Bug Description
The AWS Load Balancer Controller is unable to reconcile an IngressGroup after the Application Load Balancer reaches the maximum number of unique target groups.
This appears to be similar to #4373, but in this case the limiting resource is not the number of listener rules. The controller reaches the AWS quota of 100 unique target groups associated with a single Application Load Balancer.
Once the quota is reached, the controller repeatedly attempts to create a new listener rule referencing an additional target group. The reconciliation fails before obsolete listener rules and target groups are removed.
As a result, adding, updating, or deleting Ingress resources in the affected IngressGroup no longer converges automatically.
Error Message
`{"level":"info","ts":"2026-06-23T09:00:58Z","logger":"controllers.ingress","msg":"creating listener rule","stackID":"act-iu-eu-alb","resourceID":"443:3"}
{"level":"error","ts":"2026-06-23T09:00:58Z","msg":"Reconciler error","controller":"ingress","object":{"name":"xxx-iu-eu-alb"},"namespace":"","name":"xxx-iu-eu-alb","reconcileID":"1a47778b-67b3-4480-860a-981c8747b28b","error":"failed to create listener rule: operation error Elastic Load Balancing v2: CreateRule, https response error StatusCode: 400, RequestID: f18fac52-719a-4f11-ba24-a02f940eb045, TooManyUniqueTargetGroupsPerLoadBalancer: You have reached the maximum number of unique target groups that you can associate with a load balancer of type 'application': [100]"}`
Steps to Reproduce
- Create an Application Load Balancer managed by the AWS Load Balancer Controller.
- Configure multiple Ingress resources to use the same alb.ingress.kubernetes.io/group.name.
- Configure the Ingress resources so that they create separate target groups.
- Increase the number of Ingress resources and target groups until the ALB has 100 unique target groups associated with it.
- Add another Ingress or modify an existing Ingress so that another target group or listener rule must be created.
- Delete one or more existing Ingress resources that should cause older listener rules and target groups to be removed.
- Observe that reconciliation continues to fail with TooManyUniqueTargetGroupsPerLoadBalancer.
Expected Behavior
When the ALB has reached the maximum number of unique target groups, the controller should still be able to process deletions and updates that reduce the number of target groups.
For a model containing both deletions and creations, the controller should preferably:
Delete obsolete listener rules.
Remove obsolete target groups from the load balancer.
Wait until AWS no longer considers those target groups associated with the ALB, if required.
Create the new target groups and listener rules.
Alternatively, the controller should detect that the target-group quota has been reached and prioritize cleanup operations before attempting resource creation.
Deleting an Ingress should always allow the controller to recover from the quota condition without manual changes in AWS.
Actual Behavior
The controller attempts to create a listener rule before sufficient obsolete listener rules or target groups have been removed.
AWS rejects the request with:
TooManyUniqueTargetGroupsPerLoadBalancer:
You have reached the maximum number of unique target groups that you can associate with a load balancer of type 'application': [100]
The complete model deployment fails. Consequently, planned deletions are apparently not executed either.
The affected IngressGroup remains stuck in a reconciliation loop.
Current Workarounds
We manually deleted approximately 30 listener rules from the affected ALB within AWS Console.
After manually freeing sufficient capacity, the controller was able to continue reconciliation. It then processed the pending deletions and successfully deployed the model:
{"level":"info","ts":"2026-06-23T09:11:49Z","logger":"controllers.ingress","msg":"successfully deployed model","ingressGroup":"xxx-iu-eu-alb"}
No controller restart was required.
Environment
- AWS Load Balancer controller version: v2.17.1
- Kubernetes version: 1.33
- Using EKS (yes/no), if so version?: v1.33.13-eks-8f14419
- Using Service or Ingress: Ingress
- AWS region: eu-central-1
- How was the aws-load-balancer-controller installed:
- If helm was used then please show output of
helm ls -A | grep -i aws-load-balancer-controller
helm -n kube-system ls | grep -i aws-load-balancer-controller
xxx-iu-aws-lb-ctlr kube-system 12 2026-04-14 10:02:36.183285012 +0000 UTC deployed aws-load-balancer-controller-1.17.1 v2.17.1
Possible Solution (Optional)
Potential approaches could include:
- Execute destructive cleanup operations before create operations when an AWS quota is reached.
- Split reconciliation into cleanup and creation phases.
- Retry model deployment after performing safe deletions.
- Detect TooManyUniqueTargetGroupsPerLoadBalancer and prioritize obsolete listener-rule and target-group deletion.
- Calculate the expected peak number of associated target groups during model deployment.
- Avoid an intermediate state that requires more target groups than both the current and desired state.
- Improve the error event to indicate which Ingress resources or target groups contribute to the quota.
Additional Context
This appears closely related to #4373.
Issue #4373 describes a deadlock when the listener-rule quota is reached. This issue demonstrates similar reconciliation behavior when the quota for unique target groups per ALB is reached.
#4373
The common behavior seems to be that the controller attempts resource creation before processing deletions required to free capacity.
Bug Description
The AWS Load Balancer Controller is unable to reconcile an IngressGroup after the Application Load Balancer reaches the maximum number of unique target groups.
This appears to be similar to #4373, but in this case the limiting resource is not the number of listener rules. The controller reaches the AWS quota of 100 unique target groups associated with a single Application Load Balancer.
Once the quota is reached, the controller repeatedly attempts to create a new listener rule referencing an additional target group. The reconciliation fails before obsolete listener rules and target groups are removed.
As a result, adding, updating, or deleting Ingress resources in the affected IngressGroup no longer converges automatically.
Error Message
`{"level":"info","ts":"2026-06-23T09:00:58Z","logger":"controllers.ingress","msg":"creating listener rule","stackID":"act-iu-eu-alb","resourceID":"443:3"}
{"level":"error","ts":"2026-06-23T09:00:58Z","msg":"Reconciler error","controller":"ingress","object":{"name":"xxx-iu-eu-alb"},"namespace":"","name":"xxx-iu-eu-alb","reconcileID":"1a47778b-67b3-4480-860a-981c8747b28b","error":"failed to create listener rule: operation error Elastic Load Balancing v2: CreateRule, https response error StatusCode: 400, RequestID: f18fac52-719a-4f11-ba24-a02f940eb045, TooManyUniqueTargetGroupsPerLoadBalancer: You have reached the maximum number of unique target groups that you can associate with a load balancer of type 'application': [100]"}`
Steps to Reproduce
Expected Behavior
When the ALB has reached the maximum number of unique target groups, the controller should still be able to process deletions and updates that reduce the number of target groups.
For a model containing both deletions and creations, the controller should preferably:
Delete obsolete listener rules.
Remove obsolete target groups from the load balancer.
Wait until AWS no longer considers those target groups associated with the ALB, if required.
Create the new target groups and listener rules.
Alternatively, the controller should detect that the target-group quota has been reached and prioritize cleanup operations before attempting resource creation.
Deleting an Ingress should always allow the controller to recover from the quota condition without manual changes in AWS.
Actual Behavior
The controller attempts to create a listener rule before sufficient obsolete listener rules or target groups have been removed.
AWS rejects the request with:
TooManyUniqueTargetGroupsPerLoadBalancer:
You have reached the maximum number of unique target groups that you can associate with a load balancer of type 'application': [100]
The complete model deployment fails. Consequently, planned deletions are apparently not executed either.
The affected IngressGroup remains stuck in a reconciliation loop.
Current Workarounds
We manually deleted approximately 30 listener rules from the affected ALB within AWS Console.
After manually freeing sufficient capacity, the controller was able to continue reconciliation. It then processed the pending deletions and successfully deployed the model:
{"level":"info","ts":"2026-06-23T09:11:49Z","logger":"controllers.ingress","msg":"successfully deployed model","ingressGroup":"xxx-iu-eu-alb"}
No controller restart was required.
Environment
helm ls -A | grep -i aws-load-balancer-controllerhelm-n kube-system ls | grep -i aws-load-balancer-controllerxxx-iu-aws-lb-ctlr kube-system 12 2026-04-14 10:02:36.183285012 +0000 UTC deployed aws-load-balancer-controller-1.17.1 v2.17.1
Possible Solution (Optional)
Potential approaches could include:
Additional Context
This appears closely related to #4373.
Issue #4373 describes a deadlock when the listener-rule quota is reached. This issue demonstrates similar reconciliation behavior when the quota for unique target groups per ALB is reached.
#4373
The common behavior seems to be that the controller attempts resource creation before processing deletions required to free capacity.