### Install lbc-migrate on PATH

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress2gateway/lbc_migrate_reference/

Installs the lbc-migrate binary to your PATH by creating a symlink, so future make lbc-migrate rebuilds are picked up automatically.

```bash
make install-lbc-migrate
```

--------------------------------

### Output before target registration

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/deploy/pod_readiness_gate/

Example output of 'kubectl get pod -o wide' when the readiness gate is not yet ready (0/1).

```text
NAME                          READY   STATUS    RESTARTS   AGE   IP         NODE                       READINESS GATES
nginx-test-5744b9ff84-7ftl9   1/1     Running   0          81s   10.1.2.3   ip-10-1-2-3.ec2.internal   0/1
```

--------------------------------

### Output after target registration

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/deploy/pod_readiness_gate/

Example output of 'kubectl get pod -o wide' when the target is registered and healthy, showing the readiness gate as 1/1.

```text
NAME                          READY   STATUS    RESTARTS   AGE   IP         NODE                       READINESS GATES
nginx-test-5744b9ff84-7ftl9   1/1     Running   0          81s   10.1.2.3   ip-10-1-2-3.ec2.internal   1/1
```

--------------------------------

### Build and install lbc-migrate CLI

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress2gateway/migrate_from_ingress/

Commands to build the lbc-migrate CLI from the aws-load-balancer-controller repo and optionally install it on your PATH.

```bash
# Build from the aws-load-balancer-controller repo
make lbc-migrate

# (Optional) Install on your PATH
make install-lbc-migrate
```

--------------------------------

### Expected external-dns startup logs

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/integrations/external_dns/

Example log output showing the configuration and successful Kubernetes client creation.

```log
time="2019-12-11T10:26:05Z" level=info msg="config: {Master: KubeConfig: RequestTimeout:30s IstioIngressGateway:istio-system/istio-ingressgateway Sources:[service ingress] Namespace: AnnotationFilter: FQDNTemplate: CombineFQDNAndAnnotation:false Compatibility: PublishInternal:false PublishHostIP:false ConnectorSourceServer:localhost:8080 Provider:aws GoogleProject: DomainFilter:[test-dns.com] ZoneIDFilter:[] AlibabaCloudConfigFile:/etc/kubernetes/alibaba-cloud.json AlibabaCloudZoneType: AWSZoneType:public AWSAssumeRole: AWSBatchChangeSize:4000 AWSBatchChangeInterval:1s AWSEvaluateTargetHealth:true AzureConfigFile:/etc/kubernetes/azure.json AzureResourceGroup: CloudflareProxied:false InfobloxGridHost: InfobloxWapiPort:443 InfobloxWapiUsername:admin InfobloxWapiPassword: InfobloxWapiVersion:2.3.1 InfobloxSSLVerify:true DynCustomerName: DynUsername: DynPassword: DynMinTTLSeconds:0 OCIConfigFile:/etc/kubernetes/oci.yaml InMemoryZones:[] PDNSServer:http://localhost:8081 PDNSAPIKey: PDNSTLSEnabled:false TLSCA: TLSClientCert: TLSClientCertKey: Policy:upsert-only Registry:txt TXTOwnerID:my-identifier TXTPrefix: Interval:1m0s Once:false DryRun:false LogFormat:text MetricsAddress::7979 LogLevel:info TXTCacheInterval:0s ExoscaleEndpoint:https://api.exoscale.ch/dns ExoscaleAPIKey: ExoscaleAPISecret: CRDSourceAPIVersion:externaldns.k8s.io/v1alpha CRDSourceKind:DNSEndpoint ServiceTypeFilter:[] RFC2136Host: RFC2136Port:0 RFC2136Zone: RFC2136Insecure:false RFC2136TSIGKeyName: RFC2136TSIGSecret: RFC2136TSIGSecretAlg: RFC2136TAXFR:false}"
time="2019-12-11T10:26:05Z" level=info msg="Created Kubernetes client https://10.100.0.1:443"
```

--------------------------------

### Combined TCP/UDP Gateway and UDPRoute example

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/gateway/l4gateway/

YAML manifests for a Gateway with TCP and UDP listeners on the same port (80) and a UDPRoute that references the UDP listener. This setup creates a TCP_UDP listener on the NLB, and each attached route generates a TCP_UDP target group.

```yaml
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: my-tcp-udp-gateway
  namespace: tcp-udp
spec:
  gatewayClassName: aws-nlb-gateway-class
  listeners:
    - allowedRoutes:
        namespaces:
          from: Same
      name: tcp-app
      port: 80
      protocol: TCP
    - allowedRoutes:
        namespaces:
          from: Same
      name: udp-app
      port: 80
      protocol: UDP
---
apiVersion: gateway.networking.k8s.io/v1
kind: UDPRoute
metadata:
  name: my-udp-app-route
  namespace: tcp-udp
spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: my-tcp-udp-gateway
      sectionName: udp-app
  rules:
    - backendRefs:
        - group: ""
          kind: Service
          name: udpechoserver
          port: 8080
          weight: 1

