Skip to content

ACM creation not able to find DNS Zone for Sub-Subdomain. (sub.sub.domain.tld) #4832

Open
#4892
Open
ACM creation not able to find DNS Zone for Sub-Subdomain. (sub.sub.domain.tld)#4832
#4892

Description

@joshbeauregard-wizehive
joshbeauregard-wizehive
opened on Jul 13, 2026

Bug Description
ACM creation does not work for sub-subdomains.

I have a route53 zone for
domain.tld

When I create an ingress for echoserver-albtest.domain.tld it just works! (Thank-you!)

When I create an ingress for echoserver.albtest.domain.tld I get an error in the ALB controler logs with error: pre-check failed for domain "echoserver.albtest.domain.tld": no hosted zone found for validation records

Full log bellow

2026-07-13T11:04:57-0400 Reconciler error                                                                                                                                                                                                            │
  controller: ingress                                                                                                                                                                                                                                │
  object: {"name":"echoserver","namespace":"echoserver"}                                                                                                                                                                                             │
  namespace: echoserver                                                                                                                                                                                                                              │
  name: echoserver                                                                                                                                                                                                                                   │
  reconcileID: bahdhfsqae0c-9392-8328-c8asv9cs                                                                                                                                                                                                  │
  error: pre-check failed for domain "echoserver.albtest.domain.tld": no hosted zone found for validation records                                                                                                                           │
2026-07-13T11:10:25-0400 Auto Create SG                                                                                                                                                                                                              │
  LB SGs: [{"$ref":"#/resources/AWS::EC2::SecurityGroup/ManagedLBSecurityGroup/status/groupID"},"sg-12345678987654"]                                                                                                                              │
  backend SG: sg-12345678987654                                                                                                                                                                                                                   │
2026-07-13T11:10:25-0400 successfully built model                                                                                                                                                                                                    │
  model: {
  "id": "echoserver/echoserver",
  "resources": {
    "AWS::ACM::Certificate": {
      "amazon_issued/echoserver.albtest.domain.tld-81c9dc9a": {
        "spec": {
          "type": "AMAZON_ISSUED",
          "certificateAuthorityARN": "",
          "domainName": "echoserver.albtest.domain.tld",
          "subjectAlternativeNames": [
            "echoserver.albtest.domain.tld"
          ],
          "validationMethod": "DNS",
          "keyAlgorithm": "",
          "tags": {
            "Environment": "dev",
            "Team": "test"
          }
        }
      }
    },
    "AWS::EC2::SecurityGroup": {
      "ManagedLBSecurityGroup": {
        "spec": {
          "groupName": "k8s-echoserv-echoserv-3j4j3j4j23",
          "description": "[k8s] Managed SecurityGroup for LoadBalancer",
          "tags": {
            "Environment": "dev",
            "Team": "test"
          },
          "ingress": [
            {
              "ipProtocol": "tcp",
              "fromPort": 443,
              "toPort": 443,
              "ipRanges": [
                {
                  "cidrIP": "0.0.0.0/0"
                }
              ]
            },
            {
              "ipProtocol": "tcp",
              "fromPort": 80,
              "toPort": 80,
              "ipRanges": [
                {
                  "cidrIP": "0.0.0.0/0"
                }
              ]
            }
          ]
        }
      }
    },
    "AWS::ElasticLoadBalancingV2::Listener": {
      "443": {
        "spec": {
          "loadBalancerARN": {
            "$ref": "#/resources/AWS::ElasticLoadBalancingV2::LoadBalancer/LoadBalancer/status/loadBalancerARN"
          },
          "port": 443,
          "protocol": "HTTPS",
          "defaultActions": [
            {
              "type": "fixed-response",
              "fixedResponseConfig": {
                "contentType": "text/plain",
                "statusCode": "404"
              }
