AWS EKS部署ingress-nginx遇子网解析失败问题求助

问题背景 #

因AWS ALB不支持SSL透传，部署ingress-nginx后控制器出现如下错误：

Failed build model due to unable to resolve at least one subnet (0 match VPC and tags)

此前在AWS LB Ingress资源中，我曾用以下注解指定子网和安全组：

alb.ingress.kubernetes.io/subnets: APP-SUB-US-EAST-1A, APP-SUB-US-EAST-1B
alb.ingress.kubernetes.io/backend-protocol: HTTPS
alb.ingress.kubernetes.io/security-groups: sg-0fce858099

想确认ingress-nginx是否需要类似配置，或是遗漏了关键步骤。

环境信息 #

Ingress类详情

$ kubectl describe ingressclass
Name:         alb
Labels:       app.kubernetes.io/instance=aws-load-balancer-controller
              app.kubernetes.io/managed-by=Helm
              app.kubernetes.io/name=aws-load-balancer-controller
              app.kubernetes.io/version=v2.6.1
              helm.sh/chart=aws-load-balancer-controller-1.6.1
Annotations:  meta.helm.sh/release-name: aws-load-balancer-controller
              meta.helm.sh/release-namespace: kube-system
Controller:   ingress.k8s.aws/alb
Events:       <none>


Name:         nginx
Labels:       app.kubernetes.io/component=controller
              app.kubernetes.io/instance=ingress-nginx
              app.kubernetes.io/name=ingress-nginx
              app.kubernetes.io/part-of=ingress-nginx
              app.kubernetes.io/version=1.8.2
Annotations:  <none>
Controller:   k8s.io/ingress-nginx
Events:       <none>
Same issue if installing via helm with default ingress true:
Name:         nginx
Labels:       app.kubernetes.io/component=controller
              app.kubernetes.io/instance=ingress-nginx
              app.kubernetes.io/managed-by=Helm
              app.kubernetes.io/name=ingress-nginx
              app.kubernetes.io/part-of=ingress-nginx
              app.kubernetes.io/version=1.9.5
              helm.sh/chart=ingress-nginx-4.9.0
Annotations:  ingressclass.kubernetes.io/is-default-class: true
              meta.helm.sh/release-name: ingress-nginx
              meta.helm.sh/release-namespace: ingress-nginx
Controller:   k8s.io/ingress-nginx
Events:       <none>

ingress-nginx-controller服务错误详情

$ kubectl describe svc ingress-nginx-controller -n=ingress-nginx
Name:                     ingress-nginx-controller
Namespace:                ingress-nginx
Labels:                   app.kubernetes.io/component=controller
                          app.kubernetes.io/instance=ingress-nginx
                          app.kubernetes.io/managed-by=Helm
                          app.kubernetes.io/name=ingress-nginx
                          app.kubernetes.io/part-of=ingress-nginx
                          app.kubernetes.io/version=1.9.5
                          helm.sh/chart=ingress-nginx-4.9.0
Annotations:              meta.helm.sh/release-name: ingress-nginx
                          meta.helm.sh/release-namespace: ingress-nginx
Selector:                 app.kubernetes.io/component=controller,app.kubernetes.io/instance=ingress-nginx,app.kubernetes.io/name=ingress-nginx
Type:                     LoadBalancer
IP Family Policy:         SingleStack
IP Families:              IPv4
IP:                       172.20.34.107
IPs:                      172.20.34.107
Port:                     http  80/TCP
TargetPort:               http/TCP
NodePort:                 http  32519/TCP
Endpoints:                10.134.242.144:80
Port:                     https  443/TCP
TargetPort:               https/TCP
NodePort:                 https  31233/TCP
Endpoints:                10.134.242.144:443
Session Affinity:         None
External Traffic Policy:  Cluster
Events:
  Type     Reason            Age                 From     Message
  ----     ------            ----                ----     -------
  Warning  FailedBuildModel  3m (x11 over 154m)  service  Failed build model due to unable to resolve at least one subnet (0 match VPC and tags)

Helm安装命令

因同时部署了AWS ALB控制器，设置了默认IngressClass：

$ helm upgrade --install ingress-nginx ingress-nginx --repo https://kubernetes.github.io/ingress-nginx --namespace ingress-nginx --create-namespace --set controller.ingressClassResource.default=true

已配置的公有子网标签

kubernetes.io/role/elb  1
kubernetes.io/cluster/my-cluster    owned

解决方案 #

1. ingress-nginx指定子网和安全组的方式 #

ingress-nginx的LoadBalancer服务不使用ALB Ingress的注解格式，需用Kubernetes服务专属注解或Helm参数配置：

• 直接给ingress-nginx-controller服务添加注解：

  apiVersion: v1
  kind: Service
  metadata:
    name: ingress-nginx-controller
    namespace: ingress-nginx
    annotations:
      service.beta.kubernetes.io/aws-load-balancer-subnets: APP-SUB-US-EAST-1A, APP-SUB-US-EAST-1B
      service.beta.kubernetes.io/aws-load-balancer-security-groups: sg-0fce858099
  spec:
    # 其他原有配置...
  

• 或通过Helm安装时直接指定参数：

  helm upgrade --install ingress-nginx ingress-nginx --repo https://kubernetes.github.io/ingress-nginx --namespace ingress-nginx --create-namespace \
    --set controller.ingressClassResource.default=true \
    --set service.annotations."service\.beta\.kubernetes\.io/aws-load-balancer-subnets"="APP-SUB-US-EAST-1A,APP-SUB-US-EAST-1B" \
    --set service.annotations."service\.beta\.kubernetes\.io/aws-load-balancer-security-groups"="sg-0fce858099"
  

2. 检查子网标签与权限 #

• 确认子网的kubernetes.io/cluster/my-cluster标签值为owned，且子网、VPC属于当前EKS集群所在资源组
• 验证ingress-nginx控制器的IAM角色是否拥有ec2:DescribeSubnets、ec2:DescribeSecurityGroups等权限，确保能正常读取AWS网络资源
• 确认子网为公有子网（已关联互联网网关），且可用区覆盖集群节点所在可用区

3. 避免控制器冲突 #

若同时运行ALB控制器和ingress-nginx，需确保Ingress资源明确指定ingressClassName: nginx，防止控制器争抢资源。

内容的提问来源于stack exchange，提问作者paddock3d