Merge pull request #36 from antonin-a/draft-public-cloud-lb-aan

scraly · web-flow · commit 3da10c68a09e · 2025-10-01T12:16:59.000+02:00
Add Public Cloud Load Balancer examples
diff --git a/.DS_Store b/.DS_Store
diff --git a/.gitignore b/.gitignore
@@ -15,6 +15,8 @@ basics/utils/vars.csv
 
 containers-orchestration/managed-kubernetes/create-cluster-with-tf/my_kube_cluster.yml
 containers-orchestration/managed-private-registry/create-registry-with-pulumi/ovhcloud-registry-go/Pulumi.dev.yaml
+.DS_Store
+
 *.tfvars
 kubeconfig.yml
 .quarkus/
diff --git a/containers-orchestration/.DS_Store b/containers-orchestration/.DS_Store
diff --git a/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/basic_lb/lb_base.yaml b/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/basic_lb/lb_base.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: publicCloudLB-basic
+  labels:
+    app: test-publicCloudLB
+spec:
+  ports:
+  - name: client
+    port: 80
+    protocol: TCP
+    targetPort: 80
+  selector:
+    app: nginx
+  type: LoadBalancer
diff --git a/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/basic_lb/readme.md b/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/basic_lb/readme.md
@@ -0,0 +1,4 @@
+# Basic Public Cloud Load Balancer demo
+
+## Description
+Here is a basic example of how to expose your application using a Service type LoadBalancer relying on OVHcloud Public Cloud LoadBalancer.
diff --git a/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/basic_lb_keepip/lb_keepip.yaml b/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/basic_lb_keepip/lb_keepip.yaml
@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: publicCloudLB-keepip
+  annotations:
+    loadbalancer.openstack.org/keep-floatingip: "true" # Once the IP has been created with this flag, K8S cluster will not manage his deletion / Can be set AFTER the creation
+  labels:
+    app: test-publicCloudLB
+spec:
+  ports:
+  - name: client
+    port: 80
+    protocol: TCP
+    targetPort: 80
+  selector:
+    app: nginx
+  type: LoadBalancer
diff --git a/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/basic_lb_keepip/lb_keepip_reuse_or_already_existing_in_tenant.yaml b/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/basic_lb_keepip/lb_keepip_reuse_or_already_existing_in_tenant.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: publicCloudLB-keepip-with-existing-ip
+  labels:
+    app: test-publicCloudLB
+spec:
+  loadBalancerIP: xx.xx.xx.xx # Public Floating IP you want to use. This annontation is deprecated since K8S 1.24 but still used
+  ports:
+  - name: client
+    port: 80
+    protocol: TCP
+    targetPort: 80
+  selector:
+    app: nginx
+  type: LoadBalancer
diff --git a/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/basic_lb_keepip/readme.md b/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/basic_lb_keepip/readme.md
@@ -0,0 +1,6 @@
+# Basic Public Cloud Load Balancer and Keep/Re-use IP demo
+
+## Description
+[lb_keepip.yaml](./lb_keepip.yaml) is an example of how to keep the Public Floating IP attached to your Public Cloud LoadBalancer even if you delete your Service/LoadBalancer. In case of Service and LoadBalancer deletion, the Floating IP will be unbound and will remains available on your OVHcloud Public Cloud project. 
+
+Using [lb_keepip_reuse_or_already_existing_in_tenant.yaml](./lb_keepip_reuse_or_already_existing_in_tenant.yaml) you can use (or re-use) an existing Floating IP available on your OVHcloud Public Cloud project.
diff --git a/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/basic_lb_udp_tcp/lb_tcp_udp.yaml b/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/basic_lb_udp_tcp/lb_tcp_udp.yaml
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: publicCloudLB-udp-tcp
+  labels:
+    app: test-publicCloudLB
+spec:
+  ports:
+  - name: client
+    port: 80
+    protocol: TCP
+    targetPort: 80
+  - name: client-udp
+    port: 80
+    protocol: UDP
+    targetPort: 80
+  selector:
+    app: nginx
+  type: LoadBalancer
diff --git a/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/basic_lb_udp_tcp/readme.md b/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/basic_lb_udp_tcp/readme.md
@@ -0,0 +1,4 @@
+# Basic Public Cloud Load Balancer using UDP demo
+
+## Description
+Here is a basic example on how to use your Public Cloud LoadBalancer with UDP protocol.