            }
          ],
          "certificates": [
            {
              "certificateARN": {
                "$ref": "#/resources/AWS::ACM::Certificate/amazon_issued/echoserver.albtest.domain.tld-81c9dc9a/status/certificateARN"
              }
            }
          ],
          "sslPolicy": "ELBSecurityPolicy-TLS13-1-2-2021-06",
          "tags": {
            "Environment": "dev",
            "Team": "test"
          }
        }
      },
      "80": {
        "spec": {
          "loadBalancerARN": {
            "$ref": "#/resources/AWS::ElasticLoadBalancingV2::Load│Balancer/LoadBalancer/status/loadBalancerARN"
          },
          "port": 80,
          "protocol": "HTTP",
          "defaultActions": [
            {
              "type": "redirect",
              "redirectConfig": {
                "port": "443",
                "protocol": "HTTPS",
                "statusCode": "HTTP_301"
              }
            }
          ],
          "tags": {
            "Environment": "dev",
            "Team": "test"
          }
        }
      }
    },
    "AWS::ElasticLoadBalancingV2::ListenerRule": {
      "443:1": {
        "spec": {
          "listenerARN": {
            "$ref": "#/resources/AWS::ElasticLoadBalancingV2::Listener/443/status/listenerARN"
          },
          "priority": 1,
          "actions": [
            {
              "type": "forward",
              "forwardConfig": {
                "targetGroups": [
                  {
                    "targetGroupARN": {
                      "$ref": "#/resources/AWS::ElasticLoadBalancingV2::TargetGroup/echoserver/echoserver-echoserver:80/status/targetGroupARN"
                    }
                  }
                ]
              }
            }
          ],
          "conditions": [
            {
              "field": "host-header",
              "hostHeaderConfig": {
                "values": [
                  "echoserver.albtest.domain.tld"
                ]
              }
            },
            {
              "field": "path-pattern",
              "pathPatternConfig": {
                "values": [
                  "/"
                ]
              }
            }
          ],
          "tags": {
            "Environment": "dev",
            "Team": "test"
          }
        }
      }
    },
    "AWS::ElasticLoadBalancingV2::LoadBalancer": {
      "LoadBalancer": {
        "spec": {
          "name": "k8s-echoserv-echoserv-33384545",
          "type": "application",
          "scheme": "internet-facing",
          "ipAddressType": "ipv4",
          "subnetMapping": [
            {
              "subnetID": "subnet-0a4f3d2s1a"
            },
            {
              "subnetID": "subnet-0b4f3d2s1a"
            }
          ],
          "securityGroups": [
            {
              "$ref": "#/resources/AWS::EC2::SecurityGroup/ManagedLBSecurityGroup/status/groupID"
            },
            "sg-12345678987654"
          ],
          "tags": {
            "Environment": "dev",
            "Team": "test"
          }
        }
      }
    },
    "AWS::ElasticLoadBalancingV2::TargetGroup": {
      "echoserver/echoserver-echoserver:80": {
        "spec": {
          "name": "k8s-echoserv-echoserv-4f3d2s1a",
          "targetType": "ip",
          "port": 8080,
          "protocol": "HTTPS",
          "protocolVersion": "HTTP1",
          "ipAddressType": "ipv4",
          "healthCheckConfig": {
            "port": "traffic-port",
            "protocol": "HTTPS",
            "path": "/",
            "matcher": {
              "httpCode": "200"
            },
            "intervalSeconds": 15,
            "timeoutSeconds": 5,
            "healthyThresholdCount": 2,
            "unhealthyThresholdCount": 2
          },
          "tags": {
            "Environment": "dev",
            "Team": "test"
          }
        }
      }
    },
    "FrontendNLBTargetGroup": {
      "FrontendNLBTargetGroup": {
        "TargetGroups": {}
      }
    },
    "K8S::ElasticLoadBalancingV2::TargetGroupBinding": {
      "echoserver/echoserver-echoserver:80": {
        "spec": {
          "template": {
            "metadata": {
              "name": "k8s-echoserv-echoserv-4f3d2s1a",
              "namespace": "echoserver"
            },
            "spec": {
              "targetGroupARN": {
                "$ref": "#/resources/AWS::ElasticLoadBalancingV2::TargetGroup/echoserver/echoserver-echoserver:80/status/targetGroupARN"
              },
              "targetType": "ip",
              "serviceRef": {
                "name": "echoserver",
                "port": 80
              },
              "networking": {
                "ingress": [
                  {
                    "from": [
                      {
                        "securityGroup": {
                          "groupID": "sg-12345678987654"
                        }
                      }
                    ],
                    "ports": [
                      {
                        "protocol": "TCP",
                        "port": 8080
                      }
                    ]
                  }
                ]
              },
              "ipAddressType": "ipv4",
              "vpcID": "vpc-a1s2d3f4",
              "targetGroupProtocol": "HTTPS"
            }
          }
        }
      }
    }
  }
}

