nginx-ingress ingress-nginx/ingress-nginx \
  --namespace ingress-basic \
  --set controller.replicaCount=2 \
  --set controller.nodeSelector.&quot;kubernetes\.io/os&quot;=linux \
  --set controller.image.registry=$ACR_URL \
  --set controller.image.image=$CONTROLLER_IMAGE \
  --set controller.image.tag=$CONTROLLER_TAG \
  --set controller.image.digest=&quot;&quot; \
  --set controller.admissionWebhooks.patch.nodeSelector.&quot;kubernetes\.io/os&quot;=linux \
  --set controller.admissionWebhooks.patch.image.registry=$ACR_URL \
  --set controller.admissionWebhooks.patch.image.image=$PATCH_IMAGE \
  --set controller.admissionWebhooks.patch.image.tag=$PATCH_TAG \
  --set defaultBackend.nodeSelector.&quot;kubernetes\.io/os&quot;=linux \
  --set defaultBackend.image.registry=$ACR_URL \
  --set defaultBackend.image.image=$DEFAULTBACKEND_IMAGE \
  --set defaultBackend.image.tag=$DEFAULTBACKEND_TAG \
  --set controller.service.loadBalancerIP=$STATIC_IP \
  --set controller.service.annotations.&quot;service\.beta\.kubernetes\.io/azure-dns-label-name&quot;=$DNS_LABEL
  --set controller.service.annotations.&quot;service\.beta\.kubernetes\.io/azure-load-balancer-resource-group&quot;=$PublicIpAddressResourceGroupName
</code></pre>
</li>
</ul>
<p>For more information please check <a href="https://learn.microsoft.com/en-us/azure/aks/static-ip#create-a-service-using-the-static-ip-address" rel="nofollow noreferrer">here</a>.</p>