diff --git a/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/basic_lb_with_flavor/lb_flavor.yaml b/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/basic_lb_with_flavor/lb_flavor.yaml
@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: publicCloudLB-medium
+  annotations:
+    loadbalancer.ovhcloud.com/flavor: "medium"
+  labels:
+    app: test-publicCloudLB
+spec:
+  ports:
+  - name: client
+    port: 80
+    protocol: TCP
+    targetPort: 80
+  selector:
+    app: nginx
+  type: LoadBalancer
diff --git a/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/basic_lb_with_flavor/readme.md b/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/basic_lb_with_flavor/readme.md
@@ -0,0 +1,6 @@
+# Basic Public Cloud Load Balancer using flavor demo
+
+## Description
+Here is a basic example on how to specify the flavor that you want to use for your Public Cloud LoadBalancer.
+If not specified, LoadBalancer will be created using a Small flavor.
+You can find the OVHcloud Public Cloud loadbalancer flavor list: https://help.ovhcloud.com/csm/en-ie-public-cloud-network-octavia-use-lbaas-openstack?id=kb_article_view&sysparm_article=KB0050296
diff --git a/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/nginx_basic/README.md b/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/nginx_basic/README.md
@@ -0,0 +1,5 @@
+# Basic nginx Deployment
+
+## Description
+Here is a basic example a nginx Deployment that can be use for demo and test of Public Cloud Load Balancer.
+Once the Deployment is created your nginx will be internally exposed on port 80 so you can use the ![Basic LB](./basic_lb/lb_base.yaml) in order to forward trafic from LB listener (port 80) to Kubernetes internal nginx (port 80).
diff --git a/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/nginx_basic/nginx_base.yaml b/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/nginx_basic/nginx_base.yaml
@@ -0,0 +1,21 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+  labels:
+    app: nginx
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: nginx
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:latest
+        ports:
+        - containerPort: 80
diff --git a/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/nginx_ingress/README.md b/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/nginx_ingress/README.md
@@ -0,0 +1,114 @@
+# Install Nginx Ingress Controller on OVHcloud Managed Kubernetes Service
+
+## Description
+
+This documentation explains how to deploy the [Nginx Ingress Controller](https://kubernetes.github.io/ingress-nginx/) on **OVHcloud Managed Kubernetes Service**.  
+The Ingress Controller enables you to expose your HTTP(S) applications running inside the cluster by defining Kubernetes Ingress resources.
+
+---
+
+## Prerequisites
+
+- An existing **OVHcloud Managed Kubernetes cluster** (
+- **kubectl** installed and configured with your cluster credentials.  
+- **Helm** installed ([Installation guide](https://helm.sh/docs/intro/install/)).
+- **Cert-Manager** installed for TLS certificate management ([Documentation](https://cert-manager.io/docs/)).
+
+---
+
+## Installation
+
+1. **Add the Helm repository for ingress-nginx**:
+   ```bash
+   helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
+   helm repo update
+   ```
+
+2. **Deploy Nginx Ingress Controller** in your cluster:
+   ```bash
+   helm upgrade --install ingress-nginx ingress-nginx/ingress-nginx --namespace ingress-nginx --create-namespace --values ./values.yaml
+   ```
+ 3. **Deploy the ClusterIssuer for Cert-Manager**:  
+    Deploy the ClusterIssuer as described on `acme-config.yml` :
+    ```yaml
+    apiVersion: cert-manager.io/v1
+    kind: ClusterIssuer
+    metadata:
+      name: main
+    spec:
+      acme:
+        # The ACME server URL
+        server: https://acme-v02.api.letsencrypt.org/directory
+        # Email address used for ACME registration
+        email: email@example.com
+        # Name of a secret used to store the ACME account private key
+        privateKeySecretRef:
+          name: letsencrypt-prod
+        # Enable the HTTP-01 challenge provider
+        solvers:
+        - http01:
+            ingress:
+              class: nginx
+    ```
+
+    To do so, apply it using:
+    ```bash
+    kubectl apply -f acme-config.yml
+    ```
+---
+
+## Verification
+
+Check that the Ingress Controller pods are running:
+```bash
+kubectl get pods -n ingress-nginx
+```
+
+Retrieve the **external IP or hostname** automatically provisioned by OVHcloud LoadBalancer:
+```bash
+kubectl get svc ingress-nginx-controller -n ingress-nginx
+```
+
+⚠️ On OVHcloud Managed Kubernetes Service, the LoadBalancer service type automatically provisions an external IP from OVHcloud infrastructure. This IP/hostname must be configured in your DNS records.
+
+---
+
+## