Skip to content

Commit 0405638

Browse files
xenolinuxxenolinux
committed
CFE-371: Docs work for ALB Operator
1 parent 5af1c89 commit 0405638

9 files changed

+444
-0
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1015,6 +1015,18 @@ Topics:
10151015
File: default-network-policy
10161016
- Name: Configuring multitenant network policy
10171017
File: multitenant-network-policy
1018+
- Name: AWS Load Balancer Operator
1019+
Dir: aws_load_balancer_operator
1020+
Distros: openshift-enterprise,openshift-origin
1021+
Topics:
1022+
- Name: Installing the AWS Load Balancer Operator
1023+
File: install-aws-load-balancer-operator
1024+
- Name: Creating an instance of the AWS Load Balancer Controller
1025+
File: create-instance-aws-load-balancer-controller
1026+
- Name: Serving Multiple Ingresses through a single AWS Load Balancer
1027+
File: multiple-ingress-through-single-alb
1028+
- Name: Adding TLS termination on the AWS Load Balancer
1029+
File: add-tls-termination
10181030
- Name: Multiple networks
10191031
Dir: multiple_networks
10201032
Distros: openshift-enterprise,openshift-origin

‎modules/adding-tls-termination.adoc

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/aws_load_balancer_operator/add-tls-termination.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="nw-adding-tls-termination_{context}"]
7+
= Adding TLS termination on the AWS Load Balancer
8+
9+
You can route the traffic for the domain to pods of a service and add TLS termination on the AWS Load Balancer.
10+
11+
.Prerequisites
12+
13+
* You have an access to the OpenShift CLI (`oc`).
14+
15+
.Procedure
16+
17+
. Install the Operator and create an instance of the `aws-load-balancer-controller` resource:
18+
+
19+
[source,yaml]
20+
----
21+
apiVersion: networking.k8s.io/v1
22+
kind: AWSLoadBalancerController
23+
group: networking.olm.openshift.io/v1alpha1 <1>
24+
metadata:
25+
name: cluster <2>
26+
spec:
27+
subnetTagging: auto
28+
ingressClass: tls-termination <3>
29+
----
30+
<1> Defines the API group of the `aws-load-balancer-controller` resource.
31+
<2> Defines the `aws-load-balancer-controller` instance.
32+
<3> Defines the name of an `ingressClass` resource reconciled by the AWS Load Balancer Controller. This `ingressClass` resource gets created if it is not present. You can add additional `ingressClass` values. The controller reconciles the `ingressClass` values if the `spec.controller` is set to `ingress.k8s.aws/alb`.
33+
34+
. Create an `Ingress` resource:
35+
+
36+
[source,yaml]
37+
----
38+
apiVersion: networking.k8s.io/v1
39+
kind: Ingress
40+
metadata:
41+
name: <example> <1>
42+
annotations:
43+
alb.ingress.kubernetes.io/scheme: internet-facing <2>
44+
alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-west-2:xxxxx <3>
45+
spec:
46+
ingressClassName: tls-termination <4>
47+
rules:
48+
- host: <example.com> <5>
49+
http:
50+
paths:
51+
- path: /
52+
pathType: Exact
53+
backend:
54+
service:
55+
name: <example-service> <6>
56+
port:
57+
number: 80
58+
----
59+
<1> Specifies the name of an ingress.
60+
<2> The controller provisions the load balancer for this `Ingress` resource in a public subnet so that the load balancer is reachable over the internet.
61+
<3> The Amazon Resource Name of the certificate that you attach to the load balancer.
62+
<4> Defines the ingress class name.
63+
<5> Defines the domain for traffic routing.
64+
<6> Defines the service for traffic routing.

