Native EKS Ingress: AWS Load Balancer Controller & 5 Examples (Terraform, TLS, IngressGroup, IP)
HTML-код
- Опубликовано: 5 июл 2024
- 🔴 - To support my channel, I’d like to offer Mentorship/On-the-Job Support/Consulting - me@antonputra.com
👉 [UPDATED] AWS EKS Kubernetes Tutorial [NEW]: • AWS EKS Kubernetes Tut...
▬▬▬▬▬ Experience & Location 💼 ▬▬▬▬▬
► I’m a Senior Software Engineer at Juniper Networks (12+ years of experience)
► Located in San Francisco Bay Area, CA (US citizen)
▬▬▬▬▬▬ Connect with me 👋 ▬▬▬▬▬▬
► LinkedIn: / anton-putra
► Twitter/X: / antonvputra
► GitHub: github.com/antonputra
► Email: me@antonputra.com
▬▬▬▬▬▬ Related videos 👨🏫 ▬▬▬▬▬▬
👉 [Playlist] Kubernetes Tutorials: • Kubernetes Tutorials
👉 [Playlist] Terraform Tutorials: • Terraform Tutorials fo...
👉 [Playlist] Network Tutorials: • Network Tutorials
👉 [Playlist] Apache Kafka Tutorials: • Apache Kafka Tutorials
👉 [Playlist] Performance Benchmarks: • Performance Benchmarks
👉 [Playlist] Database Tutorials: • Database Tutorials
=========
⏱️TIMESTAMPS⏱️
0:00 Intro
2:11 IAM Roles for Service Accounts via AWS Console
6:03 IAM Roles for Service Accounts via Terraform
7:58 Deploy AWS Load Balancer Controller with YAML
9:51 Deploy AWS Load Balancer Controller with HELM
10:27 Deploy AWS Load Balancer Controller with Terraform & HELM
12:18 Simple Ingress (1-example)
15:10 Multiple Ingresses using Same Load Balancer (2-example)
18:02 Secure Ingress with SSL/TLS (3-example)
24:00 Automatically Create DNS for Ingress (4-example)
28:38 Create Service of Type LoadBalancer (5-example)
=========
Source Code
📚 - Source Code: github.com/antonputra/tutoria...
#AWS #ELB #DevOps 
Наука
🔴 - To support my channel, I’d like to offer Mentorship/On-the-Job Support/Consulting - me@antonputra.com
👉 [UPDATED] AWS EKS Kubernetes Tutorial [NEW]: ruclips.net/p/PLiMWaCMwGJXnKY6XmeifEpjIfkWRo9v2l&si=wc6LIC5V2tD-Tzwl
I have gone through so many articles on google and youtube videos. This is the best video so far.
Thanks one more is coming on the topic
This is exactly what I was looking for! Thanks for a brilliant video!
This video series is pure gold. Thank you very much.
Thank you!
This guy is way super smart 👏👏👏
thanks :) i have updated video - ruclips.net/video/5XpPiORNy1o/видео.html
High quality content only! It's the second time Your video helps me to figure out how to deal with k8s! Keep going!
Thank you, Ivan!
The most complete! Amazing. A little bit fast but everything is there and plus: raw, helm terraform.. amazing!!
thank you!!
Антон, большое спасибо за такие ценные видео!
Spasibo)
Thank God for you sir
😊
👉 How to Manage Secrets in Terraform - ruclips.net/video/3N0tGKwvBdA/видео.html
👉 Terraform Tips & Tricks - ruclips.net/video/7S94oUTy2z4/видео.html
👉 ArgoCD Tutorial - ruclips.net/video/zGndgdGa1Tc/видео.html
you saved my life man, thanks for posting this!
no problem!
I definitively appreciate this video. Clear and didactic. Thanks a lot
thank you!
Hey man! Really GREAT content! Thank you!
Hey, thanks!
