<p>I created my kubernetes cluster using KubeSpray on AWS. Now I am trying to get the Ingress Controller to work. My understanding is that I need to apply  <a href="https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v0.34.1/deploy/static/provider/aws/deploy.yaml" rel="nofollow noreferrer">https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v0.34.1/deploy/static/provider/aws/deploy.yaml</a> which will create all the resources that I need including a network load balancer.</p>
<p>However, the LoadBalancer never comes out of pending status:</p>
<pre><code>$ kubectl -n ingress-nginx get svc
NAME                                 TYPE           CLUSTER-IP      EXTERNAL-IP   PORT(S)                      AGE
ingress-nginx-controller             LoadBalancer   10.233.28.147   &lt;pending&gt;     80:31304/TCP,443:31989/TCP   11m
ingress-nginx-controller-admission   ClusterIP      10.233.58.231   &lt;none&gt;        443/TCP                      11m
</code></pre>
<p>Describing the service does not seem to provide any interesting information.</p>
<pre><code>$ kubectl -n ingress-nginx describe service ingress-nginx-controller
Name:                     ingress-nginx-controller
Namespace:                ingress-nginx
Labels:                   app.kubernetes.io/component=controller
                          app.kubernetes.io/instance=ingress-nginx
                          app.kubernetes.io/managed-by=Helm
                          app.kubernetes.io/name=ingress-nginx
                          app.kubernetes.io/version=0.34.1
                          helm.sh/chart=ingress-nginx-2.11.1
Annotations:              kubectl.kubernetes.io/last-applied-configuration:
                            {&quot;apiVersion&quot;:&quot;v1&quot;,&quot;kind&quot;:&quot;Service&quot;,&quot;metadata&quot;:{&quot;annotations&quot;:{&quot;service.beta.kubernetes.io/aws-load-balancer-backend-protocol&quot;:&quot;tcp&quot;,&quot;serv...
                          service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
                          service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: 60
                          service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: true
                          service.beta.kubernetes.io/aws-load-balancer-type: nlb
Selector:                 app.kubernetes.io/component=controller,app.kubernetes.io/instance=ingress-nginx,app.kubernetes.io/name=ingress-nginx
Type:                     LoadBalancer
IP:                       10.233.28.147
Port:                     http  80/TCP
TargetPort:               http/TCP
NodePort:                 http  31304/TCP
Endpoints:                10.233.97.22:80
Port:                     https  443/TCP
TargetPort:               https/TCP
NodePort:                 https  31989/TCP
Endpoints:                10.233.97.22:443
Session Affinity:         None
External Traffic Policy:  Local
HealthCheck NodePort:     30660
Events:                   &lt;none&gt;
</code></pre>
<p>How can this issue be debugged?</p>
<p>UPDATE:</p>
<p>The output of <code>kubectl -n kube-system logs -l component=kube-controller-manager</code> is:</p>
<pre><code>E0801 21:12:29.429759       1 job_controller.go:793] pods &quot;ingress-nginx-admission-create-&quot; is forbidden: error looking up service account ingress-nginx/ingress-nginx-admission: serviceaccount &quot;ingress-nginx-admission&quot; not found
E0801 21:12:29.429788       1 job_controller.go:398] Error syncing job: pods &quot;ingress-nginx-admission-create-&quot; is forbidden: error looking up service account ingress-nginx/ingress-nginx-admission: serviceaccount &quot;ingress-nginx-admission&quot; not found
I0801 21:12:29.429851       1 event.go:278] Event(v1.ObjectReference{Kind:&quot;Job&quot;, Namespace:&quot;ingress-nginx&quot;, Name:&quot;ingress-nginx-admission-create&quot;, UID:&quot;4faad8c5-9b1e-4c23-a942-94be181d590f&quot;, APIVersion:&quot;batch/v1&quot;, ResourceVersion:&quot;1506255&quot;, FieldPath:&quot;&quot;}): type: 'Warning' reason: 'FailedCreate' Error creating: pods &quot;ingress-nginx-admission-create-&quot; is forbidden: error looking up service account ingress-nginx/ingress-nginx-admission: serviceaccount &quot;ingress-nginx-admission&quot; not found
E0801 21:12:29.483485       1 job_controller.go:793] pods &quot;ingress-nginx-admission-patch-&quot; is forbidden: error looking up service account ingress-nginx/ingress-nginx-admission: serviceaccount &quot;ingress-nginx-admission&quot; not found
E0801 21:12:29.483512       1 job_controller.go:398] Error syncing job: pods &quot;ingress-nginx-admission-patch-&quot; is forbidden: error looking up service account ingress-nginx/ingress-nginx-admission: serviceaccount &quot;ingress-nginx-admission&quot; not found
I0801 21:12:29.483679       1 event.go:278] Event(v1.ObjectReference{Kind:&quot;Job&quot;, Namespace:&quot;ingress-nginx&quot;, Name:&quot;ingress-nginx-admission-patch&quot;, UID:&quot;92ee0e43-2711-4b37-9fd6-958ef3c95b31&quot;, APIVersion:&quot;batch/v1&quot;, ResourceVersion:&quot;1506257&quot;, FieldPath:&quot;&quot;}): type: 'Warning' reason: 'FailedCreate' Error creating: pods &quot;ingress-nginx-admission-patch-&quot; is forbidden: error looking up service account ingress-nginx/ingress-nginx-admission: serviceaccount &quot;ingress-nginx-admission&quot; not found
I0801 21:12:39.436590       1 event.go:278] Event(v1.ObjectReference{Kind:&quot;Job&quot;, Namespace:&quot;ingress-nginx&quot;, Name:&quot;ingress-nginx-admission-create&quot;, UID:&quot;4faad8c5-9b1e-4c23-a942-94be181d590f&quot;, APIVersion:&quot;batch/v1&quot;, ResourceVersion:&quot;1506255&quot;, FieldPath:&quot;&quot;}): type: 'Normal' reason: 'SuccessfulCreate' Created pod: ingress-nginx-admission-create-85x58
I0801 21:12:39.489303       1 event.go:278] Event(v1.ObjectReference{Kind:&quot;Job&quot;, Namespace:&quot;ingress-nginx&quot;, Name:&quot;ingress-nginx-admission-patch&quot;, UID:&quot;92ee0e43-2711-4b37-9fd6-958ef3c95b31&quot;, APIVersion:&quot;batch/v1&quot;, ResourceVersion:&quot;1506257&quot;, FieldPath:&quot;&quot;}): type: 'Normal' reason: 'SuccessfulCreate' Created pod: ingress-nginx-admission-patch-sn8xv
I0801 21:12:41.448425       1 event.go:278] Event(v1.ObjectReference{Kind:&quot;Job&quot;, Namespace:&quot;ingress-nginx&quot;, Name:&quot;ingress-nginx-admission-create&quot;, UID:&quot;4faad8c5-9b1e-4c23-a942-94be181d590f&quot;, APIVersion:&quot;batch/v1&quot;, ResourceVersion:&quot;1506297&quot;, FieldPath:&quot;&quot;}): type: 'Normal' reason: 'Completed' Job completed
I0801 21:12:42.481264       1 event.go:278] Event(v1.ObjectReference{Kind:&quot;Job&quot;, Namespace:&quot;ingress-nginx&quot;, Name:&quot;ingress-nginx-admission-patch&quot;, UID:&quot;92ee0e43-2711-4b37-9fd6-958ef3c95b31&quot;, APIVersion:&quot;batch/v1&quot;, ResourceVersion:&quot;1506304&quot;, FieldPath:&quot;&quot;}): type: 'Normal' reason: 'Completed' Job completed
</code></pre>
<p>I do have the PodSecurityPolicy admission controller enabled. I updated the <code>deploy.yaml</code> file with the following changes.</p>
<ul>
<li>Add the following to all ClusterRole and Role resources.</li>
</ul>
<pre><code>- apiGroups:      [policy]
  resources:      [podsecuritypolicies]
  resourceNames:  [privileged]
  verbs:          [use]
</code></pre>
<ul>
<li>Add the following to the end of the file.</li>
</ul>
<pre><code>---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    helm.sh/chart: ingress-nginx-2.11.1
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/version: 0.34.1
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller
  name: ingress-nginx
  namespace: ingress-nginx
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: ingress-nginx
subjects:
  - kind: ServiceAccount
    name: ingress-nginx
    namespace: default
</code></pre>
<p><strong>Question Responses:</strong></p>
<ul>
<li><p>The IAM roles were created by the ansible playbooks in the Kubespray <code>contrib/terraform/aws</code> directory.</p>
</li>
<li><p>A classic load balancer was created for the apiserver by those ansible scripts.</p>
</li>
</ul>

David Medinets
<p>I have two answers to this question.</p>
<p><strong>one</strong> - add the <code>cloud-provider</code> option to your <code>ansible-playbook</code> command as shown below.</p>
<pre><code>ansible-playbook \
  -vvvvv \
  -i ./inventory/hosts \
  ./cluster.yml \
  -e ansible_user=centos \
  -e cloud_provider=aws \
  -e bootstrap_os=centos \
  --become \
  --become-user=root \
  --flush-cache \
  -e ansible_ssh_private_key_file=$PKI_PRIVATE_PEM \
  | tee kubespray-cluster-$(date &quot;+%Y-%m-%d_%H:%M&quot;).log
</code></pre>
<p><strong>two</strong></p>
<p>Uncomment the cloud_provider option in group_vars/all.yml and set it to 'aws'</p>
<p><strong>proof</strong></p>
<p>I've tried the first answer.</p>
<pre><code>$ kubectl -n ingress-nginx get svc
NAME                                 TYPE           CLUSTER-IP      EXTERNAL-IP                                                                     PORT(S)                      AGE
ingress-nginx-controller             LoadBalancer   10.233.57.196   aa....amazonaws.com   80:32111/TCP,443:31854/TCP   109s
ingress-nginx-controller-admission   ClusterIP      10.233.11.133   &lt;none&gt;                                                                          443/TCP                      109s
</code></pre>