```

--------------------------------

### Example load balancer ARN output

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/use_cases/self_managed_lb/

Example output from the create-load-balancer command, showing the ARN format for a network load balancer.

```text
arn:aws:elasticloadbalancing:us-east-2:123456789012:loadbalancer/net/my-load-balancer/1234567890123456
```

--------------------------------

### Apply full YAML spec

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/deploy/installation/

Applies the downloaded full YAML manifest to install the controller.

```bash
kubectl apply -f v3_6_0_full.yaml
```

--------------------------------

### Complete Kubernetes Example for ALB Target Optimizer

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress/alb-target-agent/

A minimal working example that sets up a Namespace, Deployment with an init container running the target-control-agent, a Service, and an Ingress. The agent listens on data port 80 and control port 3000, forwards traffic to the echo server on 8080, and the Ingress annotation specifies the control port. Target type must be 'ip' for target control functionality.

```yaml
apiVersion: v1
kind: Namespace
metadata:
  name: alb-target-control-example
---
apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: alb-target-control-example
  name: echo-app
spec:
  replicas: 2
  selector:
    matchLabels:
      app: echo-app
  template:
    metadata:
      labels:
        app: echo-app
    spec:
      containers:
        - name: echo-server
          image: k8s.gcr.io/e2e-test-images/echoserver:2.5
          ports:
            - containerPort: 8080
      initContainers:
        - name: alb-target-control-agent
          image: public.ecr.aws/aws-elb/target-optimizer/target-control-agent:latest
          imagePullPolicy: Always
          restartPolicy: Always
          env:
            - name: TARGET_CONTROL_DATA_ADDRESS
              value: "0.0.0.0:80" # Agent listens on port 80 for data
            - name: TARGET_CONTROL_CONTROL_ADDRESS
              value: "0.0.0.0:3000" # Agent listens on port 3000 for control
            - name: TARGET_CONTROL_DESTINATION
              value: "127.0.0.1:8080" # Forward to echo server
            - name: TARGET_CONTROL_MAX_CONCURRENCY
              value: "100"
          ports:
            - containerPort: 80 # Data port
            - containerPort: 3000 # Control port
---
apiVersion: v1
kind: Service
metadata:
  namespace: alb-target-control-example
  name: echo-service
spec:
  selector:
    app: echo-app
  ports:
    - port: 80
      targetPort: 80 # Target agent's data port
      protocol: TCP
  type: NodePort
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  namespace: alb-target-control-example
  name: echo-ingress
  annotations:
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip # Required for target control
    alb.ingress.kubernetes.io/target-control-port.echo-service.80: "3000" # Must match agent control port
spec:
  ingressClassName: alb
  rules:
    - http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: echo-service
                port:
                  number: 80

```

--------------------------------

### Expected controller startup log output

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/examples/echo_server/

Example of the log output that should be displayed after running the verification command. It shows the controller version, webhook registration, and manager startup.

```log
{"level":"info","ts":1602778062.2588625,"logger":"setup","msg":"version","GitVersion":"v2.0.0-rc3-13-gcdc8f715-dirty","GitCommit":"cdc8f715919cc65ca8161b6083c4091222632d6b","BuildDate":"2020-10-15T15:58:31+0000"}
{"level":"info","ts":1602778065.4515743,"logger":"controller-runtime.metrics","msg":"metrics server is starting to listen","addr":":8080"}
{"level":"info","ts":1602778065.4536595,"logger":"controller-runtime.webhook","msg":"registering webhook","path":"/mutate-v1-pod"}
{"level":"info","ts":1602778065.4537156,"logger":"controller-runtime.webhook","msg":"registering webhook","path":"/mutate-elbv2-k8s-aws-v1beta1-targetgroupbinding"}
{"level":"info","ts":1602778065.4537542,"logger":"controller-runtime.webhook","msg":"registering webhook","path":"/validate-elbv2-k8s-aws-v1beta1-targetgroupbinding"}
{"level":"info","ts":1602778065.4537594,"logger":"setup","msg":"starting manager"}
I1015 16:07:45.453851       1 leaderelection.go:242] attempting to acquire leader lease  kube-system/aws-load-balancer-controller-leader...
{"level":"info","ts":1602778065.5544264,"logger":"controller-runtime.manager","msg":"starting metrics server","path":"/metrics"}
{"level":"info","ts":1602778065.5544496,"logger":"controller-runtime.webhook.webhooks","msg":"starting webhook server"}
{"level":"info","ts":1602778065.5549548,"logger":"controller-runtime.certwatcher","msg":"Updated current TLS certificate"}
{"level":"info","ts":1602778065.5550802,"logger":"controller-runtime.webhook","msg":"serving webhook server","host":"","port":9443}
{"level":"info","ts":1602778065.5551715,"logger":"controller-runtime.certwatcher","msg":"Starting certificate watcher"}
I1015 16:08:03.662023       1 leaderelection.go:252] successfully acquired lease kube-system/aws-load-balancer-controller-leader
{"level":"info","ts":1602778083.663017,"logger":"controller-runtime.controller","msg":"Starting EventSource","controller":"targetGroupBinding","source":"kind source: /, Kind="}
{"level":"info","ts":1602778083.6631303,"logger":"controller-runtime.controller","msg":"Starting EventSource","controller":"targetGroupBinding","source":"kind source: /, Kind="}
{"level":"info","ts":1602778083.6633205,"logger":"controller-runtime.controller","msg":"Starting EventSource","controller":"ingress","source":"channel source: 0xc0007340f0"}
{"level":"info","ts":1602778083.6633654,"logger":"controller-runtime.controller","msg":"Starting EventSource","controller":"ingress","source":"channel source: 0xc000734140"}
{"level":"info","ts":1602778083.6633892,"logger":"controller-runtime.controller","msg":"Starting EventSource","controller":"ingress","source":"kind source: /, Kind="}
{"level":"info","ts":1602778083.663441,"logger":"controller-runtime.controller","msg":"Starting EventSource","controller":"ingress","source":"kind source: /, Kind="}
{"level":"info","ts":1602778083.6634624,"logger":"controller-runtime.controller","msg":"Starting EventSource","controller":"ingress","source":"kind source: /, Kind="}
{"level":"info","ts":1602778083.6635776,"logger":"controller-runtime.controller","msg":"Starting EventSource","controller":"service","source":"kind source: /, Kind="}
{"level":"info","ts":1602778083.6636262,"logger":"controller-runtime.controller","msg":"Starting Controller","controller":"service"}
{"level":"info","ts":1602778083.7634695,"logger":"controller-runtime.controller","msg":"Starting EventSource","controller":"targetGroupBinding","source":"kind source: /, Kind="}
{"level":"info","ts":1602778083.7637022,"logger":"controller-runtime.controller","msg":"Starting workers","controller":"service","worker count":3}
{"level":"info","ts":1602778083.7641861,"logger":"controller-runtime.controller","msg":"Starting Controller","controller":"ingress"}
{"level":"info","ts":1602778083.8641882,"logger":"controller-runtime.controller","msg":"Starting Controller","controller":"targetGroupBinding"}
{"level":"info","ts":1602778083.864236,"logger":"controller-runtime.controller","msg":"Starting workers","controller":"targetGroupBinding","worker count":3}
{"level":"info","ts":1602778083.8643816,"logger":"controller-runtime.controller","msg":"Starting workers","controller":"ingress","worker count":3}
```