‎modules/creating-instance-aws-load-balancer-controller.adoc

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/aws_load_balancer_operator/create-instance-aws-load-balancer-controller.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="nw-creating-instance-aws-load-balancer-controller_{context}"]
7+
= Creating an instance of the AWS Load Balancer Controller using AWS Load Balancer Operator
8+
9+
You can install only a single instance of the `aws-load-balancer-controller` in a cluster. You can create the AWS Load Balancer Controller by using CLI. The AWS Load Balancer(ALB) Operator reconciles only the resource with the name `cluster`.
10+
11+
.Prerequisites
12+
13+
* You have created the `echoserver` namespace.
14+
* You have access to the OpenShift CLI (`oc`).
15+
16+
.Procedure
17+
18+
. Create an `aws-load-balancer-controller` resource YAML file, for example, `sample-aws-lb.yaml`, as follows:
19+
+
20+
[source,yaml]
21+
----
22+
apiVersion: networking.olm.openshift.io/v1alpha1
23+
kind: AWSLoadBalancerController <1>
24+
metadata:
25+
name: cluster <2>
26+
spec:
27+
subnetTagging: Auto <3>
28+
additionalResourceTags: <4>
29+
example.org/cost-center: 5113232
30+
example.org/security-scope: staging
31+
ingressClass: cloud <5>
32+
config:
33+
replicas: 2 <6>
34+
enabledAddons: <7>
35+
- AWSWAFv2 <8>
36+
----
37+
<1> Defines the `aws-load-balancer-controller` resource.
38+
<2> Defines the AWS Load Balancer Controller instance name. This instance name gets added as a suffix to all related resources.
39+
<3> Valid options are `Auto` and `Manual`. When the value is set to `Auto`, the Operator attempts to determine the subnets that belong to the cluster and tags them appropriately. The Operator cannot determine the role correctly if the internal subnet tags are not present on internal subnet. If you installed your cluster on user-provided infrastructure, you can manually tag the subnets with the appropriate role tags and set the subnet tagging policy to `Manual`.
40+
<4> Defines the tags used by the controller when it provisions AWS resources.
41+
<5> The default value for this field is `alb`. The Operator provisions an `IngressClass` resource with the same name if it does not exist.
42+
<6> Specifies the number of replicas of the controller.
43+
<7> Specifies add-ons for AWS load balancers, which get specified through annotations.
44+
<8> Enables the `alb.ingress.kubernetes.io/wafv2-acl-arn` annotation.
45+
46+
. Create a `aws-load-balancer-controller` resource by running the following command:
47+
+
48+
[source,terminal]
49+
----
50+
$ oc create -f sample-aws-lb.yaml
51+
----
52+
53+
. After the AWS Load Balancer Controller is running, create a `deployment` resource:
54+
+
55+
[source,yaml]
56+
----
57+
apiVersion: apps/v1
58+
kind: Deployment <1>
59+
metadata:
60+
name: <echoserver> <2>
61+
namespace: echoserver
62+
spec:
63+
selector:
64+
matchLabels:
65+
app: echoserver
66+
replicas: 3 <3>
67+
template:
68+
metadata:
69+
labels:
70+
app: echoserver
71+
spec:
72+
containers:
73+
- image: openshift/origin-node
74+
args:
75+
- TCP4-LISTEN:8080,reuseaddr,fork
76+
- EXEC:'/bin/bash -c \"printf \\\"HTTP/1.0 200 OK\r\n\r\n\\\"; sed -e \\\"/^\r/q\\\"\"'
77+
imagePullPolicy: Always
78+
name: echoserver
79+
ports:
80+
- containerPort: 8080
81+
----
82+
<1> Defines the deployment resource.
83+
<2> Specifies the deployment name.
84+
<3> Specifies the number of replicas of the deployment.
85+
86+
. Create a `service` resource:
87+
+
88+
[source,yaml]
89+
----
90+
apiVersion: v1
91+
kind: Service <1>
92+
metadata:
93+
name: <echoserver> <2>
94+
namespace: echoserver
95+
spec:
96+
ports:
97+
- port: 80
98+
targetPort: 8080
99+
protocol: TCP
100+
type: NodePort
101+
selector:
102+
app: echoserver
103+
----
104+
<1> Defines the service resource.
105+
<2> Specifies the name of the service.
106+
107+
. Deploy an ALB-backed `Ingress` resource:
108+
+
109+
[source,yaml]
110+
----
111+
apiVersion: networking.k8s.io/v1
112+
kind: Ingress <1>
113+
metadata:
114+
name: <echoserver> <2>
115+
namespace: echoserver
116+
annotations:
117+
alb.ingress.kubernetes.io/scheme: internet-facing
118+
alb.ingress.kubernetes.io/target-type: instance
119+
spec:
120+
ingressClassName: alb
121+
rules:
122+
- http:
123+
paths:
124+
- path: /
125+
pathType: Exact
126+
backend:
127+
service:
128+
name: <echoserver> <3>
129+
port:
130+
number: 80
131+
----
132+
<1> Defines the ingress resource.
133+
<2> Specifies the name of the ingress resource.
134+
<3> Specifies the name of the service resource.
135+
136+
.Verification
137+
138+
* Verify the status of the `Ingress` resource to show the host of the provisioned AWS Load Balancer (ALB) by running the following command:
139+
+
140+
[source,terminal]
141+
----
142+
$ HOST=$(kubectl get ingress -n echoserver echoserver -o json | jq -r '.status.loadBalancer.ingress[0].hostname')
143+
----
144+
145+
* Verify the status of the provisioned AWS Load Balancer (ALB) host by running the following command:
146+
+
147+
[source,terminal]
148+
----
149+
$ curl $HOST
150+
----

