<p>So I have an EKS cluster, and have set up the AWS Alb Ingress Controller:</p>

<p><a href="https://github.com/kubernetes-sigs/aws-alb-ingress-controller" rel="nofollow noreferrer">https://github.com/kubernetes-sigs/aws-alb-ingress-controller</a></p>

<p>I'm trying to set up Grafana here, and the Ingress is created but it doesn't seem to resolve at all.</p>

<p>I have the follow Ingress:</p>

<pre><code>$ kubectl describe ingress grafana
Name:             grafana
Namespace:        orbix-mvp
Address:          4ae1e4ba-orbixmvp-grafana-fd7d-993303634.eu-central-1.elb.amazonaws.com
Default backend:  default-http-backend:80 (&lt;none&gt;)
Rules:
  Host                        Path  Backends
  ----                        ----  --------
  grafana-orbix.orbixpay.com  
                              /   grafana:80 (&lt;none&gt;)
Annotations:
  alb.ingress.kubernetes.io/scheme:         internet-facing
  alb.ingress.kubernetes.io/ssl-policy:     ELBSecurityPolicy-2016-08
  alb.ingress.kubernetes.io/subnets:        subnet-08431d96168e36c30,subnet-0e2a7e2766852bf8a
  alb.ingress.kubernetes.io/success-codes:  302
  kubernetes.io/ingress.class:              alb
Events:
  Type    Reason  Age   From                    Message
  ----    ------  ----  ----                    -------
  Normal  CREATE  45m   alb-ingress-controller  LoadBalancer 4ae1e4ba-orbixmvp-grafana-fd7d created, ARN: arn:aws:elasticloadbalancing:eu-central-1:109153834985:loadbalancer/app/4ae1e4ba-orbixmvp-grafana-fd7d/4b98cb7027b71697
  Normal  CREATE  45m   alb-ingress-controller  rule 1 created with conditions [{    Field: "host-header",    Values: ["grafana-orbix.orbixpay.com"]  },{    Field: "path-pattern",    Values: ["/"]  }]
</code></pre>

<p>The backend fro it is the following service:</p>

<pre><code>$ kubectl describe service grafana
Name:                     grafana
Namespace:                orbix-mvp
Labels:                   app=grafana
                          chart=grafana-1.25.1
                          heritage=Tiller
                          release=grafana
Annotations:              &lt;none&gt;
Selector:                 app=grafana,release=grafana
Type:                     NodePort
IP:                       172.20.11.232
Port:                     service  80/TCP
TargetPort:               3000/TCP
NodePort:                 service  30772/TCP
Endpoints:                10.0.0.180:3000
Session Affinity:         None
External Traffic Policy:  Cluster
Events:                   &lt;none&gt;
</code></pre>

<p>It does have a proper endpoint:</p>

<pre><code>$ kubectl get endpoints | grep grafana
grafana                         10.0.0.180:3000                  46m
</code></pre>

<p>The pod itself is properly tagged and has the correct IP that's the endpoint above:</p>

<pre><code>$ kubectl describe pod grafana-bdc977fd4-ptzhg
Name:               grafana-bdc977fd4-ptzhg
Namespace:          orbix-mvp
Priority:           0
PriorityClassName:  &lt;none&gt;
Node:               ip-10-0-0-230.eu-central-1.compute.internal/10.0.0.230
Start Time:         Mon, 11 Feb 2019 13:24:43 +0200
Labels:             app=grafana
                    pod-template-hash=687533980
                    release=grafana
Annotations:        &lt;none&gt;
Status:             Running
IP:                 10.0.0.180
</code></pre>

<p>My AWS account has the LoadBalancer listed as Active, the subnets are on the same VPC as the cluster, security groups are being generated by the Ingress Controller.</p>

<p>Everything seems to be set up properly, however when I access the LoadBalancer address, it just times out.</p>

<pre><code>$ kubectl get ingresses
NAME                HOSTS                           ADDRESS                                                                     PORTS   AGE
grafana             grafana-orbix.orbixpay.com      4ae1e4ba-orbixmvp-grafana-fd7d-993303634.eu-central-1.elb.amazonaws.com     80      49m
</code></pre>

Neekoy
<p>I actually figured it out - the Ingress configuration was allowing for traffic for the domain only. That <em>excludes</em> traffic to the load balancer address (which I assumed is allowed by default).</p>

<p>Basically it needs to be allowed for * in order for the Load Balancer URL to work too. Also, if the app redirects to <code>/login</code> like in my case, all paths need to be allowed too, since that redirect doesn't work if the path specified is for <code>/</code> only.</p>