🔴UPDATED🔴 How to create EKS Cluster using Terraform MODULES (AWS Load Balancer Controller + Autoscaler + IRSA) - ruclips.net/video/kRKmcYC71J4/видео.html
Monitor EKS & EC2 instances with MANAGED Prometheus - ruclips.net/video/-nUQNFAX5TI/видео.html
Wow.. thank you soo much for the quality content. You have no idea how much I appreciate this video. If you are ever in Los Angeles let me know and I'll buy you a beer 🙌
Thanks, sure lol
The best explanation that I coud find in web. Thank you very much. It has really helped.
Thank you, Eugen! I appreciate it!
its amazing Anton )) thanks a lot bro
welcome :)
thank you so much, such a great tutorial!!
Welcome!!
Absoulely needed this!. I just subcsribed.
Thanks El!
Get Full-Length High-Quality DevOps Tutorials for Free - Subscribe Now! - ruclips.net/user/AntonPutra
🟢 [New] Terragrunt Tutorial: Create VPC, EKS from Scratch! (Step-by-Step) - ruclips.net/video/yduHaOj3XMg/видео.html
Hey,
I love your work and videos! Keep it going.
Question, is it still not possible to make aws-loadbalancer-controller work to issue letsencrypt or zerossl certificates? Do we still have to use ingress-nginx controller in 2022 because aws-loadbalancer-controller is ment to issue only AWS certificates? 😛
I can issue certificates from zerossl with cert-manager annotation, but the aws-loadbalancer-controller cannot discover those certificates unfortunately.
Hi Anton, Great video. Loved the detailed explanation. If possible please make a video on TLS Termination at Pods for end to end encryption.
well i have one with istio and end to end tls via gateway
Excellent video! I have a question. Is it recommended to use alb ingress controller in production environments? Since it requires a Nodeport service and that is a security hole because we are opening a port of our instance.
Thanks! Even if you expose your app with load balancer, it will open node ports. You still have security groups in place that block unauthorized access. But I would recommend to use ip mode anyway.
Awesome content!!. Got everything I was looking for in a single video.
Will the cost be more for ALB in comparison to Classic load balancer and how can I calculate the cost? And how we can have ingress create Classic Load Balancer instead of ALB?
Thanks again for the video!
Thanks! You shouldn't use Classic load balancer at all, better to migrate to NLB. In term of pricing ALB a little bit more expensive than NLB - aws.amazon.com/elasticloadbalancing/pricing/
You can use AWS Load balancer controller to provision services of type "LoadBalancer" with NLB
Great walkthrough ! For a of service type ClusterIP, is it mandatory to have external-dns ? If not, what the configuration would be in the ingress manifest ?
Thanks, do you mean external-dns plugin to automatically create DNS records, not at all
Hey! Thanks for the video! How much different would it be to use AWS Load Balancer Controller on a self-hosted k8s?
Thanks, you just need to attach IAM policy to nodes instead of using IAM roles for service accounts.
Awesome
Thanks vitaerial!
Thanks for the video❤
I should use only one right either terraform or helm while deploying load balancer controller right?
Welcome, you can use terraform helm provider to deploy load balancer controller.
Hey anton, i like your videos the way you do them ! can you please do a video for eks with keda autoscaling ! thanks
Sure, just put it in my list!
do you have terraform code to deploy external dns as well? The same way you did for aws ingress wiht helm. Thanks for your hard work as always!
Thanks Alex, I don't but i think it's should be straigh forward to include this helm chart to tf - github.com/kubernetes-sigs/external-dns/tree/master/charts/external-dns#externaldns
terraform/helm example - github.com/antonputra/tutorials/blob/main/lessons/155/istio-terraform/1-istio-base.tf
High level steps to create eks cluster with terraform :
1. create vpc,subnets , route table and association , igw , nat etc
2.create proper iam roles and policies required for eks master and node groups
3. create eks cluster and node groups
now how to access this cluster to run yaml files to create deployments and services etc ..... plz can u reply
You need to update your k8s config with "aws eks update-kubeconfig --name dev-demo --region us-east-2" replace region and name of the cluster
Thanks
No problem
Great job as usual! Thanks
It's a really peaty that the AWS Load Balancer Controller doesn't support the rewrite rules
Thanks, I know
Hi AntonPutra, you are doing great. just wanted know how can we deploy the nginx ingress controller using terraform?