--------------------------------

### Verify external-dns deployment

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/integrations/external_dns/

Streams logs from the external-dns pod to confirm it started successfully.

```bash
kubectl logs -f $(kubectl get po | egrep -o 'external-dns[A-Za-z0-9-]+')
```

--------------------------------

### Expected output of describe ingress

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/examples/echo_server/

Example output from the describe command showing the ingress details, including the ALB DNS name and events.

```text
Name:                   echoserver
Namespace:              echoserver
Address:                joshcalico-echoserver-echo-2ad7-1490890749.us-east-2.elb.amazonaws.com
Default backend:        default-http-backend:80 (10.2.1.28:8080)
Rules:
  Host                          Path    Backends
  ----                          ----    --------
  *
                                    /       echoserver:80 (<none>)
Annotations:
Events:
  FirstSeen     LastSeen        Count   From                    SubObjectPath   Type            Reason  Message
  ---------     --------        -----   ----                    -------------   --------        ------  -------
  3m            3m              1       ingress-controller                      Normal          CREATE  Ingress echoserver/echoserver
  3m            32s             3       ingress-controller                      Normal          UPDATE  Ingress echoserver/echoserver
```

--------------------------------

### BYOIP Configuration Example

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/globalaccelerator/aga-controller/

Specify your own IP addresses in the `ipAddresses` field of the GlobalAccelerator resource. This is a creation-only feature; IP addresses cannot be updated after accelerator creation.

```yaml
spec:
  ipAddressType: IPV4
  ipAddresses:
    - "198.51.100.10"  # Your own IP from BYOIP pool
```

--------------------------------

### Enable Feature Gates via Helm Parameters

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/globalaccelerator/installation/

Sets the same feature gates using Helm parameters when installing or upgrading the controller.

```bash
--set controllerConfig.featureGates.GlobalAcceleratorController=true --set controllerConfig.featureGates.EnableRGTAPI=true
```

--------------------------------

### Sample TargetGroupBinding YAML for Cross-Account

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/targetgroupbinding/targetgroupbinding/

Example TargetGroupBinding for managing a TargetGroup in a different AWS account. Uses iamRoleArnToAssume and assumeRoleExternalId for cross-account access.

```yaml
apiVersion: elbv2.k8s.aws/v1beta1
kind: TargetGroupBinding
metadata:
  name: peered-tg
  namespace: nlb-game-2048-1
spec:
  assumeRoleExternalId: very-secret-string-2
  iamRoleArnToAssume: arn:aws:iam::155642222660:role/tg-management-role
  networking:
    ingress:
    - from:
      - securityGroup:
          groupID: sg-0b6a41a2fd959623f
      ports:
      - port: 80
        protocol: TCP
  serviceRef:
    name: service-2048
    port: 80
  targetGroupARN: arn:aws:elasticloadbalancing:us-west-2:155642222660:targetgroup/peered-tg/6a4ecf7bfae473c1
```

--------------------------------

### service.beta.kubernetes.io/aws-load-balancer-internal annotation example

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/service/annotations/

Deprecated starting v2.2.0 in favor of aws-load-balancer-scheme. In case of ties, aws-load-balancer-scheme gets precedence.

```yaml
service.beta.kubernetes.io/aws-load-balancer-internal: "true"
```

--------------------------------

### service.beta.kubernetes.io/aws-load-balancer-scheme annotation example

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/service/annotations/

Specifies whether the NLB is internet-facing or internal. Valid values are internal and internet-facing. Default is internal.

```yaml
service.beta.kubernetes.io/aws-load-balancer-scheme: "internet-facing"
```

--------------------------------

### Create and label namespace for QUIC example

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/use_cases/quic/

Creates a namespace named 'quic-example' and labels it with 'elbv2.k8s.aws/quic-server-id-inject=enabled' to enable server ID injection into pod environment variables. Only pods annotated with 'service.beta.kubernetes.io/aws-load-balancer-quic-enabled-containers' will have server IDs injected.

```bash
kubectl create ns quic-example
kubectl label namespace quic-example elbv2.k8s.aws/quic-server-id-inject=enabled
```

--------------------------------

### Check Installed AWSALBIngressController Version

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/deploy/upgrade/migrate_v1_v2/

Command to determine the existing installed AWSALBIngressController version by inspecting the deployment image. Example output shows version v1.1.9.

```bash
foo@bar:~$ kubectl describe deployment  -n kube-system  alb-ingress-controller | grep Image
    Image:      docker.io/amazon/aws-alb-ingress-controller:v1.1.9
```

--------------------------------

### Apply echoserver namespace, service, and deployment

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/examples/echo_server/

Deploys all echoserver resources (namespace, service, deployment) from the AWS Load Balancer Controller v3.6.0 examples.

```bash
kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v3.6.0/docs/examples/echoservice/echoserver-namespace.yaml &&\
kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v3.6.0/docs/examples/echoservice/echoserver-service.yaml &&\
kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v3.6.0/docs/examples/echoservice/echoserver-deployment.yaml
```

--------------------------------

### Run lbc-migrate to translate Ingress to Gateway API

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress2gateway/migrate_from_ingress/

Quick start commands for lbc-migrate: from YAML files, from a directory, or from a live cluster. The --from-cluster option is recommended for best results as it automatically fetches referenced Services, IngressClass, etc.

```bash
# From YAML files
lbc-migrate -f ingress.yaml --output-dir ./gw/

# From a directory of manifests
lbc-migrate --input-dir ./k8s-manifests/ --output-dir ./gw/

# From a live cluster (recommended — automatically fetches referenced Services, IngressClass, etc.)
lbc-migrate --from-cluster --namespaces production --output-dir ./gw/
```

--------------------------------

### Create and label a namespace for pod readiness gate injection

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/deploy/pod_readiness_gate/

Commands to create a namespace named 'readiness' and label it with 'elbv2.k8s.aws/pod-readiness-gate-inject=enabled'. The output shows the namespace being created and labeled, and the describe output confirming the label.

```bash
$ kubectl create namespace readiness
namespace/readiness created

$ kubectl label namespace readiness elbv2.k8s.aws/pod-readiness-gate-inject=enabled
namespace/readiness labeled

$ kubectl describe namespace readiness
Name:         readiness
Labels:       elbv2.k8s.aws/pod-readiness-gate-inject=enabled
Annotations:  <none>
Status:       Active
```

--------------------------------

### service.beta.kubernetes.io/aws-load-balancer-security-group-prefix-lists annotation example

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/service/annotations/

Specifies managed prefix lists allowed to access the NLB. Ignored if aws-load-balancer-security-groups is specified. Ensure security group rule quota is sufficient.

```yaml
service.beta.kubernetes.io/aws-load-balancer-security-group-prefix-lists: pl-00000000, pl-1111111
```

--------------------------------

### Verify GlobalAccelerator CRD Installation

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/globalaccelerator/installation/

Checks that the GlobalAccelerator CRD is installed by listing CRDs and filtering for the expected name.

```bash
kubectl get crd | grep globalaccelerators.aga.k8s.aws
```

--------------------------------

### lbc-migrate: From live cluster (all namespaces)

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress2gateway/lbc_migrate_reference/

Fetches resources from a live cluster across all namespaces and generates Gateway API output.

```bash
lbc-migrate --from-cluster --all-namespaces --output-dir ./gateway-output/
```

--------------------------------

### Controller log output for created listener rule

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/examples/echo_server/

Example log output from the ingress controller showing a created listener rule and successful deployment of the model.

```json
{"level":"info","ts":1602803967.7160048,"logger":"controllers.ingress","msg":"created listener rule","stackID":"echoserver/echoserver","resourceID":"80:1","arn":"arn:aws:elasticloadbalancing:us-west-2:019453415603:listener-rule/app/k8s-echoserv-echoserv-d4d6bd65d0/4b4ebe8d6e1ef0c1/6e13477f9d840da0/23ef859380e792e8"}
{"level":"info","ts":1602803967.8484688,"logger":"controllers.ingress","msg":"successfully deployed model","ingressGroup":"echoserver/echoserver"}
```

