部署alb-ingress-controller时子网自动发现失败求助

错误信息 #

{"level":"error","ts":1676886565.8192506,"logger":"controller-runtime.manager.controller.ingress","msg":"Reconciler error","name":"revaturepro-qa3-alb-ingress-controller","namespace":"qa3","error":"couldn't auto-discover subnets: unable to discover at least one subnet"}

已提供配置 #

ServiceAccount #

apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/name: aws-load-balancer-controller
  name: aws-load-balancer-controller
  namespace: kube-system

IAM策略 #

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "acm:DescribeCertificate",
                "acm:ListCertificates",
                "acm:GetCertificate"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:CreateSecurityGroup",
                "ec2:CreateTags",
                "ec2:DeleteTags",
                "ec2:DeleteSecurityGroup",
                "ec2:DescribeAccountAttributes",
                "ec2:DescribeAddresses",
                "ec2:DescribeInstances",
                "ec2:DescribeInstanceStatus",
                "ec2:DescribeInternetGateways",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:DescribeTags",
                "ec2:DescribeVpcs",
                "ec2:ModifyInstanceAttribute",
                "ec2:ModifyNetworkInterfaceAttribute",
                "ec2:RevokeSecurityGroupIngress"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "elasticloadbalancing:AddListenerCertificates",
                "elasticloadbalancing:AddTags",
                "elasticloadbalancing:CreateListener",
                "elasticloadbalancing:CreateLoadBalancer",
                "elasticloadbalancing:CreateRule",
                "elasticloadbalancing:CreateTargetGroup",
                "elasticloadbalancing:DeleteListener",
                "elasticloadbalancing:DeleteLoadBalancer",
                "elasticloadbalancing:DeleteRule",
                "elasticloadbalancing:DeleteTargetGroup",
                "elasticloadbalancing:DeregisterTargets",
                "elasticloadbalancing:DescribeListenerCertificates",
                "elasticloadbalancing:DescribeListeners",
                "elasticloadbalancing:DescribeLoadBalancers",
                "elasticloadbalancing:DescribeLoadBalancerAttributes",
                "elasticloadbalancing:DescribeRules",
                "elasticloadbalancing:DescribeSSLPolicies",
                "elasticloadbalancing:DescribeTags",
                "elasticloadbalancing:DescribeTargetGroups",
                "elasticloadbalancing:DescribeTargetGroupAttributes",
                "elasticloadbalancing:DescribeTargetHealth",
                "elasticloadbalancing:ModifyListener",
                "elasticloadbalancing:ModifyLoadBalancerAttributes",
                "elasticloadbalancing:ModifyRule",
                "elasticloadbalancing:ModifyTargetGroup",
                "elasticloadbalancing:ModifyTargetGroupAttributes",
                "elasticloadbalancing:RegisterTargets",
                "elasticloadbalancing:RemoveListenerCertificates",
                "elasticloadbalancing:RemoveTags",
                "elasticloadbalancing:SetIpAddressType",
                "elasticloadbalancing:SetSecurityGroups",
                "elasticloadbalancing:SetSubnets",
                "elasticloadbalancing:SetWebACL"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:CreateServiceLinkedRole",
                "iam:GetServerCertificate",
                "iam:ListServerCertificates"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "cognito-idp:DescribeUserPoolClient"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "waf-regional:GetWebACLForResource",
                "waf-regional:GetWebACL",
                "waf-regional:AssociateWebACL",
                "waf-regional:DisassociateWebACL"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "tag:GetResources",
                "tag:TagResources"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "waf:GetWebACL"
            ],
            "Resource": "*"
        }
    ]
}

排查步骤 #

1. 确认ServiceAccount与IAM角色绑定关系 #

你的ServiceAccount部署在kube-system命名空间，需确认该ServiceAccount是否正确关联了拥有上述IAM策略的IAM角色（通过IRSA、kube2iam等方式）。如果绑定失效，控制器将无法调用AWS API查询子网信息。

2. 检查子网标签是否符合自动发现规则 #

ALB控制器默认通过标签筛选可用子网：

• 公网子网：需带有标签kubernetes.io/role/elb: 1或kubernetes.io/role/elb: ""
• 内网子网：需带有标签kubernetes.io/role/internal-elb: 1或kubernetes.io/role/internal-elb: ""
  若Ingress配置了alb.ingress.kubernetes.io/scheme: internal，控制器只会筛选内网子网；否则优先查找公网子网。确保对应类型的子网存在且标签配置正确。

3. 验证控制器是否指向正确VPC #

如果集群所在环境存在多个VPC，需确认ALB控制器部署时是否通过--cluster-vpc-id参数指定了集群所属的VPC ID。未指定的话，控制器可能查询到其他VPC的子网，但不符合集群要求。

4. 检查子网可用性状态 #

登录AWS控制台，确认目标VPC下的子网处于Available状态，未被删除或标记为不可用。

5. 验证IAM权限实际生效情况 #

在控制器Pod中执行AWS CLI命令测试权限：

kubectl exec -n kube-system <alb-controller-pod-name> -- aws ec2 describe-subnets --filters "Name=vpc-id,Values=<your-cluster-vpc-id>"

若返回空结果或权限错误，说明权限配置存在问题（比如IRSA角色未正确关联、IAM策略未生效）。

6. 检查Ingress资源的子网指定配置 #

如果Ingress资源通过alb.ingress.kubernetes.io/subnets指定了子网ID，需确认这些子网存在且属于集群VPC，同时控制器有权限访问。

内容的提问来源于stack exchange，提问作者Sayeda Fathima