<p>Trying to deploy <a href="https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.2/" rel="nofollow noreferrer">aws-load-balancer-controller</a> on Kubernetes.</p>
<p>I have the following TF code:</p>
<pre><code>resource &quot;kubernetes_deployment&quot; &quot;ingress&quot; {
  metadata {
    name      = &quot;alb-ingress-controller&quot;
    namespace = &quot;kube-system&quot;
    labels = {
      app.kubernetes.io/name = &quot;alb-ingress-controller&quot; 
      app.kubernetes.io/version = &quot;v2.2.3&quot;
      app.kubernetes.io/managed-by = &quot;terraform&quot;
    }
  }

  spec {
    replicas = 1

    selector {
      match_labels = {
        app.kubernetes.io/name = &quot;alb-ingress-controller&quot; 
      }
    }

    strategy {
      type = &quot;Recreate&quot;
    }

    template {
      metadata {
        labels = {
                app.kubernetes.io/name = &quot;alb-ingress-controller&quot; 
                app.kubernetes.io/version = &quot;v2.2.3&quot;
        }
      }

      spec {
        dns_policy                       = &quot;ClusterFirst&quot;
        restart_policy                   = &quot;Always&quot;
        service_account_name             = kubernetes_service_account.ingress.metadata[0].name
        termination_grace_period_seconds = 60

        container {
          name              = &quot;alb-ingress-controller&quot;
          image             = &quot;docker.io/amazon/aws-alb-ingress-controller:v2.2.3&quot;
          image_pull_policy = &quot;Always&quot;

          args = [
            &quot;--ingress-class=alb&quot;,
            &quot;--cluster-name=${local.k8s[var.env].esk_cluster_name}&quot;,
            &quot;--aws-vpc-id=${local.k8s[var.env].cluster_vpc}&quot;,
            &quot;--aws-region=${local.k8s[var.env].region}&quot;
          ]
          volume_mount {
            mount_path = &quot;/var/run/secrets/kubernetes.io/serviceaccount&quot;
            name       = kubernetes_service_account.ingress.default_secret_name
            read_only  = true
          }
        }
        volume {
          name = kubernetes_service_account.ingress.default_secret_name

          secret {
            secret_name = kubernetes_service_account.ingress.default_secret_name
          }
        }
      }
    }
  }

  depends_on = [kubernetes_cluster_role_binding.ingress]
}

resource &quot;kubernetes_ingress&quot; &quot;app&quot; {
  metadata {
    name      = &quot;owncloud-lb&quot;
    namespace = &quot;fargate-node&quot;
    annotations = {
      &quot;kubernetes.io/ingress.class&quot;           = &quot;alb&quot;
      &quot;alb.ingress.kubernetes.io/scheme&quot;      = &quot;internet-facing&quot;
      &quot;alb.ingress.kubernetes.io/target-type&quot; = &quot;ip&quot;
    }
    labels = {
      &quot;app&quot; = &quot;owncloud&quot;
    }
  }

  spec {
    backend {
      service_name = &quot;owncloud-service&quot;
      service_port = 80
    }
    rule {
      http {
        path {
          path = &quot;/&quot;
          backend {
            service_name = &quot;owncloud-service&quot;
            service_port = 80
          }
        }
      }
    }
  }
  depends_on = [kubernetes_service.app]
}
</code></pre>
<p>This works up to version <code>1.9</code> as required. As soon as I upgrade to version <code>2.2.3</code> the pod fails to update and on the pod get the following error:<code>{&quot;level&quot;:&quot;error&quot;,&quot;ts&quot;:1629207071.4385357,&quot;logger&quot;:&quot;setup&quot;,&quot;msg&quot;:&quot;unable to create controller&quot;,&quot;controller&quot;:&quot;TargetGroupBinding&quot;,&quot;error&quot;:&quot;no matches for kind \&quot;TargetGroupBinding\&quot; in version \&quot;elbv2.k8s.aws/v1beta1\&quot;&quot;}</code></p>
<p>I have read the update the doc and have amended the IAM policy as they state but they also mention:</p>
<blockquote>
<p>updating the TargetGroupBinding CRDs</p>
</blockquote>
<p>And that where I am not sure how to do that using terraform</p>
<p>If I try to do deploy on a new cluster (e.g not an upgrade from 1.9 I get the same error) I get the same error.</p>

alexis
<p>With your Terraform code, you apply an <code>Deployment</code> and an <code>Ingress</code> resource, but you must also add the <code>CustomResourceDefinitions</code> for the <code>TargetGroupBinding</code> custom resource.</p>
<p>This is described under &quot;Add Controller to Cluster&quot; in the <a href="https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.2/deploy/installation/" rel="noreferrer">Load Balancer Controller installation documentation</a> - with examples for Helm and Kubernetes Yaml provided.</p>
<p>Terraform has <a href="https://www.hashicorp.com/blog/beta-support-for-crds-in-the-terraform-provider-for-kubernetes" rel="noreferrer">beta support for applying CRDs</a> including an <a href="https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest#example-create-a-kubernetes-custom-resource-definition" rel="noreferrer">example of deploying CustomResourceDefinition</a>.</p>