--------------------------------

### Verify controller deployment with kubectl logs

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/examples/echo_server/

Run this command to check the controller logs and verify the deployment was successful. The output should show version information and startup messages.

```bash
kubectl logs -n kube-system --tail -1 -l app.kubernetes.io/name=aws-load-balancer-controller
```

--------------------------------

### Example target group ARN output

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/use_cases/self_managed_lb/

Example output from the create-target-group command, showing the ARN format for a target group.

```text
arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/1234567890123456
```

--------------------------------

### lbc-migrate: From live cluster (multiple namespaces)

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress2gateway/lbc_migrate_reference/

Fetches resources from multiple namespaces (team-a, team-b) in a live cluster.

```bash
lbc-migrate --from-cluster --namespaces team-a,team-b --output-dir ./gateway-output/
```

--------------------------------

### Deploy gRPC server ingress with kubectl apply

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/examples/grpc_server/

Applies the customized ingress manifest to create the ingress resource. Wait a few minutes for the ALB to provision and DNS to update.

```bash
kubectl apply -f grpcserver-ingress.yaml
```

--------------------------------

### Expected output of eksctl get cluster

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/examples/echo_server/

Shows the expected output from the eksctl get cluster command, including subnet IDs.

```text
NAME                        VERSION STATUS         CREATED          VPC                     SUBNETS                             SECURITYGROUPS
exciting-gopher-1534270749  1.10    ACTIVE  2018-08-14T18:20:32Z    vpc-0aa01b07b3c922c9c   subnet-05e1c98ed0f5b109e,subnet-07f5bb81f661df61b,subnet-0a4e6232630820516  sg-05ceb5eee9fd7cac4
```

--------------------------------

### Helm install without IRSA

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/deploy/installation/

Installs the AWS Load Balancer Controller using Helm for clusters not using IRSA. Only the cluster name is required.

```bash
helm install aws-load-balancer-controller eks/aws-load-balancer-controller -n kube-system --set clusterName=<cluster-name>
```

--------------------------------

### Launch migration console with lbc-migrate

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress2gateway/in_cluster_console/

Starts the migration console. By default it binds to http://localhost:8080 and operates cluster-wide using the current kubeconfig context. Use --port to bind to a different port.

```bash
lbc-migrate --console
# or bind to a different port
lbc-migrate --console --port 9000
```

--------------------------------

### kubectl apply -R -f ./gw/

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress2gateway/lbc_migrate_reference/

Apply all generated resources recursively from the output directory.

```bash
kubectl apply -R -f ./gw/
```

--------------------------------

### Install standard Gateway API CRDs

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/gateway/gateway/

Required command to install the standard Gateway API CRDs (v1.6.0) using kubectl apply with server-side apply.

```bash
kubectl apply --server-side=true -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.0/standard-install.yaml
```

--------------------------------

### Install LBC Gateway API specific CRDs

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/gateway/gateway/

Required command to install the AWS Load Balancer Controller Gateway API specific CRDs from the main branch.

```bash
kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/refs/heads/main/config/crd/gateway/gateway-crds.yaml
```

--------------------------------

### Set slow start duration to 30 seconds target group attribute

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress/annotations/

Sets the slow start duration to 30 seconds. Available range is 30-900 seconds.

```yaml
alb.ingress.kubernetes.io/target-group-attributes: slow_start.duration_seconds=30
```

--------------------------------

### Build lbc-migrate from source

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress2gateway/lbc_migrate_reference/

Builds the lbc-migrate binary from the root of the aws-load-balancer-controller repo. Requires Go. The binary is placed at bin/lbc-migrate.

```bash
# From the root of the aws-load-balancer-controller repo
make lbc-migrate
```

--------------------------------

### Run lbc-migrate with go run

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress2gateway/lbc_migrate_reference/

Runs lbc-migrate directly without building a binary, using go run from the repository root.

```bash
go run ./cmd/lbc-migrate/ [flags]
```

--------------------------------

### Install TargetGroupBinding CRDs for helm upgrade

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/deploy/installation/

Downloads and applies the TargetGroupBinding CRDs when upgrading the controller via helm upgrade. The helm install command automatically applies CRDs, but helm upgrade does not.

```bash
wget https://raw.githubusercontent.com/aws/eks-charts/master/stable/aws-load-balancer-controller/crds/crds.yaml
kubectl apply -f crds.yaml
```

--------------------------------

### Deploy gRPC server manifests with kubectl apply

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/examples/grpc_server/

Apply the namespace, service, and deployment manifests for the gRPC server from the official GitHub repository. Run these commands in sequence to create the required resources in your cluster.

```bash
kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/main/docs/examples/grpc/grpcserver-namespace.yaml
kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/main/docs/examples/grpc/grpcserver-service.yaml
kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/main/docs/examples/grpc/grpcserver-deployment.yaml
```

--------------------------------

### Helm install with IRSA

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/deploy/installation/

Installs the AWS Load Balancer Controller using Helm for clusters with IAM Roles for Service Accounts (IRSA). Sets the cluster name and uses an existing service account.

```bash
helm install aws-load-balancer-controller eks/aws-load-balancer-controller -n kube-system --set clusterName=<cluster-name> --set serviceAccount.create=false --set serviceAccount.name=aws-load-balancer-controller
```

