From ce7f491608f0db3bbf50924a2130139f091e9ce0 Mon Sep 17 00:00:00 2001 From: arcegal Date: Fri, 4 Sep 2026 17:33:40 +0000 Subject: [PATCH] fix(troubleshooting): substitute $INBOUND_CIDRS when applying alb ingress The troubleshooting/alb setup applied the ui ingress via a plain 'kubectl apply -k', so the 'alb.ingress.kubernetes.io/inbound-cidrs: $INBOUND_CIDRS' annotation was stored as a literal string. The AWS Load Balancer Controller then failed model-building on every reconcile with 'invalid CIDR address: $INBOUND_CIDRS', so the ALB was never created -- masking the intended subnet-tag (alb_fix_1) and IAM (alb_fix_5) scenarios and leaving alb_fix_5 Step 4 unable to show an ALB hostname. Apply the ingress through envsubst using the module's inbound_cidrs variable (mirroring how alb_fix_7 applies fix_ingress) so a valid CIDR is baked in at setup. The backend service-ui / ui-app selector issues are left untouched for alb_fix_7. Verified on a local deployment: after prepare-environment the annotation holds a real CIDR, the documented subnet/IAM errors surface as intended, and alb_fix_5 Step 4 returns an ALB hostname. --- .../troubleshooting/alb/.workshop/terraform/main.tf | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/manifests/modules/troubleshooting/alb/.workshop/terraform/main.tf b/manifests/modules/troubleshooting/alb/.workshop/terraform/main.tf index 9cd9c3aff7..89dd9bdfeb 100644 --- a/manifests/modules/troubleshooting/alb/.workshop/terraform/main.tf +++ b/manifests/modules/troubleshooting/alb/.workshop/terraform/main.tf @@ -113,8 +113,14 @@ resource "null_resource" "kustomize_app" { always_run = timestamp() } + # The ingress carries an `alb.ingress.kubernetes.io/inbound-cidrs` annotation + # templated as `$INBOUND_CIDRS`. Substitute it here (from the module's + # inbound_cidrs variable) so the AWS Load Balancer Controller receives a valid + # CIDR. Without substitution the controller fails model-building with + # "invalid CIDR address: $INBOUND_CIDRS" and never provisions the ALB, which + # masks the intended subnet-tag (alb_fix_1) and IAM (alb_fix_5) scenarios. provisioner "local-exec" { - command = "kubectl apply -k ~/environment/eks-workshop/modules/troubleshooting/alb/creating-alb" + command = "kubectl kustomize ~/environment/eks-workshop/modules/troubleshooting/alb/creating-alb | INBOUND_CIDRS='${var.inbound_cidrs}' envsubst '$INBOUND_CIDRS' | kubectl apply -f -" when = create }