All Products
Search

This Product

    Container Service for Kubernetes:ALB Ingress Controller upgrade precheck failures

    Document Center

    Container Service for Kubernetes:ALB Ingress Controller upgrade precheck failures

    Last Updated:Jun 18, 2026

    Identify and resolve precheck errors during ALB Ingress Controller upgrades.

    Contents

    Usage notes

    Before the upgrade

    Note

    Before upgrading, review the new features in ALB Ingress Controller.

    1. Run kubectl get event to check for reconciliation failures in the cluster. Resolve any failures before proceeding.

    2. Ensure the ALB console configuration matches the Albconfig. Align any inconsistencies before upgrading. Do not modify ALB instances, listeners, forwarding rules, ACLs, or server groups in the ALB console before the precheck. Configuration drift causes the precheck to fail.

      • To keep the ALB console configuration, update the Albconfig or Ingress to match.

      • To keep the Albconfig or Ingress configuration, run kubectl edit to modify a non-key field and trigger reconciliation. Alternatively, update the ALB console to match. Then enable the configuration read-only mode for the ALB instance. See Enable or disable the configuration read-only mode.

    During the upgrade

    Do not modify the Albconfig or Ingress configuration during the precheck. If you make changes, rerun the precheck.

    Precheck error messages and solutions

    Note

    If the precheck fails, log on to the Container Service Management Console, click Precheck > View Details, and check the Report to identify the failure cause.

    Error messages related to ALB instances

    Error message

    Cause

    Solutions

    Scenario 1: You have not modified the backend server configuration of the ALB instance in the ALB console

    Scenario 2: You have manually modified the backend server configuration of the ALB instance in the ALB console

    CreateALB

    The ALB instance configuration does not match the Albconfig.

    Rerun the precheck. Do not change the Albconfig during the upgrade precheck.

    Align the ALB instance configuration with the Albconfig. Then rerun the precheck.

    ReuseALB

    UnReuseALB

    DeleteALB

    UpdateALBAttribute

    ALB instance attributes (such as instance name and read-only mode status) do not match the Albconfig.

    Rerun the precheck. Do not change the Albconfig during the upgrade pre-check.

    Run kubectl describe albconfig [$Albconfig_Name] to compare ALB instance and Albconfig attributes. Restore the ALB instance attributes in the console to match the Albconfig. Then rerun the precheck.

    UpdateALBDeletionProtection

    The ALB instance deletion protection status does not match the Albconfig.

    Rerun the precheck. Do not change the Albconfig during the upgrade pre-check.

    Run kubectl describe albconfig [$Albconfig_Name] to check the Albconfig deletion protection status. Restore the ALB instance deletion protection in the console to match. Then rerun the precheck.

    UpdateALBAccessLog

    The ALB instance access log configuration does not match the Albconfig.

    Rerun the precheck. Do not change the Albconfig during the upgrade pre-check.

    Align the ALB instance access log configuration with the Albconfig. To keep the ALB console configuration, run kubectl edit albconfig [$Albconfig_Name] to update the Albconfig. Then rerun the precheck.

    UpdateALBEdition

    The ALB instance edition (Standard or WAF-enabled) does not match the Albconfig.

    Rerun the precheck. Do not change the Albconfig during the upgrade pre-check.

    Align the ALB instance edition with the Albconfig. Then rerun the precheck.

    UpdateALBResourceGroup

    The ALB instance resource group does not match the Albconfig.

    Rerun the precheck. Do not change the Albconfig during the upgrade pre-check.

    Align the ALB instance resource group with the Albconfig. Then rerun the precheck.

    UpdateALBTag

    The ALB instance tags do not match the Albconfig.

    Rerun the precheck. Do not change the Albconfig during the upgrade pre-check.

    Align the ALB instance tags with the Albconfig. Then rerun the precheck.

    UpdateALBAddressType

    The ALB instance network type does not match the Albconfig.

    Rerun the precheck. Do not change the Albconfig during the upgrade pre-check.

    Align the ALB instance network type with the Albconfig. To keep the ALB console network type, run kubectl edit albconfig [$Albconfig_Name] to update the Albconfig. Then rerun the precheck.

    Important

    • Changing from private to public involves EIP changes and incurs fees. Proceed with caution.

    • Changing from public to private removes all EIPs and modifies domain name resolution. Proceed with caution.

    UpdateALBBandWidthPackage

    The ALB instance Internet Shared Bandwidth package does not match the Albconfig.

    Rerun the precheck. Do not change the Albconfig during the upgrade pre-check.

    Align the ALB instance Internet Shared Bandwidth package with the Albconfig. To keep the ALB console configuration, run kubectl edit albconfig [$Albconfig_Name] to update the Albconfig. Then rerun the precheck.

    Error messages related to listeners

    Error message

    Cause

    Solutions

    Scenario 1: You have not modified the backend server configuration of the ALB instance in the ALB console

    Scenario 2: You have manually modified the backend server configuration of the ALB instance in the ALB console

    CreateALBListener

    The ALB listener configuration does not match the Albconfig.

