# NLB target registration issue on EKS 1.24 **URL:** \ **Category:** Traefik v2\ **Tags:** kubernetes-ingress\ **Created:** [February 15, 2023, 7:16pm UTC](https://community.traefik.io/t/nlb-target-registration-issue-on-eks-1-24/17566 "2023-02-15T19:16:48Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![jjg23](https://avatars.discourse-cdn.com/v4/letter/j/7ab992/32.png) [@jjg23](https://community.traefik.io/u/jjg23)\ **Post date:** [February 15, 2023, 7:16pm UTC](https://community.traefik.io/t/nlb-target-registration-issue-on-eks-1-24/17566/1 "2023-02-15T19:16:48Z")
Good afternoon, I'm deploying Traefik 2.9.6 from the official helm chart here: [GitHub - traefik/traefik-helm-chart: Traefik v2 helm chart](https://github.com/traefik/traefik-helm-chart) and running into an issue related to load balancer target group registration. I'm using the annotation `service.beta.kubernetes.io/aws-load-balancer-type: nlb` to deploy this as a Network Load Balancer In order to preserve the original client IP I understand that I need to set `externalTrafficPolicy: Local` on the service spec. I'm setting this from values.yaml and this works: the NLB is configured, target registered, traffic hits my service, and I'm able to successfully whitelist based on client IP. However if I terminate the EC2 instance (EKS Managed Node Group) when my Auto Scaling Group recreates the node as a new instance it is never registered as a target in the NLB. With `externalTrafficPolicy: Cluster` this appears to work as expected and the new node is registered in the target group as soon as it comes up, but then the whitelisting doesn't work. I've looked through [Troubleshoot unhealthy targets for NLB in Amazon EKS](https://aws.amazon.com/premiumsupport/knowledge-center/eks-troubleshoot-unhealthy-targets-nlb/) and checked that the kube-proxy has been patched with the `--hostname-override` flag, so that's not the issue. FWIW I don't think this is a Traefik issue exactly as I saw this same behavior with ingress-nginx. I've opened a ticket with AWS support, but I'm trying to cast a wide net as this is issue is a blocker for my progress on this configuration. Any idea what might cause this behavior? Edit with additional detail: when switching between `Local` and `Cluster` the target groups are recreated and have different health checks configured. `Cluster` gives a TCP health check configured for "Traffic port" while `Local` configures an HTTP health check for `/healthz`. Both of these seem to succeed when changing the `externalTrafficPolicy` back and forth. ---
**Author:** ![jjg23](https://avatars.discourse-cdn.com/v4/letter/j/7ab992/32.png) [@jjg23](https://community.traefik.io/u/jjg23)\ **Post date:** [February 16, 2023, 1:53pm UTC](https://community.traefik.io/t/nlb-target-registration-issue-on-eks-1-24/17566/2 "2023-02-16T13:53:23Z")
I suspect this issue may be related to the bug described here: [https://github.com/kubernetes/cloud-provider-aws/pull/302](https://github.com/kubernetes/cloud-provider-aws/pull/302) and fixed here: [Restore chunked behaviour of target group creation in LBv2 by JoelSpeed · Pull Request #527 · kubernetes/cloud-provider-aws · GitHub](https://github.com/kubernetes/cloud-provider-aws/pull/527) but I'm not 100% certain. If that is the case it seems I'll need to wait until the next EKS release to (hopefully) see this resolved as we can't update the Cloud Controller Manager component in EKS. The 1.25 release is slated for March. ---
**Author:** ![jjg23](https://avatars.discourse-cdn.com/v4/letter/j/7ab992/32.png) [@jjg23](https://community.traefik.io/u/jjg23)\ **Post date:** [March 17, 2023, 1:12pm UTC](https://community.traefik.io/t/nlb-target-registration-issue-on-eks-1-24/17566/3 "2023-03-17T13:12:02Z")
This appears to be resolved in EKS 1.25, though I can't pinpoint any specific changelog. The previously mentioned PR was slated for 1.26, but maybe was backported?