[apigatewayv2] Simplify integration HTTP_PROXY with ALB ingress

[acharviakou]

Is your feature request related to a problem?

As customer I would like to be able easily configure API gateway in front of EKS ingress(ALB ingress controller)
Currently it is possible using HTTP_PROXY apigw integration, but it is hard to get correct integrationURI
Currently we have workaround in pipeline to get such uri.

ingressHostname=$(kubectl get ingress ${ingressName} -n ${namespace} -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')
loadBalancerARN=$(aws elbv2 describe-load-balancers --query LoadBalancers[?DNSName=='${ingressHostname}'].LoadBalancerArn  --output text)
aws elbv2 describe-listeners --load-balancer-arn ${loadBalancerARN} --query "Listeners[?Protocol=='HTTPS'].ListenerArn" --output text

This solution is not an ideal. For example there is race condition. You can not get integrationURI if you don't have ingress installed before.
It means to make new service fully working we have to run "helm apply" at least 2 times

Describe the solution you'd like
A description of what you want to happen.

Add some integration in controller to automatically detect integrationURI for ALB ingress
For example https://aws-controllers-k8s.github.io/community/reference/apigatewayv2/v1alpha1/integration/#spec
In current setup we can specify API gateway by ID, or by name of object.

apiID: string
apiRef: 
  from: 
    name: string
    namespace: string

It would be nice to have something similar here as well

Describe alternatives you've considered
A description of any alternative solutions or features you've considered.

[github-actions]

Hello @acharviakou 👋 Thank you for opening an issue in ACK! A maintainer will triage this issue soon.

We encourage community contributions, so if you're interested in tackling this yourself or suggesting a solution, please check out our Contribution and Code of Conduct guidelines.

You can find more information about ACK on our website.

[rushmash91]

Hi @acharviakou,

I understand you're looking to simplify the integration between API Gateway v2 and ALB ingress controller in EKS, specifically to avoid the current manual process of obtaining the integrationURI and dealing with race conditions during deployment.

I'd like to recommend considering KRO:https://kro.run/docs/overview/ as a potential solution for this use case. KRO is a Kubernetes-native project that allows you to define custom APIs to manage related resources and their dependencies in a more streamlined way.

With KRO, you can:

• Define a custom API that manages both the API Gateway and ALB ingress resources
• Use CEL expressions to automatically handle the value passing between resources
• Define the correct ordering of resource creation to avoid race conditions
• Simplify the end-user experience by abstracting away the complex integration URI lookup

You can find relevant examples of similar patterns in:

https://github.com/kro-run/kro/tree/main/examples/apigateway/vpc-lattice
https://github.com/kro-run/kro/tree/main/examples/aws/ingress-triangle

Feel free to drop any further questions you have.

[acharviakou]

Hi @rushmash91,

We already have pretty complex logic in helm, it can be hard to rework everything to support KRO
Moreover latest version is v0.3.0 which is not production ready
Besides that I think KRO will not solve this issue. KRO can use fields from different defined objects
As you may see from commands I provided in first message we need listener ARN as integrationURI value
If I am not mistaken KRO can get value from spec or status of object
Ingress object expose only hostname

status:
  loadBalancer:
    ingress:
    - hostname: internal-k8s-test-sdfsdfs-sdfsdfsd.us-east-1.elb.amazonaws.com

targetgroupbindings object has only targetGroupARN in spec

To sum up. There is no alb listener ARN field in k8s objects, or I didn't find it

[rushmash91]

Hi @acharviakou,

Thank you for the detailed response!
Since the AWS Load Balancer Controller is not an ACK controller, the ACK APIGatewayv2 controller cannot reference Ingress resources it manages.

ACK controllers can only reference other ACK-managed resources.

However, I do have a workaround that might work out in your case(requires KRO). Have you tried adopting the load balancer and listerner using the ELBv2 Controller as Read Only using kro?

That will allow you to pull in the ListenerArn without messing with the ingress controller that will continue to manage it.
Unfortunatly, that is only workaround for now.