### Complete Example: ALB Target Optimizer with Manual Agent Injection Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/ingress/alb-target-agent.md This example shows a minimal Kubernetes setup for ALB Target Optimizer, including namespace, deployment with the echo-app and the target control agent, a service, and an Ingress resource. Ensure the target type is 'ip' and the target control port annotation matches the agent's control port. ```yaml apiVersion: v1 kind: Namespace metadata: name: alb-target-control-example --- apiVersion: apps/v1 kind: Deployment metadata: namespace: alb-target-control-example name: echo-app spec: replicas: 2 selector: matchLabels: app: echo-app template: metadata: labels: app: echo-app spec: containers: - name: echo-server image: k8s.gcr.io/e2e-test-images/echoserver:2.5 ports: - containerPort: 8080 initContainers: - name: alb-target-control-agent image: public.ecr.aws/aws-elb/target-optimizer/target-control-agent:latest imagePullPolicy: Always restartPolicy: Always env: - name: TARGET_CONTROL_DATA_ADDRESS value: "0.0.0.0:80" # Agent listens on port 80 for data - name: TARGET_CONTROL_CONTROL_ADDRESS value: "0.0.0.0:3000" # Agent listens on port 3000 for control - name: TARGET_CONTROL_DESTINATION value: "127.0.0.1:8080" # Forward to echo server - name: TARGET_CONTROL_MAX_CONCURRENCY value: "100" ports: - containerPort: 80 # Data port - containerPort: 3000 # Control port --- apiVersion: v1 kind: Service metadata: namespace: alb-target-control-example name: echo-service spec: selector: app: echo-app ports: - port: 80 targetPort: 80 # Target agent's data port protocol: TCP type: NodePort --- apiVersion: networking.k8s.io/v1 kind: Ingress metadata: namespace: alb-target-control-example name: echo-ingress annotations: alb.ingress.kubernetes.io/scheme: internet-facing alb.ingress.kubernetes.io/target-type: ip # Required for target control alb.ingress.kubernetes.io/target-control-port.echo-service.80: "3000" # Must match agent control port spec: ingressClassName: alb rules: - http: paths: - path: / pathType: Prefix backend: service: name: echo-service port: number: 80 ``` -------------------------------- ### Install lbc-migrate Tool Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/ingress2gateway/lbc_migrate_reference.md Install the lbc-migrate binary to your system's PATH by creating a symlink. This ensures that future rebuilds are automatically reflected. ```bash make install-lbc-migrate ``` -------------------------------- ### Install Controller with Helm (No IRSA) Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/deploy/installation.md Install the AWS Load Balancer Controller using Helm for clusters not configured with IRSA. ```bash helm install aws-load-balancer-controller eks/aws-load-balancer-controller -n kube-system --set clusterName= ``` -------------------------------- ### ExternalDNS Log Output Example Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/integrations/external_dns.md This is an example of the log output you should see from the external-dns pod after successful deployment, showing its configuration details. ```text time="2019-12-11T10:26:05Z" level=info msg="config: {Master: KubeConfig: RequestTimeout:30s IstioIngressGateway:istio-system/istio-ingressgateway Sources:[service ingress] Namespace: AnnotationFilter: FQDNTemplate: CombineFQDNAndAnnotation:false Compatibility: PublishInternal:false PublishHostIP:false ConnectorSourceServer:localhost:8080 Provider:aws GoogleProject: DomainFilter:[test-dns.com] ZoneIDFilter:[] AlibabaCloudConfigFile:/etc/kubernetes/alibaba-cloud.json AlibabaCloudZoneType: AWSZoneType:public AWSAssumeRole: AWSBatchChangeSize:4000 AWSBatchChangeInterval:1s AWSEvaluateTargetHealth:true AzureConfigFile:/etc/kubernetes/azure.json AzureResourceGroup: CloudflareProxied:false InfobloxGridHost: InfobloxWapiPort:443 InfobloxWapiUsername:admin InfobloxWapiPassword: InfobloxWapiVersion:2.3.1 InfobloxSSLVerify:true DynCustomerName: DynUsername: DynPassword: DynMinTTLSeconds:0 OCIConfigFile:/etc/kubernetes/oci.yaml InMemoryZones:[] PDNSServer:http://localhost:8081 PDNSAPIKey: PDNSTLSEnabled:false TLSCA: TLSClientCert: TLSClientCertKey: Policy:upsert-only Registry:txt TXTOwnerID:my-identifier TXTPrefix: Interval:1m0s Once:false DryRun:false LogFormat:text MetricsAddress::7979 LogLevel:info TXTCacheInterval:0s ExoscaleEndpoint:https://api.exoscale.ch/dns ExoscaleAPIKey: ExoscaleAPISecret: CRDSourceAPIVersion:externaldns.k8s.io/v1alpha CRDSourceKind:DNSEndpoint ServiceTypeFilter:[] RFC2136Host: RFC2136Port:0 RFC2136Zone: RFC2136Insecure:false RFC2136TSIGKeyName: RFC2136TSIGSecret: RFC2136TSIGSecretAlg: RFC2136TAXFR:false}" time="2019-12-11T10:26:05Z" level=info msg="Created Kubernetes client https://10.100.0.1:443" ``` -------------------------------- ### Build and Install lbc-migrate CLI Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/ingress2gateway/migrate_from_ingress.md Build the `lbc-migrate` CLI from the aws-load-balancer-controller repository. Optionally, install it on your system's PATH for easier access. ```bash # Build from the aws-load-balancer-controller repo make lbc-migrate # (Optional) Install on your PATH make install-lbc-migrate ``` -------------------------------- ### Cluster Information Output Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/examples/echo_server.md Example output from `eksctl get cluster`, showing cluster name, VPC, subnets, and security groups. ```console NAME VERSION STATUS CREATED VPC SUBNETS * Deploy the ingress resource for echoserver ```bash kubectl apply -f echoserver-ingress.yaml ``` 1. Verify the aws-load-balancer-controller creates the resources ```bash kubectl logs -n kube-system --tail -1 -l app.kubernetes.io/name=aws-load-balancer-controller | grep 'echoserver/echoserver' ``` You should see similar to the following. ```console ``` ``` -------------------------------- ### ALB Gateway Setup Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/gateway/gateway_chaining.md Configure an internal ALB Gateway with HTTP and HTTPS listeners. This setup requires a LoadBalancerConfiguration for the ALB. ```yaml apiVersion: gateway.networking.k8s.io/v1beta1 kind: GatewayClass metadata: name: aws-alb-gateway-class spec: controllerName: gateway.k8s.aws/alb --- # my-alb-gateway.yaml apiVersion: gateway.networking.k8s.io/v1beta1 kind: Gateway metadata: name: my-alb-gateway namespace: example-ns spec: gatewayClassName: aws-alb-gateway-class infrastructure: parametersRef: kind: LoadBalancerConfiguration name: alb-lb-config group: gateway.k8s.aws listeners: - name: http protocol: HTTP port: 80 allowedRoutes: namespaces: from: Same - name: https protocol: HTTPS port: 443 allowedRoutes: namespaces: from: Same --- # lbconfig.yaml apiVersion: gateway.k8s.aws/v1beta1 kind: LoadBalancerConfiguration metadata: name: alb-lb-config namespace: example-ns spec: listenerConfigurations: - protocolPort: HTTPS:443 defaultCertificate: --- # httproute.yaml apiVersion: gateway.networking.k8s.io/v1beta1 kind: HTTPRoute metadata: name: my-http-app-route namespace: example-ns spec: parentRefs: - group: gateway.networking.k8s.io kind: Gateway name: my-alb-gateway sectionName: http - group: gateway.networking.k8s.io kind: Gateway name: my-alb-gateway sectionName: https rules: - backendRefs: - name: echoserver port: 80 ``` -------------------------------- ### RouteConfigurations Example Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/gateway/targetgroupconfig.md Applies route-specific configurations using a specificity-based matching algorithm. ```yaml apiVersion: gateway.k8s.aws/v1beta1 kind: TargetGroupConfiguration metadata: name: route-specific-config namespace: example-ns spec: targetReference: name: my-service defaultConfiguration: targetType: ip routeConfigurations: - routeIdentifier: kind: HTTPRoute namespace: example-ns-1 name: api-route targetGroupProps: healthCheckConfig: healthCheckPath: /api/health healthCheckProtocol: HTTP - routeIdentifier: kind: HTTPRoute namespace: example-ns-2 name: admin-route targetGroupProps: healthCheckConfig: healthCheckPath: /admin/health healthCheckInterval: 10 ``` -------------------------------- ### EchoServer Resource Output Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/examples/echo_server.md Example output showing the created echoserver service and deployment. This confirms the resources are running. ```console NAME CLUSTER-IP EXTERNAL-IP PORT(S) AGE svc/echoserver 10.3.31.76 80:31027/TCP 4d NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE deploy/echoserver 1 1 1 1 4d ``` -------------------------------- ### Install AWS Load Balancer Controller with IAM Roles for Service Account Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/helm/aws-load-balancer-controller/README.md Installs the controller using Helm, assuming IAM Roles for Service Accounts are configured. Ensure `serviceAccount.create` is false and `serviceAccount.name` is set to `aws-load-balancer-controller`. ```sh helm repo add eks https://aws.github.io/eks-charts # If using IAM Roles for service account install as follows - NOTE: you need to specify both of the chart values `serviceAccount.create=false` and `serviceAccount.name=aws-load-balancer-controller` helm install aws-load-balancer-controller eks/aws-load-balancer-controller --set clusterName=my-cluster -n kube-system --set serviceAccount.create=false --set serviceAccount.name=aws-load-balancer-controller ``` -------------------------------- ### Install Controller with Helm (IRSA) Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/deploy/installation.md Install the AWS Load Balancer Controller using Helm for clusters configured with IAM Roles for Service Accounts (IRSA). ```bash helm install aws-load-balancer-controller eks/aws-load-balancer-controller -n kube-system --set clusterName= --set serviceAccount.create=false --set serviceAccount.name=aws-load-balancer-controller ``` -------------------------------- ### Missing Resource Warnings Example Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/ingress2gateway/lbc_migrate_reference.md When using file-based input, the tool warns about referenced resources (like Services or IngressClasses) that are not provided in the input files. These warnings are informational. ```bash WARNING: Ingress "default/my-ingress" references Service "api-service" but it was not provided. Service-level annotation overrides may be missing. WARNING: Ingress "default/my-ingress" uses IngressClass "alb" but it was not provided. IngressClassParams overrides may be missing. Tip: Use --from-cluster to automatically read all referenced resources, or include Service/IngressClass/IngressClassParams files in your input. ``` -------------------------------- ### Install cert-manager Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/deploy/installation.md Install the cert-manager component, which is a prerequisite for the AWS Load Balancer Controller when using YAML manifests. ```bash kubectl apply --validate=false -f https://github.com/cert-manager/cert-manager/releases/download/v1.12.3/cert-manager.yaml ``` -------------------------------- ### DefaultConfiguration Example Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/gateway/targetgroupconfig.md Defines fallback configuration applied to all routes, unless overridden by route-specific configurations. ```yaml apiVersion: gateway.k8s.aws/v1beta1 kind: TargetGroupConfiguration metadata: name: example-tg-config namespace: example-ns spec: targetReference: name: my-service defaultConfiguration: targetGroupName: my-target-group targetType: ip ``` -------------------------------- ### Example using Target Group Stickiness Config Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/ingress/annotations.md When using `alb.ingress.kubernetes.io/target-group-attributes` with `stickiness.enabled=true`, you must add `TargetGroupStickinessConfig` under `alb.ingress.kubernetes.io/actions.weighted-routing` to enable target group stickiness. ```yaml alb.ingress.kubernetes.io/actions.weighted-routing: targetGroupStickinessConfig: enabled: true durationSeconds: 3600 attributes: - key: "lb_cookie.name" value: "my_cookie" - key: "lb_cookie.path" value: "/" - key: "lb_cookie.domain" value: "example.com" - key: "lb_cookie.ttl" value: "300" ``` -------------------------------- ### ListenerSet Status Example Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/gateway/listenersets.md Illustrates the status of a ListenerSet, including top-level `Accepted` and `Programmed` conditions, and per-listener status details. ```yaml status: conditions: - type: Accepted status: "True" reason: Accepted - type: Programmed status: "True" reason: Programmed listeners: - name: app-http attachedRoutes: 1 conditions: - type: Accepted status: "True" reason: Accepted - type: Programmed status: "True" reason: Programmed - type: Conflicted status: "False" reason: NoConflicts - type: ResolvedRefs status: "True" reason: ResolvedRefs ``` -------------------------------- ### Create EKS Cluster with eksctl Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/examples/echo_server.md Use this command to create a new EKS cluster. Ensure eksctl is installed and configured. ```bash eksctl create cluster ``` -------------------------------- ### Example AWS Load Balancer Controller Log Output Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/examples/echo_server.md This is an example of the expected log output from a successfully running AWS Load Balancer controller. It indicates the version, active components, and successful leader election. ```json {"level":"info","ts":1602778062.2588625,"logger":"setup","msg":"version","GitVersion":"v2.0.0-rc3-13-gcdc8f715-dirty","GitCommit":"cdc8f715919cc65ca8161b6083c4091222632d6b","BuildDate":"2020-10-15T15:58:31+0000"} {"level":"info","ts":1602778065.4515743,"logger":"controller-runtime.metrics","msg":"metrics server is starting to listen","addr":":8080"} {"level":"info","ts":1602778065.4536595,"logger":"controller-runtime.webhook","msg":"registering webhook","path":"/mutate-v1-pod"} {"level":"info","ts":1602778065.4537156,"logger":"controller-runtime.webhook","msg":"registering webhook","path":"/mutate-elbv2-k8s-aws-v1beta1-targetgroupbinding"} {"level":"info","ts":1602778065.4537542,"logger":"controller-runtime.webhook","msg":"registering webhook","path":"/validate-elbv2-k8s-aws-v1beta1-targetgroupbinding"} {"level":"info","ts":1602778065.4537594,"logger":"setup","msg":"starting manager"} I1015 16:07:45.453851 1 leaderelection.go:242] attempting to acquire leader lease kube-system/aws-load-balancer-controller-leader... {"level":"info","ts":1602778065.5544264,"logger":"controller-runtime.manager","msg":"starting metrics server","path":"/metrics"} {"level":"info","ts":1602778065.5544496,"logger":"controller-runtime.webhook.webhooks","msg":"starting webhook server"} {"level":"info","ts":1602778065.5549548,"logger":"controller-runtime.certwatcher","msg":"Updated current TLS certificate"} {"level":"info","ts":1602778065.5550802,"logger":"controller-runtime.webhook","msg":"serving webhook server","host":"","port":9443} {"level":"info","ts":1602778065.5551715,"logger":"controller-runtime.certwatcher","msg":"Starting certificate watcher"} I1015 16:08:03.662023 1 leaderelection.go:252] successfully acquired lease kube-system/aws-load-balancer-controller-leader {"level":"info","ts":1602778083.663017,"logger":"controller-runtime.controller","msg":"Starting EventSource","controller":"targetGroupBinding","source":"kind source: /, Kind="} {"level":"info","ts":1602778083.6631303,"logger":"controller-runtime.controller","msg":"Starting EventSource","controller":"targetGroupBinding","source":"kind source: /, Kind="} {"level":"info","ts":1602778083.6633205,"logger":"controller-runtime.controller","msg":"Starting EventSource","controller":"ingress","source":"channel source: 0xc0007340f0"} {"level":"info","ts":1602778083.6633654,"logger":"controller-runtime.controller","msg":"Starting EventSource","controller":"ingress","source":"channel source: 0xc000734140"} {"level":"info","ts":1602778083.6633892,"logger":"controller-runtime.controller","msg":"Starting EventSource","controller":"ingress","source":"kind source: /, Kind="} {"level":"info","ts":1602778083.663441,"logger":"controller-runtime.controller","msg":"Starting EventSource","controller":"ingress","source":"kind source: /, Kind="} {"level":"info","ts":1602778083.6634624,"logger":"controller-runtime.controller","msg":"Starting EventSource","controller":"ingress","source":"kind source: /, Kind="} {"level":"info","ts":1602778083.6635776,"logger":"controller-runtime.controller","msg":"Starting