An ingress controller starts but health checks still fail

The manifests apply cleanly, but the controller repeatedly logs subnet resolution or target health problems because the chosen subnets are only partially suitable.