‎modules/creating-multiple-ingress-through-single-alb.adoc

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/aws_load_balancer_operator/multiple-ingress-through-single-alb.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="nw-creating-multiple-ingress-through-single-alb_{context}"]
7+
= Creating multiple ingresses through a single AWS Load Balancer
8+
9+
You can route the traffic to multiple Ingresses through a single AWS Load Balancer (ALB) by using the CLI.
10+
11+
.Prerequisites
12+
13+
* You have an access to the OpenShift CLI (`oc`).
14+
15+
.Procedure
16+
17+
. Create an `IngressClassParams` resource YAML file, for example, `sample-single-lb-params.yaml`, as follows:
18+
+
19+
[source,yaml]
20+
----
21+
apiVersion: elbv2.k8s.aws/v1beta1 <1>
22+
kind: IngressClassParams
23+
metadata:
24+
name: <single-lb-params> <2>
25+
spec:
26+
group:
27+
name: single-lb <3>
28+
----
29+
<1> Defines the API group and version of the `IngressClassParams` resource.
30+
<2> Specifies the name of the `IngressClassParams` resource.
31+
<3> Specifies the name of the `IngressGroup`. All Ingresses of this class belong to this `IngressGroup`.
32+
33+
. Create an `IngressClassParams` resource by running the following command:
34+
+
35+
[source,terminal]
36+
----
37+
$ oc create -f sample-single-lb-params.yaml
38+
----
39+
40+
. Create an `IngressClass` resource YAML file, for example, `sample-single-lb.yaml`, as follows:
41+
+
42+
[source,yaml]
43+
----
44+
apiVersion: networking.k8s.io/v1 <1>
45+
kind: IngressClass
46+
metadata:
47+
name: <single-lb> <2>
48+
spec:
49+
controller: ingress.k8s.aws/alb <3>
50+
parameters:
51+
apiGroup: elbv2.k8s.aws <4>
52+
kind: IngressClassParams <5>
53+
name: single-lb <6>
54+
----
55+
<1> Defines the API group and the version of the `IngressClass` resource.
56+
<2> Specifies the name of the `IngressClass`.
57+
<3> Defines the controller name, common for all `IngressClasses`. The `aws-load-balancer-controller` reconciles the controller.
58+
<4> Defines the API group of the `IngressClassParams` resource.
59+
<5> Defines the resource type of the `IngressClassParams` resource.
60+
<6> Defines the name of the `IngressClassParams` resource.
61+
62+
. Create an `IngressClass` resource by running the following command:
63+
+
64+
[source,terminal]
65+
----
66+
$ oc create -f sample-single-lb.yaml
67+
----
68+
69+
. Create an `Ingress` resource YAML file, for example, `sample-multiple-ingress.yaml`, as follows:
70+
+
71+
[source,yaml]
72+
----
73+
apiVersion: networking.k8s.io/v1 <1>
74+
kind: Ingress
75+
metadata:
76+
name: <example-1> <1>
77+
annotations:
78+
alb.ingress.kubernetes.io/scheme: internet-facing <2>
79+
alb.ingress.kubernetes.io/group.order: "1" <3>
80+
spec:
81+
ingressClass: alb <4>
82+
rules:
83+
- host: example.com <5>
84+
http:
85+
paths:
86+
- path: /blog <6>
87+
backend:
88+
service:
89+
name: <example-1> <7>
90+
port:
91+
number: 80 <8>
92+
kind: Ingress
93+
metadata:
94+
name: <example-2>
95+
annotations:
96+
alb.ingress.kubernetes.io/scheme: internet-facing
97+
alb.ingress.kubernetes.io/group.order: "2"
98+
spec:
99+
ingressClass: alb
100+
rules:
101+
- host: example.com
102+
http:
103+
paths:
104+
- path: /store
105+
backend:
106+
service:
107+
name: <example-2>
108+
port:
109+
number: 80
110+
kind: Ingress
111+
metadata:
112+
name: <example-3>
113+
annotations:
114+
alb.ingress.kubernetes.io/scheme: internet-facing
115+
alb.ingress.kubernetes.io/group.order: "3"
116+
spec:
117+
ingressClass: alb
118+
rules:
119+
- host: example.com
120+
http:
121+
paths:
122+
- path: /
123+
backend:
124+
service:
125+
name: <example-3>
126+
port:
127+
number: 80
128+
----
129+
<1> Specifies the name of an ingress.
130+
<2> Indicates the load balancer to provision in the public subnet and makes it accessible over the internet.
131+
<3> Specifies the order in which the rules from the Ingresses are matched when the request is received at the load balancer.
132+
<4> Specifies the Ingress Class that belongs to this ingress.
133+
<5> Defines the name of a domain used for request routing.
134+
<6> Defines the path that must route to the service.
135+
<7> Defines the name of the service that serves the endpoint configured in the ingress.
136+
<8> Defines the port on the service that serves the endpoint.
137+
138+
. Create the `Ingress` resources by running the following command:
139+
+
140+
[source,terminal]
141+
----
142+
$ oc create -f sample-multiple-ingress.yaml
143+
----

0 commit comments

Comments
 (0)