Load Balancer Controller & Ingress Patterns
Share one ALB across many Ingresses with IngressGroup, target pods directly, and terminate TLS at the edge cleanly.
The AWS Load Balancer Controller does far more than turn an Ingress into an ALB. A few patterns separate a tidy setup from a sprawling, expensive one.
Share one ALB with IngressGroup
By default each Ingress spins up its own ALB — and each ALB costs money and burns subnet IPs. The alb.ingress.kubernetes.io/group.name annotation lets multiple Ingress objects (even across namespaces) merge onto a single ALB, with group.order controlling rule priority. One load balancer, many teams.
Target pods, not nodes
Set target-type: ip so the ALB registers pod IPs directly (courtesy of the VPC CNI), skipping the extra NodePort hop and its kube-proxy indirection. It also means health checks reflect real pod health.
TLS and redirects at the edge
- Attach an ACM certificate with
certificate-arnand let the ALB terminate TLS — your pods stay plain HTTP. - Add a small
ssl-redirectaction so port 80 permanently redirects to 443. - Use
healthcheck-pathto point at a real readiness endpoint, not/.
NLB for L4
For non-HTTP or ultra-low-latency traffic, a Service of type LoadBalancer with the NLB annotations gives you a Network Load Balancer with the same IP-target trick.
Example
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: api
annotations:
alb.ingress.kubernetes.io/scheme: internet-facing
alb.ingress.kubernetes.io/target-type: ip
alb.ingress.kubernetes.io/group.name: shared-public
alb.ingress.kubernetes.io/group.order: "20"
alb.ingress.kubernetes.io/listen-ports: '[{"HTTP":80},{"HTTPS":443}]'
alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-1:111122223333:certificate/abc-123
alb.ingress.kubernetes.io/ssl-redirect: "443"
alb.ingress.kubernetes.io/healthcheck-path: /healthz
spec:
ingressClassName: alb
rules:
- host: api.example.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: api
port: { number: 80 }When to use it
- A platform team uses IngressGroup to share one ALB across 15 microservice Ingresses, reducing monthly ALB costs from $270 to $18.
- A security team configures target-type: ip on ALB Ingresses to route directly to pod IPs, eliminating double NAT and enabling exact pod-level security group enforcement.
- A multi-tenant SaaS uses wildcard host rules on a single ALB Ingress to route *.tenant.example.com to a tenant-routing service without creating one Ingress per tenant.
More examples
Shared ALB with IngressGroup
Uses the alb.ingress.kubernetes.io/group.name annotation so multiple Ingress objects share the same ALB instance, reducing load balancer costs.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: api-ingress
annotations:
kubernetes.io/ingress.class: alb
alb.ingress.kubernetes.io/group.name: prod-alb
alb.ingress.kubernetes.io/group.order: "10"
alb.ingress.kubernetes.io/scheme: internet-facing
spec:
rules:
- host: api.example.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: api-svc
port:
number: 80IP target type with readiness gate
Routes ALB traffic directly to pod IPs with a 30-second deregistration delay so in-flight connections complete before a pod is removed.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: api-ingress
annotations:
alb.ingress.kubernetes.io/target-type: ip
alb.ingress.kubernetes.io/target-group-attributes: deregistration_delay.timeout_seconds=30
spec:
rules:
- host: api.example.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: api-svc
port:
number: 80Check ALB provisioning status
Shows the ALB provisioning events and retrieves the ALB hostname once the Load Balancer Controller has finished creating it.
kubectl describe ingress api-ingress | grep -A5 'Events\|Address'
kubectl get ingress api-ingress \
-o jsonpath='{.status.loadBalancer.ingress[0].hostname}'
Discussion