Thanks, here is an example - github.com/antonputra/tutorials/blob/main/lessons/167/terraform/10-helm-ingress.tf
very nice tutorial! i can't figure out how to create the ALB on an EXISTING eks...
Why? What's the problem? Do you use helm cli to deploy or terraform?
Can somebody use an alb present not spun up by the load balancer controller as the single alb used by ingress classes?
Or using 1 alb from eks as well as for ec2s outside the eks not possible at the same time?
Yes, you can use TargetGroupBinding, "can expose your pods using an existing..".
Take a look on doc - kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/guide/targetgroupbinding/targetgroupbinding/
@antonPutra
if we are changing image for service b then its not working for service b using only path based routing , which looks like service not available , can you help
Well, alb controller has some limitations related to rewriting but it should work in the case you described
Hi!
How do you know which version to use in resource "helm_release" "aws-load-balancer-controller",
version = "1.4.1" #?
and in tag:
set {
name = "image.tag"
value = "v2.4.2" #?
where did you get it?
Thanks!
At this point you can use default one that comes with the helm chart
Great video, thanks for share, I've using Istio for K8s mesh, in my opinion it's more easier and simple to manage, but learn other methods it's very important.
Thanks, what about app mesh?
@@AntonPutra Yes, about networking service mesh, discovery. Istio works like that, including gateway and ingress controllers.
just subscribed! awesome tutorial. Do you have a video guide how to connect eks to database using terraform?
Thanks! which one? dynamodb?
I don't but I'm going to create soon how to invoke lambda from eks, same principle will apply
@@AntonPutra a simple container app using env amd secrets to connect to rds
Great walkthrough and Excellent work ! but how about to use aws load balancer juste to controle the life cycle of an ALB then create an ingress resource in aws load balancer to route all the traffic to an ingnix controller then create multiple ingresses in ngnix controller so u have all ur services in cluster ip and juste one with nodePort does thin work ?
Thanks, didn't get a question. You can use either aws load balancer controller or nginx controller to fulfill the ingress resource.
@@AntonPutra cannot be possible to work with both ? the aws LB to create the application LB then create an ingress resoursse to route all the traffic to the ngnix controller who will be responsable to route the trafic to each microservice with the ingress rules
@@AntonPutra i want to do that architecture can u help me with that ?
@@wassimbenregaya5445 you can use alb controller to create network load balancer for Nginx
Very helpful tutorial, anyway I have a question about best practice for deploying more than 1 EKS Cluster, Should I create 2 load balancer controller ?? adding user on role or do you have any idea ?? Thank you very much @Anton Putra
you need to deployed alb controller to each cluster, but better look into nginx or istio/linkerd (you can get lots more for free)
@@AntonPutra I see but it seems when I try to deploy ingress, on load balancer controller logs it says No OpenIDConnect provider... I have created new oidc for new cluster and assigned new role and following along with your tutorial (the first cluster has no issue)
Can we configure aws load balancer with kubedam setup cluster so that when I connect my network load balancer with kubeadm worker nodes then on loadbalancer service type, then in external IP it will show my NLB DNA record
Not sure, but kubeadm works with metallb if you need on-prem setup.
is it possible to use singel ALB to terminate mutiple SSL hosts that are using the same ACM?
I guess you could use multiple alternative names when issuing the certificate. However, it can be a nightmare to maintain in the long term, especially if you need to add new DNS entries or remove deprecated ones.
how to create the health checks for the target groups that are created by the controller ? is there a way to create it via terraform ?