EventSource","controller":"service","source":"kind source: /, Kind="} {"level":"info","ts":1602778083.6636262,"logger":"controller-runtime.controller","msg":"Starting Controller","controller":"service"} {"level":"info","ts":1602778083.7634695,"logger":"controller-runtime.controller","msg":"Starting EventSource","controller":"targetGroupBinding","source":"kind source: /, Kind="} {"level":"info","ts":1602778083.7637022,"logger":"controller-runtime.controller","msg":"Starting workers","controller":"service","worker count":3} {"level":"info","ts":1602778083.7641882,"logger":"controller-runtime.controller","msg":"Starting Controller","controller":"ingress"} {"level":"info","ts":1602778083.8641882,"logger":"controller-runtime.controller","msg":"Starting Controller","controller":"targetGroupBinding"} {"level":"info","ts":1602778083.864236,"logger":"controller-runtime.controller","msg":"Starting workers","controller":"targetGroupBinding","worker count":3} {"level":"info","ts":1602778083.8643816,"logger":"controller-runtime.controller","msg":"Starting workers","controller":"ingress","worker count":3} ``` -------------------------------- ### BYOIP (Bring Your Own IP) Configuration Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/globalaccelerator/examples.md Configure Global Accelerator to use your own IP addresses allocated through the Bring Your Own IP (BYOIP) service. This example assigns a specific IP address to the accelerator. ```yaml apiVersion: aga.k8s.aws/v1beta1 kind: GlobalAccelerator metadata: name: byoip-accelerator namespace: default spec: name: "byoip-accelerator" ipAddressType: IPV4 ipAddresses: - "198.51.100.10" # Your own IP from BYOIP pool listeners: - protocol: TCP portRanges: - fromPort: 443 toPort: 443 endpointGroups: - endpoints: - type: Ingress name: secure-ingress ``` -------------------------------- ### Gateway Status Example Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/gateway/listenersets.md Shows the `status.attachedListenerSets` field indicating the count of successfully accepted ListenerSets. ```yaml status: attachedListenerSets: 2 addresses: - type: Hostname value: my-alb-1234567890.us-west-2.elb.amazonaws.com ``` -------------------------------- ### Deploy gRPC Server Manifests Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/examples/grpc_server.md Apply the Kubernetes manifests to deploy the gRPC server. Ensure you have the necessary prerequisites like an EKS cluster and the aws-load-balancer-controller installed. ```bash kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/main/docs/examples/grpc/grpcserver-namespace.yaml kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/main/docs/examples/grpc/grpcserver-service.yaml kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/main/docs/examples/grpc/grpcserver-deployment.yaml ``` -------------------------------- ### Configure Ingress for External-DNS Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/examples/echo_server.md Update your ingress resource to include `spec.rules[0].host` with your domain name. This example uses `echoserver.example.org`. ```yaml spec: rules: - host: echoserver.example.org http: paths: ``` -------------------------------- ### Ingress with Host Header Condition Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/ingress/annotations.md This example demonstrates how to define an Ingress resource with a specific host-header condition using the `alb.ingress.kubernetes.io/conditions.rule-path1` annotation. It also includes a corresponding fixed-response action. ```yaml apiVersion: networking.k8s.io/v1 kind: Ingress metadata: namespace: default name: ingress annotations: alb.ingress.kubernetes.io/scheme: internet-facing alb.ingress.kubernetes.io/actions.rule-path1: > {"type":"fixed-response","fixedResponseConfig":{"contentType":"text/plain","statusCode":"200","messageBody":"Host is www.example.com OR anno.example.com"}} alb.ingress.kubernetes.io/conditions.rule-path1: > [{"field":"host-header","hostHeaderConfig":{"values":["anno.example.com"]}}] ``` -------------------------------- ### Add Source IP Routing Conditions with Index Matching Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/gateway/customization.md This example shows how to apply source IP conditions to specific indices within a ListenerRuleConfiguration, allowing for more granular control over routing rules. ```yaml # source-ip-condition.yaml apiVersion: gateway.k8s.aws/v1beta1 kind: ListenerRuleConfiguration metadata: name: custom-rule-config-source-ip namespace: example-ns spec: conditions: - field: source-ip matchIndexes: [0,1] sourceIPConfig: values: - 10.0.0.0/5 ``` -------------------------------- ### Blue-Green Deployment Configuration Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/globalaccelerator/examples.md Utilize endpoint weights in Global Accelerator to manage blue-green deployments. This example directs 80% of traffic to the stable 'blue' environment and 20% to the new 'green' environment. ```yaml apiVersion: aga.k8s.aws/v1beta1 kind: GlobalAccelerator metadata: name: blue-green-accelerator namespace: default spec: name: "blue-green-accelerator" ipAddressType: IPV4 listeners: - protocol: TCP portRanges: - fromPort: 80 toPort: 80 - fromPort: 443 toPort: 443 endpointGroups: - endpoints: # Blue environment (current stable version) - type: Service name: blue-service weight: 200 # 80% of traffic (200/250) - stable version gets majority # Green environment (new version being deployed) - type: Service name: green-service