    Rerun the precheck. Do not modify the listener during the precheck.

    • Add the deleted listener to the ALB instance and rerun the precheck.

    • To keep the ALB instance listener configuration, run kubectl edit albconfig [$Albconfig_Name] to delete the listener from the Albconfig. Then rerun the precheck.

    UpdateALBListenerExtraCertificates

    The listener additional certificate configuration does not match the Albconfig.

    Rerun the precheck. Do not modify the listener during the precheck.

    Align the listener additional certificate configuration with the Albconfig. To keep the ALB console configuration, run kubectl edit albconfig [$Albconfig_Name] to update the Albconfig. Then rerun the precheck.

    UpdateALBListenerAttribute

    The listener attribute configuration does not match the Albconfig.

    Rerun the precheck. Do not modify the listener during the precheck.

    • Check for inconsistent listener attributes, such as certificates, compression algorithms, access control policies, idle connection timeout, and XForwardConfig.

    • To keep the ALB instance listener configuration, run kubectl edit albconfig [$Albconfig_Name] to update the Albconfig. Then rerun the precheck.

    DeleteALBListener

    The listener configuration does not match the Albconfig.

    Rerun the precheck. Do not modify the listener during the precheck.

    • Delete the added listener in the ALB console and rerun the precheck.

    • To keep the ALB instance listener configuration, run kubectl edit albconfig [$Albconfig_Name] to add the listener to the Albconfig. Then rerun the precheck.

    Error messages related to network ACLs

    Error message

    Cause

    Solutions

    Case 1: You have not modified the backend server configuration of the ACL in the ALB console

    Case 2: You have manually modified the backend server configuration of the ACL in the ALB console

    CreateAcl

    The ACL configuration does not match the Albconfig access policy.

    Run the precheck again. Do not modify the ACL during the upgrade check.

    Align the ACL configuration between the Albconfig and the ALB console. To keep the console configuration, run kubectl edit albconfig [$Albconfig_Name] to update the Albconfig access control policy. Then rerun the precheck.

    DeleteAcl

    AddEntriesToAcl

    RemoveEntriesFromAcl

    AssociateAclWithListener

    DisassociateAclWithListener

    Error messages related to forwarding rules

    Error message

    Cause

    Solutions

    Scenario 1: You have not modified the backend server configuration of the ALB instance in the ALB console.

    Scenario 2: You have manually modified the backend server configuration of the ALB instance in the ALB console.

    CreateALBListenerRules

    The ALB instance forwarding rules do not match the Ingress configuration.

    Rerun the precheck. Do not change the listener rules during the precheck.

    Add the deleted forwarding rules and rerun the precheck.

    UpdateALBListenerRules

    The ALB instance forwarding rules do not match the Ingress configuration.

    Rerun the precheck. Do not change the listener rules during the precheck.

    Align the ALB instance forwarding rules with the Ingress. To keep the ALB console rules, run kubectl -n [$Namespace] edit ingress [$Ingress_Name] to update the Ingress. Then rerun the precheck.

    DeleteALBListenerRules

    The ALB instance forwarding rules do not match the Ingress configuration.

    Rerun the precheck. Do not change the listener rules during the precheck.

    Delete the added forwarding rules and rerun the precheck.

    Error messages related to server groups

    Error message

    Cause

    Solutions

    Scenario 1: You have not modified the backend server configuration of the ALB instance in the ALB console

    Scenario 2: You have manually modified the backend server configuration of the ALB instance in the ALB console

    CreateALBServerGroup

    The ALB instance server group configuration does not match the Ingress configuration.

    Rerun the precheck. Do not modify the ServerGroup during the upgrade pre-check.

    Add the deleted server group and rerun the precheck.

    UpdateALBServerGroup

    The ALB instance server group configuration does not match the Ingress configuration.

    Rerun the precheck. Do not modify the ServerGroup during the upgrade pre-check.

    Align the ALB instance and Ingress server group configurations. To keep the ALB console configuration, run kubectl -n [$Namespace] edit ingress [$Ingress_Name] to update the Ingress. Then rerun the precheck.

    DeleteALBServerGroup

    The ALB instance server group configuration does not match the Ingress configuration.

    Rerun the precheck. Do not modify the ServerGroup during the upgrade pre-check.

    Delete the added server group and rerun the precheck.

    Error messages related to backend servers

    Error message

    Cause

    Solution

    Case 1: The backend server configuration of the ALB instance was not modified in the ALB console.

    Case 2: The backend server configuration of the ALB instance was manually modified in the ALB console.

    RegisterALBServers

    The cluster Endpoints and ALB instance backend servers do not match.

    Perform the precheck again. Do not modify the backend servers during the precheck.

    Restore the ALB instance backend servers to match the ACK or ACK Serverless cluster nodes. Then rerun the precheck.

    DeregisterALBServers

    ReplaceALBServers

    References