EKS Subnet Tags and Load Balancer Placement

EKS Subnet Tags and Load Balancer Placement An architecture diagram generated by Archify. AWS Load Balancer Controller · Discovers subnets by tag · Architecture component AWS Load Balancer Controller Discovers subnets by tag Public subnets (AZ-a, AZ-b) · kubernetes.io/role/elb: 1 · Architecture component Public subnets (AZ-a, AZ-b) kubernetes.io/role/elb: 1 Private subnets (AZ-a, AZ-b) · kubernetes.io/role/internal-elb: 1 · Architecture component Private subnets (AZ-a, AZ-b) kubernetes.io/role/internal-elb: 1 Internet-facing ALB/NLB · Accepts external traffic · Architecture component Internet-facing ALB/NLB Accepts external traffic Internal ALB/NLB · Traffic inside the VPC · Architecture component Internal ALB/NLB Traffic inside the VPC finds elb tag finds internal-elb tag scheme: internet-facing scheme: internal Legend Backend Cloud Security

Public subnet tags

  • • kubernetes.io/role/elb: 1 — marks subnets for internet-facing load balancers
  • • kubernetes.io/cluster/<cluster-name>: shared or owned
  • • shared allows other clusters to use it; owned is exclusive to this cluster

Private subnet tags

  • • kubernetes.io/role/internal-elb: 1 — marks subnets for internal load balancers
  • • These subnets host worker nodes and carry internal traffic only
  • • Add operational tags such as Name and Environment alongside them

Watch out for

  • • Tag values are case-sensitive and the cluster name must match exactly
  • • Without the tags the controller cannot find subnets and load balancer creation fails
  • • Apply them per subnet with aws ec2 create-tags and audit them regularly