weight: 50 # 20% of traffic (50/250) - new version gets smaller portion for testing ``` -------------------------------- ### NLB Gateway Setup for Chaining Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/gateway/gateway_chaining.md Configure an internet-facing NLB Gateway with TCP listeners to forward traffic to the ALB Gateway. This requires a LoadBalancerConfiguration specifying 'internet-facing' scheme. ```yaml apiVersion: gateway.networking.k8s.io/v1beta1 kind: GatewayClass metadata: name: aws-nlb-gateway-class spec: controllerName: gateway.k8s.aws/nlb --- # my-nlb-gateway.yaml apiVersion: gateway.networking.k8s.io/v1beta1 kind: Gateway metadata: name: my-tcp-gateway namespace: example-ns spec: gatewayClassName: aws-nlb-gateway-class infrastructure: parametersRef: group: gateway.k8s.aws kind: LoadBalancerConfiguration name: nlb-lb-config listeners: - name: unsecure protocol: TCP port: 80 allowedRoutes: namespaces: from: Same - name: secure protocol: TCP port: 443 allowedRoutes: namespaces: from: Same --- # lbconfig.yaml apiVersion: gateway.k8s.aws/v1beta1 kind: LoadBalancerConfiguration metadata: name: nlb-lb-config namespace: example-ns spec: scheme: internet-facing --- # my-unsecure-tcproute.yaml apiVersion: gateway.networking.k8s.io/v1alpha2 kind: TCPRoute metadata: name: my-unsecure-app-route namespace: example-ns spec: parentRefs: - group: gateway.networking.k8s.io kind: Gateway name: my-tcp-gateway sectionName: unsecure rules: - backendRefs: - name: my-alb-gateway kind: Gateway port: 80 --- # my-secure-tcproute.yaml apiVersion: gateway.networking.k8s.io/v1alpha2 kind: TCPRoute metadata: name: my-secure-app-route namespace: example-ns spec: parentRefs: - group: gateway.networking.k8s.io kind: Gateway name: my-tcp-gateway sectionName: secure rules: - backendRefs: - name: my-alb-gateway kind: Gateway port: 443 ``` -------------------------------- ### Verify AWS Load Balancer Controller Deployment Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/examples/echo_server.md Use this command to check the logs of the AWS Load Balancer controller to ensure it has started successfully. This helps in diagnosing any startup issues. ```bash kubectl logs -n kube-system --tail -1 -l app.kubernetes.io/name=aws-load-balancer-controller ``` -------------------------------- ### Run a Conformance Profile Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/conformance/README.md Execute a complete conformance profile, such as GATEWAY-HTTP. Specify the profile with '--conformance-profiles' and supported features with '--supported-features'. Use '--skip-tests' to exclude specific tests. ```bash go test -v ./conformance \ --gateway-class=REPLACE_WITH_YOUR_GW_CLASS \ --allow-crds-mismatch=true --cleanup-base-resources=false \ --conformance-profiles=GATEWAY-HTTP \ --supported-features=Gateway,HTTPRoute \ --skip-tests=GatewaySecretInvalidReferenceGrant \ --debug=true ``` -------------------------------- ### Download ExternalDNS Manifest Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/integrations/external_dns.md Download the sample external-dns manifest file. This is the first step in setting up ExternalDNS. ```bash wget https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/main/docs/examples/external-dns.yaml ``` -------------------------------- ### Ingress with HTTP Request Method Condition Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/ingress/annotations.md This example demonstrates an Ingress resource with an http-request-method condition specified via `alb.ingress.kubernetes.io/conditions.rule-path4`. It allows routing based on GET or HEAD methods and includes a fixed-response action. ```yaml apiVersion: networking.k8s.io/v1 kind: Ingress metadata: namespace: default name: ingress annotations: alb.ingress.kubernetes.io/scheme: internet-facing alb.ingress.kubernetes.io/actions.rule-path4: > {"type":"fixed-response","fixedResponseConfig":{"contentType":"text/plain","statusCode":"200","messageBody":"Http request method is GET OR HEAD"}} alb.ingress.kubernetes.io/conditions.rule-path4: > [{"field":"http-request-method","httpRequestMethodConfig":{"Values":["GET", "HEAD"]}}] ``` -------------------------------- ### Cross-Region Manual Endpoint Configuration Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/globalaccelerator/examples.md Set up a Global Accelerator with manual endpoint registration using ARNs for cross-region traffic distribution. This example splits traffic 50/50 between local and a remote region. ```yaml apiVersion: aga.k8s.aws/v1beta1 kind: GlobalAccelerator metadata: name: cross-region-accelerator namespace: default spec: name: "cross-region-accelerator" ipAddressType: IPV4 listeners: - protocol: TCP portRanges: - fromPort: 443 toPort: 443 endpointGroups: # Local region endpoint group - endpoints: - type: Service name: local-service # Remote region endpoint group - region: us-west-2 # Specific AWS region trafficDialPercentage: 50 # Split traffic 50% endpoints: - type: EndpointID endpointID: arn:aws:elasticloadbalancing:us-west-2:123456789012:loadbalancer/app/remote-lb/1234567890123456 weight: 128 ``` -------------------------------- ### Install CRDs for Helm Upgrade Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/deploy/installation.md If upgrading an existing Helm chart installation, you need to manually apply the TargetGroupBinding CRDs. The `helm install` command applies these automatically. ```bash wget https://raw.githubusercontent.com/aws/eks-charts/master/stable/aws-load-balancer-controller/crds/crds.yaml ``` ```bash kubectl apply -f crds.yaml ``` -------------------------------- ### Launch Migration Console Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/ingress2gateway/lbc_migrate_reference.md Use the '--console' flag to launch a web UI for comparing Ingress and Gateway dry-run models during migration. ```bash lbc-migrate --console ``` -------------------------------- ### Launch the migration console Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/ingress2gateway/migrate_from_ingress.md Start the migration console to preview the differences between the Ingress and Gateway API plans. The console runs locally and compares the generated plans without modifying any cluster or AWS resources. ```bash lbc-migrate --console ``` ```bash lbc-migrate --console --port 9000 ``` -------------------------------- ### Migrate from Live Cluster (All Namespaces) Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/ingress2gateway/lbc_migrate_reference.md Migrate all Ingress resources from all namespaces in a live Kubernetes cluster. ```bash lbc-migrate --from-cluster --all-namespaces --output-dir ./gateway-output/ ``` -------------------------------- ### Deploy EchoServer Resources Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/examples/echo_server.md Apply the namespace, service, and deployment manifests for the echoserver. Ensure these resources are created before proceeding. ```bash kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v3.4.0/docs/examples/echoservice/echoserver-namespace.yaml &&\ kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v3.4.0/docs/examples/echoservice/echoserver-service.yaml &&\ kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v3.4.0/docs/examples/echoservice/echoserver-deployment.yaml ``` -------------------------------- ### Verify GlobalAccelerator CRD Installation Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/globalaccelerator/installation.md Check if the GlobalAccelerator CRD has been successfully installed by listing custom resource definitions and filtering for the GlobalAccelerator CRD. ```bash kubectl get crd | grep globalaccelerators.aga.k8s.aws ``` -------------------------------- ### Set Target Group Slow Start Duration Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/ingress/annotations.md Configure the slow start duration for a target group. The available range is 30-900 seconds. ```yaml alb.ingress.kubernetes.io/target-group-attributes: slow_start.duration_seconds=30 ``` -------------------------------- ### Run lbc-migrate with Go Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/ingress2gateway/lbc_migrate_reference.md Execute the lbc-migrate tool directly using 'go run' without building a binary. This is useful for quick tests or when a build is not desired. ```bash go run ./cmd/lbc-migrate/ [flags] ``` -------------------------------- ### Migrate from Live Cluster (Specific Namespaces) Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/ingress2gateway/lbc_migrate_reference.md Use '--from-cluster' with '--namespaces' to specify a comma-separated list of namespaces from which to read Ingress resources in a live cluster. ```bash lbc-migrate --from-cluster --namespaces production ``` -------------------------------- ### Migrate from Directory Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/ingress2gateway/lbc_migrate_reference.md Use the '--input-dir' flag to process all YAML/JSON files within a specified directory for migration. ```bash lbc-migrate --input-dir ./my-manifests/ ``` -------------------------------- ### Install AWS Load Balancer Controller without IAM Roles for Service Account Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/helm/aws-load-balancer-controller/README.md Installs the controller using Helm when IAM Roles for Service Accounts are not being used. ```sh # If not using IAM Roles for service account helm install aws-load-balancer-controller eks/aws-load-balancer-controller --set clusterName=my-cluster -n kube-system ``` -------------------------------- ### Install Experimental Gateway API CRDs Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/gateway/gateway.md Installs the experimental Gateway API CRDs, which are necessary for L4 routes like TLSRoute. This is optional and depends on your specific routing needs. ```bash kubectl apply --server-side=true -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.5.0/experimental-install.yaml ``` -------------------------------- ### Install Standard Gateway API CRDs Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/gateway/gateway.md Installs the standard Gateway API CRDs required for basic functionality. This command is essential for using Gateway API objects with the controller. ```bash kubectl apply --server-side=true -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.5.0/standard-install.yaml ``` -------------------------------- ### Install AWS Load Balancer Controller without IAM Service Account Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/helm/aws-load-balancer-controller/README.md Install the AWS Load Balancer controller using Helm when not using an IAM Service Account. Ensure the clusterName is set. ```shell helm upgrade -i aws-load-balancer-controller eks/aws-load-balancer-controller -n kube-system --set clusterName= ``` -------------------------------- ### Migrate from Live Cluster (Multiple Namespaces) Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/ingress2gateway/lbc_migrate_reference.md Migrate Ingress resources from multiple specified namespaces in a live Kubernetes