--------------------------------

### Custom throttle config example for ELBv2 calls

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/deploy/configurations/

Example of specifying client-side throttling for ELBv2 calls via the --aws-api-throttle flag. It sets a rate limit for RegisterTargets and DeregisterTargets operations and a general limit for all other ELBv2 operations.

```text
--aws-api-throttle=Elastic Load Balancing v2:RegisterTargets|DeregisterTargets=4:20,Elastic Load Balancing v2:.*=10:40
```

--------------------------------

### Blue-Green Deployment with Endpoint Weights

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/globalaccelerator/examples/

Configures a GlobalAccelerator with two Service endpoints (blue and green) using weights to gradually shift traffic. Blue gets 200 weight (80%) and green gets 50 weight (20%) for incremental rollout.

```yaml
apiVersion: aga.k8s.aws/v1beta1
kind: GlobalAccelerator
metadata:
  name: blue-green-accelerator
  namespace: default
spec:
  name: "blue-green-accelerator"
  ipAddressType: IPV4
  listeners:
    - protocol: TCP
      portRanges:
        - fromPort: 80
          toPort: 80
        - fromPort: 443
          toPort: 443
      endpointGroups:
        - endpoints:
            # Blue environment (current stable version)
            - type: Service
              name: blue-service
              weight: 200  # 80% of traffic (200/250) - stable version gets majority

            # Green environment (new version being deployed)
            - type: Service
              name: green-service
              weight: 50   # 20% of traffic (50/250) - new version gets smaller portion for testing
```

--------------------------------

### lbc-migrate: From live cluster (specific namespace)

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress2gateway/lbc_migrate_reference/

Fetches resources from a single namespace (production) in a live cluster.

```bash
lbc-migrate --from-cluster --namespaces production --output-dir ./gateway-output/
```

--------------------------------

### Example Ingress Manifest for AWS Load Balancer Controller

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress/spec/

An example ingress resource that uses the `alb` ingress class and routes traffic to a NodePort service. The host field specifies the Route 53-managed domain. The controller does not support the `resource` field of `backend`.

```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: "2048-ingress"
  namespace: "2048-game"
  labels:
    app: 2048-nginx-ingress
spec:
  ingressClassName: alb
  rules:
    - host: 2048.example.com
      http:
        paths:
          - path: /*
            pathType: ImplementationSpecific
            backend:
              service:
                name: "service-2048"
                port:
                  number: 80
```

--------------------------------

### IngressClassParams with subnets.ids

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress/ingress_class/

Example IngressClassParams that specifies subnets by their IDs.

```yaml
apiVersion: elbv2.k8s.aws/v1beta1
kind: IngressClassParams
metadata:
  name: awesome-class
spec:
  subnets:
    ids:
    - subnet-xxx
    - subnet-123

```

--------------------------------

### lbc-migrate: Missing resource warnings

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress2gateway/lbc_migrate_reference/

Example stderr output when file-based input is missing referenced resources. The tool still generates output, but warns about missing Service and IngressClass resources.

```text
WARNING: Ingress "default/my-ingress" references Service "api-service"
  but it was not provided. Service-level annotation overrides may be missing.

WARNING: Ingress "default/my-ingress" uses IngressClass "alb"
  but it was not provided. IngressClassParams overrides may be missing.

Tip: Use --from-cluster to automatically read all referenced resources,
     or include Service/IngressClass/IngressClassParams files in your input.
```

--------------------------------

### IngressClassParams with wafv2AclName

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress/ingress_class/

Example IngressClassParams that associates a WAFv2 ACL by name.

```yaml
apiVersion: elbv2.k8s.aws/v1beta1
kind: IngressClassParams
metadata:
  name: class2048-config
spec:
  wafv2AclName: "web-acl-name-1"

```

--------------------------------

### Output of readiness gate reason check

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/deploy/pod_readiness_gate/

Example output showing the pod's status conditions, including the message 'Initial health checks in progress' and reason 'Elb.InitialHealthChecking'.

```text
status:
  conditions:
  - lastProbeTime: null
    lastTransitionTime: null
    message: Initial health checks in progress
    reason: Elb.InitialHealthChecking
    status: "True"
    type: target-health.elbv2.k8s.aws/k8s-readines-perf1000-7848e5026b
```

--------------------------------

### IngressClassParams with targetType

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress/ingress_class/

Example IngressClassParams that sets the target type to 'ip'.

```yaml
apiVersion: elbv2.k8s.aws/v1beta1
kind: IngressClassParams
metadata:
  name: class2048-config
spec:
  targetType: ip

```

--------------------------------

### lbc-migrate --split=namespace command

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress2gateway/lbc_migrate_reference/

Run lbc-migrate with --split=namespace to generate one file per namespace plus a cluster-scoped file. The output directory is ./gw/.

```bash
lbc-migrate --from-cluster --all-namespaces --output-dir ./gw/ --split=namespace
```

--------------------------------

### IngressClassParams with certificateArn

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress/ingress_class/

Example IngressClassParams that specifies a list of certificate ARNs.

```yaml
apiVersion: elbv2.k8s.aws/v1beta1
kind: IngressClassParams
metadata:
name: class2048-config
spec:
  certificateArn: ['arn:aws:acm:us-east-1:123456789:certificate/test-arn-1','arn:aws:acm:us-east-1:123456789:certificate/test-arn-2']

