How to configure AWS Network Load Balancer (NLB) for use with HA

a tcp forwarding load balancer needs to forward traffic on port 6443, 443, and 8800 to all the master and worker nodes and traffic on 443 and 8800 to the worker nodes in aws the proper way to do it is to split out into different "target groups" separate pools of nodes organized by their port sample configuration create three target groups kube api tg tcp, 6443, instance targets all master node instances, 6443 dashboard tg tcp, 8800, instance targets all master and worker node instances, 6443 swimlane tg tcp, 443, instance targets all master and worker node instances, 443 follow steps to create a network load balancer add listener port 6443 forward to kube api tg target group port 8800 forward to dashboard tg target group port 443 forward to swimlane tg target group security group allow inbound tcp traffic to port 6443, 8800, 443 troubleshooting when using nlb on aws all hosts in the target group are routed to by default if none of them are healthy it may be worth dropping all instances from the nlb except for the first master out of the 6443 target group then try to run the install script again if all goes, well, the next master can be added to the target group use the instance type for the target group = ip instead of instance for more information see https //docs aws amazon com/elasticloadbalancing/latest/network/load balancer troubleshooting htm