cluster. ```bash lbc-migrate --from-cluster --namespaces team-a,team-b --output-dir ./gateway-output/ ``` -------------------------------- ### Install AWS Load Balancer Controller with IAM Service Account Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/helm/aws-load-balancer-controller/README.md Install the AWS Load Balancer controller using Helm, configuring it to use an IAM Service Account. Ensure the clusterName is set. ```shell # NOTE: The clusterName value must be set either via the values.yaml or the Helm command line. The in the command # below should be replaced with name of your k8s cluster before running it. helm upgrade -i aws-load-balancer-controller eks/aws-load-balancer-controller -n kube-system --set clusterName= --set serviceAccount.create=false --set serviceAccount.name=aws-load-balancer-controller ``` -------------------------------- ### Migrate from Live Cluster (All Namespaces) Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/ingress2gateway/lbc_migrate_reference.md Use '--from-cluster' with '--all-namespaces' to read Ingress resources from all namespaces in a live Kubernetes cluster. Requires read-only access. ```bash lbc-migrate --from-cluster --all-namespaces ``` -------------------------------- ### Test Secure gRPC Service with Client Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/examples/grpc_server.md Run the greeter client to test your secure gRPC service. Replace YOUR_DOMAIN_NAME with the domain configured in your ingress manifest. This confirms the end-to-end functionality. ```bash docker run --rm -it --env BACKEND=YOUR_DOMAIN_NAME placeexchange/grpc-demo:latest python greeter_client.py ``` -------------------------------- ### Build lbc-migrate Tool Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/ingress2gateway/lbc_migrate_reference.md Build the lbc-migrate binary from the source code. The binary will be located in the 'bin/' directory. ```bash make lbc-migrate ``` -------------------------------- ### Install LBC Gateway API CRDs Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/gateway/gateway.md Installs the AWS Load Balancer Controller's specific CRDs for Gateway API integration. These are required for the controller to manage AWS resources based on Gateway API objects. ```bash kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/refs/heads/main/config/crd/gateway/gateway-crds.yaml ``` -------------------------------- ### Create Source Code Directories Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/controller-devel.md Ensures the necessary directory structure exists in your Go workspace for the Kubernetes SIGs organization. ```bash mkdir -p $GOPATH/src/sigs.k8s.io ``` -------------------------------- ### Install CRDs Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/controller-devel.md Applies the Custom Resource Definitions to your Kubernetes cluster. This is necessary before deploying the controller. ```bash make install ``` -------------------------------- ### Configure Namespace for QUIC Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/use_cases/quic/index.md Create a namespace and label it to enable server ID injection for QUIC traffic. This is required for pods annotated with `service.beta.kubernetes.io/aws-load-balancer-quic-enabled-containers`. ```bash kubectl create ns quic-example kubectl label namespace quic-example elbv2.k8s.aws/quic-server-id-inject=enabled ``` -------------------------------- ### Check AWSALBIngressController Version Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/deploy/upgrade/migrate_v1_v2.md Use this command to determine the currently installed version of the AWSALBIngressController deployment. ```bash kubectl describe deployment -n kube-system alb-ingress-controller | grep Image ``` -------------------------------- ### Apply Controller Manifest Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/deploy/installation.md Apply the modified YAML manifest to install the AWS Load Balancer Controller. ```bash kubectl apply -f v3_4_0_full.yaml ``` -------------------------------- ### Build and Push Docker Image Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/controller-devel.md Builds the controller's container image and pushes it to a container registry. This is typically done before deployment. ```bash make docker-push ``` -------------------------------- ### Ingress Resource with Specific Class Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/deploy/configurations.md An example of an Ingress resource that will be managed by the controller when configured with the matching 'ingressClassName'. ```yaml apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: echoserver namespace: echoserver spec: ingressClassName: alb ... ``` -------------------------------- ### Run a Single Conformance Test Case Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/conformance/README.md Execute a specific conformance test case for debugging. Use '--run-test' to specify the test and '--debug=true' for verbose logging. Adjust '--gateway-class' as needed. ```bash go test ./conformance -run TestConformance -v -args \ --gateway-class=REPLACE_WITH_GATEWAY_CLASS_NAME \ --run-test=HTTPRouteExactPathMatching --allow-crds-mismatch=true --cleanup-base-resources=false \ --debug=true ``` -------------------------------- ### Multiple Listeners with Different Protocols for Global Accelerator Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/globalaccelerator/examples.md Creates a Global Accelerator with both TCP and UDP listeners for different services. Demonstrates