<p>I have an EKS cluster created with <code>eksctl</code>, with two unmanaged nodegroups. <code>ingress-nginx</code> and <code>cluster-autoscaler</code> are deployed and working. <code>ingress-nginx</code> controller has created a Classic LoadBalancer upon deployment.</p>
<p>When either NodeGroup scales up, its instances are added to the LB. (question: <em>what</em> takes this action? It's not the ASG itself, so I assume it's <code>ingress-nginx</code> doing this). Additionally, I see that all instances (from both ASGs) are responding as &quot;healthy&quot; to the TCP healthcheck on the LoadBalancer.</p>
<p>The problem: I need to only whitelist <strong>one</strong> of the node groups as being eligible for load balancing. The other ASG (and any future ASGs, by default), are batch workers which do not host any internet services, and no web service pods will be ever scheduled on them.</p>
<p>Is this possible to achieve in EKS, and how?</p>

ebr
<p>You are right, that's the default behavior of Kubernetes <code>LoadBalancer</code> services like Nginx Ingress. <code>LoadBalancer</code> under the hood uses <code>NodePort</code> service which is exposed on ALL cluster nodes regardless of EKS node group they belong to.</p>
<p>What you should do is to add <code>externalTrafficPolicy: Local</code> to your Nginx Ingress <code>LoadBalancer</code> like that (this is just an example):</p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  name: example-service
spec:
  selector:
    app: example
  ports:
    - port: 8765
      targetPort: 9376
  externalTrafficPolicy: Local
  type: LoadBalancer
</code></pre>
<p>Doing that will cause AWS Load Balancer to target only those nodes who actually run Nginx Ingress pods. After that you may want to use Nginx Ingress <code>nodeSelector</code> to run only on desired EKS node group.</p>