```

--------------------------------

### Discover via Ingress rule host - YAML example

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress/cert_discovery/

This Ingress resource uses the `host` field in a rule to attach a certificate for `dev.example.com` or `*.example.com` to the ALB. It requires the `alb.ingress.kubernetes.io/listen-ports` annotation to enable HTTPS on port 443.

```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  namespace: default
  name: ingress
  annotations:
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
spec:
  ingressClassName: alb
  rules:
  - host: dev.example.com
    http:
      paths:
      - path: /users
        pathType: Prefix
        backend:
          service:
            name: user-service
            port:
              number: 80
```

--------------------------------

### IngressClassParams with IngressGroup

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress/ingress_class/

Example IngressClassParams that sets the IngressGroup name to 'my-group'.

```yaml
apiVersion: elbv2.k8s.aws/v1beta1
kind: IngressClassParams
metadata:
  name: awesome-class
spec:
  group:
    name: my-group

```

--------------------------------

### Discover via Ingress tls - YAML example

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress/cert_discovery/

This Ingress resource uses the `tls` field to attach a certificate for `www.example.com` to the ALB. It requires the `alb.ingress.kubernetes.io/listen-ports` annotation to enable HTTPS on port 443.

```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  namespace: default
  name: ingress
  annotations:
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
spec:
  ingressClassName: alb
  tls:
  - hosts:
    - www.example.com
  rules:
  - http:
      paths:
      - path: /users
        pathType: Prefix
        backend:
          service:
            name: user-service
            port:
              number: 80
```

--------------------------------

### IngressClassParams with IPv4IPAMPoolId

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress/ingress_class/

Example IngressClassParams that configures an IPAM pool ID for IPv4.

```yaml
apiVersion: elbv2.k8s.aws/v1beta1
kind: IngressClassParams
metadata:
  name: class2048-config
spec:
  ipamConfiguration:
    ipv4IPAMPoolId: ipam-pool-000000000

```

--------------------------------

### IngressClassParams with sslRedirectPort

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress/ingress_class/

Example IngressClassParams that sets the SSL redirect port to '443'.

```yaml
apiVersion: elbv2.k8s.aws/v1beta1
kind: IngressClassParams
metadata:
  name: class2048-config
spec:
  sslRedirectPort: '443'

```

--------------------------------

### IngressClassParams with namespaceSelector

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress/ingress_class/

Example IngressClassParams that selects namespaces with label 'team: team-a'.

```yaml
apiVersion: elbv2.k8s.aws/v1beta1
kind: IngressClassParams
metadata:
  name: awesome-class
spec:
  namespaceSelector:
    matchLabels:
      team: team-a

```

--------------------------------

### ListenerConfiguration with QUIC enabled

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/gateway/loadbalancerconfig/

Configures UDP and TCP_UDP listeners with QUIC protocol support enabled.

```yaml
apiVersion: gateway.k8s.aws/v1
kind: LoadBalancerConfiguration
metadata:
  name: example-config
  namespace: echoserver
spec:
  listenerConfigurations:
    - protocolPort: UDP:80
      quicEnabled: true
    - protocolPort: TCP_UDP:443
      quicEnabled: true
```

--------------------------------

### IngressClassParams with loadBalancerName

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress/ingress_class/

Example IngressClassParams that sets a custom load balancer name to 'name-1'.

```yaml
apiVersion: elbv2.k8s.aws/v1beta1
kind: IngressClassParams
metadata:
  name: awesome-class
spec:
  loadBalancerName: name-1

```

--------------------------------

### lbc-migrate: From live cluster (single Ingress)

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress2gateway/lbc_migrate_reference/

Fetches a specific Ingress (my-api) from the production namespace in a live cluster.

```bash
lbc-migrate --from-cluster --namespaces production --ingress-name my-api --output-dir ./gateway-output/
```

--------------------------------

### Run greeter client to test gRPC service

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/examples/grpc_server/

Runs the greeter client in a Docker container to test the secure gRPC service. Substitute YOUR_DOMAIN_NAME with the domain used in the ingress manifest. The expected response is 'Greeter client received: Hello, you!'.

```bash
docker run --rm -it --env BACKEND=YOUR_DOMAIN_NAME placeexchange/grpc-demo:latest python greeter_client.py
```

--------------------------------

### Confirm gRPC server resources with kubectl get

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/examples/grpc_server/

Verify that all resources (pod, service, deployment, replicaset) were created successfully in the grpcserver namespace. The expected output shows the pod running, the ClusterIP service, and the deployment with one replica.

```bash
kubectl get -n grpcserver all
```

--------------------------------

### Apply GlobalAccelerator CRD

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/globalaccelerator/installation/

Installs the GlobalAccelerator Custom Resource Definition (CRD) from the official repository.

```bash
kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/refs/heads/main/config/crd/aga/aga.k8s.aws_globalaccelerators.yaml
```