multi-protocol support. ```yaml apiVersion: aga.k8s.aws/v1beta1 kind: GlobalAccelerator metadata: name: multi-protocol-accelerator namespace: default spec: name: "multi-protocol-accelerator" ipAddressType: IPV4 listeners: - protocol: TCP portRanges: - fromPort: 80 toPort: 80 - fromPort: 443 toPort: 443 clientAffinity: SOURCE_IP endpointGroups: - endpoints: - type: Ingress name: web-ingress - protocol: UDP portRanges: - fromPort: 53 toPort: 53 clientAffinity: NONE endpointGroups: - endpoints: - type: Service name: dns-service ``` -------------------------------- ### Host Header Rewrite Transform Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/ingress/annotations.md Modify the host header of incoming requests. This example replaces 'example.com' with 'example.org'. ```yaml alb.ingress.kubernetes.io/transforms.my-service: > [ { "type": "host-rewrite", "hostRewriteConfig": { "host": "example.org" } } ] ``` -------------------------------- ### Set Output Format Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/ingress2gateway/lbc_migrate_reference.md Use the '--output-format' flag to choose between 'yaml' (default) or 'json' for the output manifests. ```bash lbc-migrate --output-format json ``` -------------------------------- ### Add Helm Repository Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/deploy/installation.md Add the EKS chart repository to your Helm configuration. This is a prerequisite for installing the controller via Helm. ```bash helm repo add eks https://aws.github.io/eks-charts ``` -------------------------------- ### Install TargetGroupBinding CRDs Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/helm/aws-load-balancer-controller/README.md Apply the TargetGroupBinding Custom Resource Definitions (CRDs) required for the AWS Load Balancer Controller. ```shell kubectl apply -k "github.com/aws/eks-charts/stable/aws-load-balancer-controller/crds?ref=master" ``` -------------------------------- ### URL Rewrite Transform Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/ingress/annotations.md Apply URL rewrite transformations to incoming requests. This example removes the leading '/api/' from request paths. ```yaml alb.ingress.kubernetes.io/transforms.my-service: > [ { "type": "url-rewrite", "urlRewriteConfig": { "rewrites": [ { "regex": "^\\/api\\/(.+)$", "replace": "/$1" } ] } } ] ``` -------------------------------- ### Monitor ALB and DNS Provisioning Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/examples/grpc_server.md Check the logs of the aws-load-balancer-controller and external-dns to ensure the ALB is created and a DNS record is set up for your domain. This step is crucial for external access to the gRPC service. ```bash kubectl logs -n kube-system --tail -1 -l app.kubernetes.io/name=aws-load-balancer-controller | grep 'grpcserver/grpcserver' kubectl logs -n kube-system --tail -1 -l app.kubernetes.io/name=external-dns | grep 'YOUR_DOMAIN_NAME' ``` -------------------------------- ### LoadBalancerConfiguration for Header Modification Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/gateway/l7gateway.md Configure request header modifications using LoadBalancerConfiguration and Listener Attributes. This example sets the Access-Control-Allow-Origin header. ```yaml apiVersion: gateway.k8s.aws/v1beta1 kind: LoadBalancerConfiguration metadata: name: example-config namespace: example-ns spec: listenerConfigurations: - protocolPort: HTTPS:443 defaultCertificate: my-cert listenerAttributes: - key: routing.http.response.access_control_allow_origin.header_value value: example.com ``` -------------------------------- ### Download Ingress Resources Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/deploy/installation.md Optionally download the default IngressClass and IngressClass parameters for the controller. ```bash wget https://github.com/kubernetes-sigs/aws-load-balancer-controller/releases/download/v3.4.0/v3_4_0_ingclass.yaml ``` -------------------------------- ### Gateway API Acceleration with Global Accelerator Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/globalaccelerator/examples.md Accelerates traffic to a Gateway API resource. Requires Gateway API CRDs to be installed in your cluster. ```yaml apiVersion: aga.k8s.aws/v1beta1 kind: GlobalAccelerator metadata: name: gateway-accelerator namespace: gateway-ns spec: name: "gateway-accelerator" ipAddressType: IPV4 listeners: - protocol: TCP portRanges: - fromPort: 80 toPort: 80 - fromPort: 443 toPort: 443 endpointGroups: - endpoints: - type: Gateway name: my-gateway weight: 128 ``` -------------------------------- ### Verify DNS Propagation with Dig Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/examples/echo_server.md Use the `dig` command to verify that the DNS record for your specified host has propagated. This example checks `echoserver.example.org`. ```bash dig echoserver.example.org ``` ```console ;; QUESTION SECTION: ;echoserver.example.org. IN A ;; ANSWER SECTION: echoserver.example.org. 60 IN A 13.59.147.105 echoserver.example.org. 60 IN A 18.221.65.39 echoserver.example.org. 60 IN A 52.15.186.25 ``` -------------------------------- ### Install ALBTargetControlConfig CRD Source: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/ingress/alb-target-agent.md Apply the ALBTargetControlConfig Custom Resource Definition using kubectl to enable automatic injection of the ALB Target Control Agent. ```bash kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/refs/heads/main/config/crd/bases/elbv2.k8s.aws_albtargetcontrolconfigs.yaml ```