Generally you don't need to create extra health checks besides the ones created by the aws load balancer controller. If you're looking to manage your own load balancer, check this - kubernetes-sigs.github.io/aws-load-balancer-controller/v2.5/guide/use_cases/self_managed_lb/
Thank you very very much for your turorials! Is this valid for 1.29?
Yes, but there are some limitations, and most likely you would keep using one ALB per one ingress in prod - kubernetes-sigs.github.io/aws-load-balancer-controller/v2.7/guide/ingress/annotations/#ingressgroup
Thanks, Anton! I will test it tonight!
@@davidvillasmil1468 i still prefer nginx ingress, you can scape ingress (prom metrics) to get all metrics (latency, availability etc all 4 golden signals out of box) with alb controller you forced to expose metrics on each app. By the way I'll release refreshed video soon with pod identities instead of irsa
do we always have to mention host in Ingress controller?
No but it’s highly recommended, if you don’t it’s going to be a wildcard
how do i get url = aws_eks_cluster.cluster.identity[0].oidc[0].issuer if i'm declaring the eks not as a "aws_eks_ckuster" resource but as a module? (module "eks") can't figure that out
something like this - github.com/antonputra/tutorials/blob/e1c48ccb8888ac6f079cfb520b4f010388dd81ec/lessons/006/main.tf#L14
Keep in mind, you module needs to have output variable
This is great, thanks!!
can i use nginx load balancer in place of aws load balancer
Right, what you'll want to do is use the AWS Load Balancer Controller to create a Network Load Balancer for the Nginx Ingress Controller. I have a video - ruclips.net/video/ePqUq06WoLk/видео.html
@@AntonPutra thanks sir
that cert-manager yaml file link is not there
You can use the following command to install cert-manager - kubectl apply -f github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.yaml
I love all kubernetes related things, sadly it's an overkill for my company and we stick to simple self managed docker swarm, soon to be ECS autoscalable
Sometimes I think it's easier to deploy standalone VMs, a lot of overhead and hidden cost in Kubernetes
how to make NLB to use 443?
I have a section for 443/TLS -> 18:02 Secure Ingress with SSL/TLS
@@AntonPutra do i need ingress.yaml for NLB also?
can you share me iam policy. i did find policy in your git file.
This one? github.com/antonputra/tutorials/blob/main/lessons/112/ExternalDNSAccess.json
Why do yo have it still going through http when you already have it going through https? Isn't that insecure the fact that it can still be accessed with http?
You can use plain http with internal services that can be accessed only within your VPC
@@AntonPutra Thanks for your explanation. For me everything looks fine, however, when I do kubectl get ing -n I do not get and ADDRESS, and I also notice I do not have any load balancer present in ec2 control pane. Any recommendations? Error message: Failed build model due to couldn't auto-discover subnets: unable to discover at least one subnet
Does anybody else has problems with destroying ingresses / loadbalancers created from terraform? It seems like there is a problem with security groups created for each loadbalancer
Before you run "terraform destroy" you need to delete kubernetes objects that manage application load balancers. Something like kubectl delete -f ingress.yaml or service.yaml.
@@AntonPutra I found that problem is more serious. Currently I have 1 ingress set with terraform for grafana service. It is being created correctly. But i cannot delete it. Neither by terraform destroy, not even kubectl delete. Finalizers in ingress objects AND in namespace which contains those ingresses prevents them from deletion. So i have to remove them with kubectl patch or curl. I already spent few days investigating this. Currently im messing arrount with policies and roles to find a clue.
Great content bro, thank you.
Your name likes indonesian name, are you from indonesia ?
Thanks aryadi!
No, but I was told the same many times when I was in Bali =)
Hi Anton, I got an error in the ingress.
default-http-backend:80 (
why this error occur ?
response of alb is 404 not found
Hi Anton, I have solved the problem. wrong host in the ingress
Can I use load balancer controller to expose this helm chart: bitnami/keycloak ?
I am trying to change it's values but I am unable, can you help me?
did you use match your ingress class name with this?
github.com/bitnami/charts/blob/master/bitnami/keycloak/values.yaml#L526