Quotas limit resource usage or access frequency over a period. This topic explains how ALB counts quotas for standard ALB instances, server groups, listeners, and forwarding rules so you can estimate consumption before deployment.
How quotas are calculated
ALB routes traffic through a four-level hierarchy: ALB instance → Ingresses → backend server groups (Service:port pairs) → pods. Quotas are counted at each level.
Examples below reference this diagram.
Key multiplier rule: When an Ingress is associated with multiple listeners, its forwarding rules, backend pods, and certificates are each counted once per listener.
ALB instance quotas
Additional certificates per ALB instance
Quota ID: alb_quota_loadbalancer_certificates_num_standard_edition
Certificate count = sum of additional certificates across all listeners.
Certificate count per Ingress depends on the configuration method:
| Configuration method | How certificates are counted |
|---|---|
| Automatic certificate discovery | Certificates associated with the domain in Certificate Management Service |
| Kubernetes Secrets | Secrets in the secretName field of spec.tls. Cross-namespace Secrets are included; same-namespace Secrets count once. |
AlbConfig CertificateId field |
Certificates in the CertificateId field |
| Multiple methods combined | Depends on method compatibility |
| Multiple listeners | Counted once per associated listener |
Scenario example:
| Ingress | Listeners | Certificate count |
|---|---|---|
| ALB Ingress 1 | HTTP Listener 1 | 0 (HTTP requires no certificates) |
| ALB Ingress 2 | HTTP Listener 2 | 0 (HTTP requires no certificates) |
| ALB Ingress 3 | HTTPS Listener 3, HTTPS Listener 4 (1 cert each) | 2 (1 cert x 2 listeners) |
Forwarding rules per ALB instance
Quota ID: alb_quota_loadbalancer_rules_num_standard_edition
Forwarding rule count = sum across all Ingresses on all listeners.
Rule count per Ingress = number of path entries under host in spec.rules. If associated with multiple listeners, rules are counted once per listener.
Scenario example:
| Ingress | Rules | Listeners | Total rules counted |
|---|---|---|---|
| ALB Ingress 1 | 1 | 1 | 1 |
| ALB Ingress 2 | 1 | 1 | 1 |
| ALB Ingress 3 | 1 | 2 | 2 (1 rule x 2 listeners) |
Backend servers per ALB instance
Quota ID: alb_quota_loadbalancer_servers_num_standard_edition
Backend server count = sum of pods across all Ingresses on all listeners.
Per-Ingress backend server count = total pods across all forwarding rules. If associated with multiple listeners, pods are counted once per listener.
Scenario example:
| Ingress | Pods | Listeners | Total servers counted |
|---|---|---|---|
| ALB Ingress 1 | 3 | 1 | 3 |
| ALB Ingress 2 | 3 | 1 | 3 |
| ALB Ingress 3 | 2 | 2 | 4 (2 pods x 2 listeners) |
Listeners per ALB instance
Quota ID: alb_quota_loadbalancer_listeners_num_standard_edition
Listener count = number of port:protocol pairs in the AlbConfig Listeners parameter. Per-Ingress listener count depends on the alb.ingress.kubernetes.io/listen-ports annotation.
Scenario example:
| Ingress | Listener count |
|---|---|
| ALB Ingress 1 | 1 |
| ALB Ingress 2 | 1 |
| ALB Ingress 3 | 2 |
Server group quotas
Server groups per backend server
Quota ID: alb_quota_server_added_num
Tracks how many ALB server groups contain a given pod IP.
A pod referenced in multiple forwarding rules is counted once per rule. If a rule has multiple listeners, the pod is counted once per listener per rule.
Scenario example:
| Pod | Service:port pairs | Forwarding rules | Listeners | Server group count |
|---|---|---|---|---|
| Pod 1 | Service 1:80, Service 2:80 | 1 rule per Service | 1 per rule | 2 |
| Pod 2 | Service 1:80, Service 2:80 | 1 rule per Service | 1 per rule | 2 |
| Pod 3 | Service 1:80, Service 2:80 | 1 rule per Service | 1 per rule | 2 |
| Pod 4 | Service 3:80 | 1 rule | 2 listeners | 2 |
| Pod 5 | Service 3:80 | 1 rule | 2 listeners | 2 |
Listener and rule associations per server group
Quota ID: alb_quota_servergroup_attached_num
Tracks how many listener and rule associations a server group (Service:port pair) has.
Count = forwarding rules referencing the Service:port pair. If a rule has multiple listeners, the group is counted once per listener.
Scenario example:
| Service:port | Forwarding rules | Listeners | Association count |
|---|---|---|---|
| Service 1:80 | 1 | 1 | 1 |
| Service 2:80 | 1 | 1 | 1 |
| Service 3:80 | 1 | 2 | 2 (1 rule x 2 listeners) |
Backend servers per server group
Quota ID: alb_quota_servergroup_servers_num
Backend server count = number of pod:port pairs in the server group.
Scenario example:
| Service:port | Backend servers |
|---|---|
| Service 1:80 | 3 |
| Service 2:80 | 3 |
| Service 3:80 | 2 |
Listener quotas
Network ACLs per listener
Network ACL count per listener = entries in non-empty aclConfig fields across port:protocol pairs in the AlbConfig Listeners parameter.
Scenario example:
| Listener | Network ACL count |
|---|---|
| Listener 1 | 1 |
| Listener 2 | 1 |
| Listener 3 | 0 |
| Listener 4 | 0 |
Network ACL entries per listener
ACL entry count per listener = total entries in non-empty aclConfig fields across port:protocol pairs in the AlbConfig Listeners parameter.
Scenario example:
| Listener | ACL entry count |
|---|---|
| Listener 1 | Depends on the number of ACL IDs in the aclId field |
| Listener 2 | 2 |
| Listener 3 | 0 |
| Listener 4 | 0 |
Forwarding rule quotas
Actions per forwarding rule
The action count for a forwarding rule depends on the value of the servicePort field:
servicePort value |
Action count |
|---|---|
use-annotation |
Custom actions specified by annotations |
| Any other value | Custom annotation actions + 1 |
Scenario example: ALB Ingress 1 has one rule with servicePort = 80 and no custom actions. Action count: 1.
Match conditions per forwarding rule
Quota ID: alb_quota_rule_matchevaluations_num
Match condition count = non-empty hosts + path conditions + custom annotation conditions
Path conditions are counted as follows based on pathType:
pathType value |
Conditions per path |
|---|---|
Prefix |
2 |
| Any other value | 1 |
Scenario example:
| Ingress | Hosts | Paths | Custom conditions | Match condition count |
|---|---|---|---|---|
| ALB Ingress 1 | 1 | 1 | 1 | 3 |
| ALB Ingress 2 | 1 | 1 | 0 | 2 |
| ALB Ingress 3 | 1 | 1 | 0 | 2 |
Wildcard characters per forwarding rule
Wildcard count = total wildcard characters across the rule's actions and match conditions.
Scenario example: ALB Ingress 2 has one rule with one wildcard (*) in the host condition. Wildcard count: 1.