--------------------------------

### Install ALBTargetControlConfig CRD

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress/alb-target-agent/

Applies the ALBTargetControlConfig custom resource definition from the controller's GitHub repository.

```bash
kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/refs/heads/main/config/crd/bases/elbv2.k8s.aws_albtargetcontrolconfigs.yaml
```

--------------------------------

### Set NLB scheme annotation

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress/annotations/

Specifies the scheme for the Network Load Balancer. Example sets it to internet-facing.

```yaml
alb.ingress.kubernetes.io/frontend-nlb-scheme: internet-facing
```

--------------------------------

### Expected response from greeter client

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/examples/grpc_server/

Shows the expected output from the greeter client, confirming the gRPC service is working.

```text
Greeter client received: Hello, you!
```

--------------------------------

### Health Check Path Annotations

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress/annotations/

Specifies the HTTP path for health checks, with examples for HTTP and gRPC.

```yaml
alb.ingress.kubernetes.io/healthcheck-path: /ping
```

```yaml
alb.ingress.kubernetes.io/healthcheck-path: /package.service/method
```

--------------------------------

### IngressClassParams with minimumLoadBalancerCapacity.capacityUnits

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress/ingress_class/

Example IngressClassParams that sets the minimum load balancer capacity to 1000 capacity units.

```yaml
apiVersion: elbv2.k8s.aws/v1beta1
kind: IngressClassParams
metadata:
  name: class2048-config
spec:
  minimumLoadBalancerCapacity:
    capacityUnits: 1000

```

--------------------------------

### Add source IP routing condition with ListenerRuleConfiguration and HTTPRoute

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/gateway/customization/

This example adds a routing rule that only allows requests from 10.0.0.0/5 to be routed to the backend. It includes a ListenerRuleConfiguration resource and an updated HTTPRoute that references it via an ExtensionRef filter.

```yaml
# source-ip-condition.yaml
apiVersion: gateway.k8s.aws/v1
kind: ListenerRuleConfiguration
metadata:
  name: custom-rule-config-source-ip
  namespace: example-ns
spec:
  conditions:
    - field: source-ip
      sourceIPConfig:
        values:
          - 10.0.0.0/5
---
# updated-http-route.yaml
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: my-http-app-route
  namespace: example-ns
spec:
  parentRefs:
  - group: gateway.networking.k8s.io
    kind: Gateway
    name: my-alb-gateway
    sectionName: http
  - group: gateway.networking.k8s.io
    kind: Gateway
    name: my-alb-gateway
    sectionName: https
  rules:
  - backendRefs:
    - name: <your service>
      port: <your service port>
    filters:
      - type: ExtensionRef
        extensionRef:
          group: "gateway.k8s.aws"
          kind: "ListenerRuleConfiguration"
          name: "custom-rule-config-source-ip"
```

--------------------------------

### IngressClassParams with subnets.tags

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress/ingress_class/

Example IngressClassParams that selects subnets by tags, including a role tag and custom tags.

```yaml
apiVersion: elbv2.k8s.aws/v1beta1
kind: IngressClassParams
metadata:
  name: class2048-config
spec:
  subnets:
  tags:
    kubernetes.io/role/internal-elb:
    - "1"
    myKey:
    - myVal0
    - myVal1

```

--------------------------------

### Create IAM OIDC provider with eksctl

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/deploy/installation/

Command to create an IAM OIDC provider for your cluster. Skip if you already have one.

```bash
eksctl utils associate-iam-oidc-provider \
    --region <region-code> \
    --cluster <your-cluster-name> \
    --approve
```

--------------------------------

### Retrieve NLB DNS name

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/use_cases/quic/

Use kubectl to get the hostname of the quic-service service in the quic-example namespace.

```bash
kubectl -n quic-example get svc quic-service -o yaml | grep 'hostname:'
```

--------------------------------

### Get cluster subnets with eksctl

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/examples/echo_server/

Retrieves cluster information including subnets to use for the ingress annotation.

```bash
eksctl get cluster exciting-gopher-1534270749
```

--------------------------------

### Custom NodeSelector in TargetGroupBinding

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/targetgroupbinding/targetgroupbinding/

Example TargetGroupBinding CR with a custom nodeSelector. This selector is merged with the default node selector above.

```yaml
apiVersion: elbv2.k8s.aws/v1beta1
kind: TargetGroupBinding
metadata:
  name: my-tgb
spec:
  nodeSelector:
    matchLabels:
      foo: bar
  ...
```

--------------------------------

### List echoserver resources

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/examples/echo_server/

Lists the deployments and services in the echoserver namespace to verify they were created.

```bash
kubectl get -n echoserver deploy,svc
```

--------------------------------

### Enable frontend NLB annotation

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress/annotations/

Set this annotation to 'true' to enable the frontend NLB feature. The controller provisions an NLB and registers the ALB as its target. Provisioning can take up to 3-4 minutes if enabled at ingress creation.

```yaml
alb.ingress.kubernetes.io/enable-frontend-nlb: "true"
```

--------------------------------

### Set health check path annotation

Source: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress/annotations/

Specifies the destination path for health checks. Example sets it to /health.

```yaml
alb.ingress.kubernetes.io/frontend-nlb-healthcheck-path: /health
```