AWS Load Balancer Controller
The AWS Load Balancer Controller is a Kubernetes controller from AWS that watches Ingress and Service objects and provisions Application and Network Load Balancers to match. In the Web App Blueprint it is the reason no unit declares a load balancer: the chart declares an Ingress and the controller builds the ALB.
What it does
The controller runs in the cluster with AWS permissions. For each Ingress of class alb it creates a load balancer, listeners, target groups and security groups, and keeps them in step as pods come and go. Annotations on the Ingress choose the scheme, the certificate, the target type, health checks and grouping. Delete the Ingress and the ALB is deleted.
How BuiltForProd uses it
The alb-controller unit in acme-aws-blueprint-webapp-infra installs the aws-load-balancer-controller chart (version 3.4.0 from the EKS charts repository) into kube-system, with the cluster name, region and the VPC id read from /acme/usw2/dev/vpc/id. Its identity is an EKS Pod Identity role, acme-usw2-dev-aws-lbc-pod-id, built with the registry module terraform-aws-modules/eks-pod-identity/aws 2.9.0 and its attach_aws_lb_controller_policy option, so the controller carries exactly the AWS-published policy for this job and nothing more.
One Ingress drives it, the application's, from the chart in acme-aws-blueprint-webapp-gitops: internet-facing, target-type: ip, a single HTTPS listener on 443, health check /health on port 8080, and group.name: blueprint-app. The chart leaves ingress.certificateArn empty, so the controller discovers the ACM certificate by the Ingress host name.
Because targets are pod IP addresses, a load balancer can route to pods without node ports, and the chart's NetworkPolicy admits port 8080 from the stage VPC CIDR to let that traffic in. Ingress groups mean that another Ingress annotated with group.name: blueprint-app would share the API's ALB rather than create a new one.
The controller only creates the ALB. The DNS record for the Ingress host is written by ExternalDNS, and the WAF rules on the ALB come from Firewall Manager in the security account.
Terms you will see
| Term | Meaning |
|---|---|
| Ingress class | The value alb that tells this controller to act. |
| Annotation | An Ingress metadata entry that configures the ALB, such as scheme. |
| Target type | ip (pods) or instance (nodes); the platform uses ip. |
| Ingress group | Ingresses that share one load balancer. |
| Certificate discovery | Matching an ACM certificate to the Ingress host automatically. |
Where to read more
- Elastic Load Balancing for the ALB it creates
- EKS for the cluster it runs in
- ExternalDNS for the DNS side
- Web App Blueprint overview