Steps to Reproduce

Create an Ingress like:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: echoserver
  namespace: echoserver
  annotations:
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/tags: Environment=dev,Team=test
    alb.ingress.kubernetes.io/backend-protocol: HTTPS
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443},{"HTTP":80}]'
    alb.ingress.kubernetes.io/ssl-policy: ELBSecurityPolicy-TLS13-1-2-2021-06
    alb.ingress.kubernetes.io/ssl-redirect: "443"
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/create-acm-cert: 'true'
    # nested subdomain is required for acm test
    external-dns.alpha.kubernetes.io/hostname: 'echoserver.albtest.domain.tld'
spec:
  ingressClassName: alb
  rules:
    - host: 'echoserver.albtest.domain.tld'
      http:
        paths:
          - path: /
            pathType: Exact
            backend:
              service:
                name: echoserver
                port:
                  number: 80

Expected Behavior
Cert to create

Actual Behavior

Route 53 precheck fails due to bad dns zone lookup

Regression
Not that I am aware of as this is my first time trying this feature

Current Workarounds

Create cert manaully

Environment

  • AWS Load Balancer controller version: 3.4.0
  • Kubernetes version: 1.3.4
  • Using EKS (yes/no), if so version?: yes 1.3.4
  • Using Service or Ingress: Ingress
  • AWS region: us-east-1
  • How was the aws-load-balancer-controller installed:
    Argo AppCRD
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: aws-load-balancer-controller-{{ .Values.clusterName }}
  namespace: argocd
spec:
  destination:
    server: eks-dev
    namespace: kube-system
  source:
    chart: aws-load-balancer-controller
    repoURL: 'https://aws.github.io/eks-charts'
    targetRevision: 3.4.0
    helm:
      releaseName: aws-load-balancer-controller
      # note: serviceAccount.name is aws-lbc for operations-tools-vpc1-eks1 only
      # values file at https://github.com/aws/eks-charts/blob/master/stable/aws-load-balancer-controller/values.yaml
      values: |
        vpcId: vpc-08fsdk34dkj3a
        clusterName: eks-dev
        serviceAccount:
          name: aws-load-balancer-controller
          create: false
        nodeSelector:
          kubernetes.io/os: linux
        enablePodReadinessGateInject: true
        enableWafv2: true
        controllerConfig:
          enableCertificateManagment: true
  project: operations
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
  • Current state of the Controller configuration:

Namespace: kube-system
CreationTimestamp: Thu, 17 Oct 2024 14:52:04 -0400
Labels: app.kubernetes.io/instance=aws-load-balancer-controller-eks-dev
app.kubernetes.io/managed-by=Helm
app.kubernetes.io/name=aws-load-balancer-controller
app.kubernetes.io/version=v3.4.0
helm.sh/chart=aws-load-balancer-controller-3.4.0
Annotations: argocd.argoproj.io/tracking-id:
aws-load-balancer-controller-eks-dev-cluster-us-east-1:apps/Deployment:kube-system/aws-load-balancer-controller
deployment.kubernetes.io/revision: 9
Selector: app.kubernetes.io/instance=aws-load-balancer-controller,app.kubernetes.io/name=aws-load-balancer-controller
Replicas: 2 desired | 2 updated | 2 total | 2 available | 0 unavailable
StrategyType: RollingUpdate
MinReadySeconds: 0
RollingUpdateStrategy: 25% max unavailable, 25% max surge
Pod Template:
Labels: app.kubernetes.io/instance=aws-load-balancer-controller
app.kubernetes.io/name=aws-load-balancer-controller
Annotations: kubectl.kubernetes.io/restartedAt: 2025-11-17T19:19:04-08:00
prometheus.io/port: 8080
prometheus.io/scrape: true
Service Account: aws-load-balancer-controller
Containers:
aws-load-balancer-controller:
Image: public.ecr.aws/eks/aws-load-balancer-controller:v3.4.0
Ports: 9443/TCP (webhook-server), 8080/TCP (metrics-server)
Host Ports: 0/TCP (webhook-server), 0/TCP (metrics-server)
Args:
--cluster-name=eks-dev-cluster-us-east-1
--ingress-class=alb
--aws-vpc-id=vpc-08f2398d86822213a
--enable-pod-readiness-gate-inject=true
--enable-wafv2=true
--feature-gates=EnableCertificateManagement=true
Liveness: http-get http://:61779/healthz delay=30s timeout=10s period=10s #success=1 #failure=2
Readiness: http-get http://:61779/readyz delay=10s timeout=10s period=10s #success=1 #failure=2
Environment:
Mounts:
/tmp/k8s-webhook-server/serving-certs from cert (ro)
Volumes:
cert:
Type: Secret (a volume populated by a Secret)
SecretName: aws-load-balancer-tls
Optional: false
Priority Class Name: system-cluster-critical
Node-Selectors: kubernetes.io/os=linux
Tolerations:
Conditions:
Type Status Reason

Available True MinimumReplicasAvailable
Progressing True NewReplicaSetAvailable
OldReplicaSets: aws-load-balancer-controller-775b9d4bd (0/0 replicas created), aws-load-balancer-controller-68485ddd64 (0/0 replicas created), aws-load-balancer-controller-54fc4455b9 (0/0 replicas created), aws-load-balancer-controller-75848d78d7 (0/0 replicas created), aws-load-balancer-controller-64fb584fcc (0/0 replicas created), aws-load-balancer-controller-7dd466654f (0/0 replicas created), aws-load-balancer-controller-577c97fd48 (0/0 replicas created)
NewReplicaSet: aws-load-balancer-controller-7bfc85f5bf (2/2 replicas created)


**Possible Solution (Optional)**

The Issue is def here https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/b0129ab6ebbbffa5f60cc24cf1b1c66580e58bb6/pkg/aws/services/route53.go#L54

**Contribution Intention (Optional)**
I will take a look but go is not my strong suite

- [* ] Yes, I'm willing to submit a PR to fix this issue
- [ ] No, I cannot work on a PR at this time

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions