# EKS with Traefik and Gateway API (internal only load balancer)

**URL:** <https://community.traefik.io/t/eks-with-traefik-and-gateway-api-internal-only-load-balancer/29904>\
**Category:** Traefik v3 (latest)\
**Tags:** kubernetes-ingress\
**Created:** [May 27, 2026, 7:43am UTC](https://community.traefik.io/t/eks-with-traefik-and-gateway-api-internal-only-load-balancer/29904 "2026-05-27T07:43:46Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jpi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/jpi/32/11236_2.png) [@jpi](https://community.traefik.io/u/jpi)\
**Post date:** [May 27, 2026, 7:43am UTC](https://community.traefik.io/t/eks-with-traefik-and-gateway-api-internal-only-load-balancer/29904/1 "2026-05-27T07:43:47Z")

</div>

I have an EKS cluster (private+public). I'd like to use Traefik (with Gateway API) to access my apps in the cluster. I'd like to have an internal load balancer, the apps should not be accessible over the Internet. In preparation for this I've:

1. Installed Gateway API's CRDs `v1.5.1/standard-install.yaml`.
2. labeled my private subnets with:
  1. `kubernetes.io/role/internal-elb: 1`
  2. `kubernetes.io/cluster/eks-a:`` shared`

I've then installed version `40.2.0` of the `traefik` Helm chart with the following values. This, however, deploys a `traefik` k8s service of type `LoadBalancer` with an Internet facing external IP (e.g. `....c-......970.us-east-1.elb.amazonaws.com`) - this corresponds on the AWS side to a classic load balancer with a scheme equal to `Internet-facing`. This doesn't seem right given my scheme in `internal` via the values below. I'm still wrapping my head around what role the `aws-load-balancer-controller` plays here (note this is NOT installed on the cluster). Thanks for the help.

```yaml
deployment:
  replicas: 2

service:
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-scheme: "internal"

ingressClass:
  enabled: false

providers:
  kubernetesIngress:
    enabled: false
  kubernetesGateway:
    enabled: true

gateway:
  listeners:
    web:
      namespacePolicy:
        from: All

```

---

<div class="post-metadata">

**Author:** ![jpi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/jpi/32/11236_2.png) [@jpi](https://community.traefik.io/u/jpi)\
**Post date:** [May 28, 2026, 1:59pm UTC](https://community.traefik.io/t/eks-with-traefik-and-gateway-api-internal-only-load-balancer/29904/2 "2026-05-28T13:59:48Z")

</div>

For those who find this, I was using the incorrect annotation values. The values below get me an internal NLB.

```auto
service:
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
    service.beta.kubernetes.io/aws-load-balancer-internal: "true"

```