<p>Within my AWS EKS cluster provisioning an AWS application load balancer using annotations on the Ingress object. Additionally an unnecessary classic load balancer is being provisioned. Any ideas or best practice on how to prevent this?</p>
<pre><code>resource &quot;kubernetes_service&quot; &quot;api&quot; {
  metadata {
     name = &quot;${var.project_prefix}-api-service&quot;
  }
  spec {
    selector = {
      app = &quot;${var.project_prefix}-api&quot;
    }
    port {
      name = &quot;http&quot;
      port        = 80
      target_port = 1337
    }
    port {
      name = &quot;https&quot;
      port = 443
      target_port = 1337
    }
    type = &quot;LoadBalancer&quot;
  }
}

resource &quot;kubernetes_ingress&quot; &quot;api&quot; {
  wait_for_load_balancer = true
  metadata {
    name = &quot;${var.project_prefix}-api&quot;
    annotations = {
      &quot;kubernetes.io/ingress.class&quot; = &quot;alb&quot;
      &quot;alb.ingress.kubernetes.io/scheme&quot; = &quot;internet-facing&quot;
      &quot;alb.ingress.kubernetes.io/target-type&quot; = &quot;instance&quot;
      &quot;alb.ingress.kubernetes.io/certificate-arn&quot; = local.api-certificate_arn
      &quot;alb.ingress.kubernetes.io/load-balancer-name&quot; = &quot;${var.project_prefix}-api&quot;
      &quot;alb.ingress.kubernetes.io/listen-ports&quot; = &quot;[{\&quot;HTTP\&quot;: 80}, {\&quot;HTTPS\&quot;:443}]&quot;
      &quot;alb.ingress.kubernetes.io/actions.ssl-redirect&quot; = &quot;{\&quot;Type\&quot;: \&quot;redirect\&quot;, \&quot;RedirectConfig\&quot;: { \&quot;Protocol\&quot;: \&quot;HTTPS\&quot;, \&quot;Port\&quot;: \&quot;443\&quot;, \&quot;StatusCode\&quot;: \&quot;HTTP_301\&quot;}}&quot;
    }
  }
  spec {
    backend {
      service_name = kubernetes_service.api.metadata.0.name
      service_port = 80
    }
    rule {
      http {
        path {
          path = &quot;/*&quot;
           backend {
            service_name = &quot;ssl-redirect&quot;
            service_port = &quot;use-annotation&quot;
          }
        }
      }
     }
  }
}
</code></pre>

florianmaxim
<p>Your LoadBalancer service is responsible for deploying the classic load balancer, and if you just need an application load balancer, is unnecessary.</p>
<pre><code>resource &quot;kubernetes_service&quot; &quot;api&quot; {
  metadata {
     name = &quot;${var.project_prefix}-api-service&quot;
  }
  spec {
    selector = {
      app = &quot;${var.project_prefix}-api&quot;
    }
    port {
      name = &quot;http&quot;
      port        = 80
      target_port = 1337
    }
    port {
      name = &quot;https&quot;
      port = 443
      target_port = 1337
    }
    type = &quot;ClusterIP&quot; # See comments below
  }
}

resource &quot;kubernetes_ingress&quot; &quot;api&quot; {
  wait_for_load_balancer = true
  metadata {
    name = &quot;${var.project_prefix}-api&quot;
    annotations = {
      &quot;kubernetes.io/ingress.class&quot; = &quot;alb&quot;
      &quot;alb.ingress.kubernetes.io/target-type&quot; = &quot;ip&quot; # See comments below
      &quot;alb.ingress.kubernetes.io/scheme&quot; = &quot;internet-facing&quot;
      &quot;alb.ingress.kubernetes.io/target-type&quot; = &quot;instance&quot;
      &quot;alb.ingress.kubernetes.io/certificate-arn&quot; = local.api-certificate_arn
      &quot;alb.ingress.kubernetes.io/load-balancer-name&quot; = &quot;${var.project_prefix}-api&quot;
      &quot;alb.ingress.kubernetes.io/listen-ports&quot; = &quot;[{\&quot;HTTP\&quot;: 80}, {\&quot;HTTPS\&quot;:443}]&quot;
      &quot;alb.ingress.kubernetes.io/actions.ssl-redirect&quot; = &quot;{\&quot;Type\&quot;: \&quot;redirect\&quot;, \&quot;RedirectConfig\&quot;: { \&quot;Protocol\&quot;: \&quot;HTTPS\&quot;, \&quot;Port\&quot;: \&quot;443\&quot;, \&quot;StatusCode\&quot;: \&quot;HTTP_301\&quot;}}&quot;
    }
  }
  spec {
    backend {
      service_name = kubernetes_service.api.metadata.0.name
      service_port = 80
    }
    rule {
      http {
        path {
          path = &quot;/*&quot;
           backend {
            service_name = &quot;ssl-redirect&quot;
            service_port = &quot;use-annotation&quot;
          }
        }
      }
     }
  }
}
</code></pre>
<h2>Traffic Modes</h2>
<p>Depending on your cluster and networking setup, you might be able to use <code>ip</code> target type, where the load balancer can communicate directly with Kubernetes pods via their IP (so <code>ClusterIP</code> service types are fine) if you have a CNI configuration, or use <code>instance</code> in conjunction with <code>NodePort</code> service types as the load balancer cannot directly access the pod IPs. Some relevant links below:</p>
<p><a href="https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/guide/ingress/annotations/#target-type" rel="nofollow noreferrer">ALB Target Types</a></p>
<p><a href="https://github.com/aws/amazon-vpc-cni-k8s" rel="nofollow noreferrer">VPC CNI EKS Plugin</a></p>
<h2>Load Balancer Types</h2>
<p>Some relevant links regarding Kubernetes load balancing and EKS load balancers. Note that Ingress resources are layer 7 and load balance service resources are layer 4, hence ALBs deployed for EKS ingress resources and NLBs for load balanced service resources:</p>
<p><a href="https://rancher.com/docs/rancher/v2.5/en/k8s-in-rancher/load-balancers-and-ingress/load-balancers/" rel="nofollow noreferrer">Rancher Kubernetes Load Balancers</a></p>
<p><a href="https://aws.amazon.com/elasticloadbalancing/features/" rel="nofollow noreferrer">AWS Load Balancer Comparison</a></p>
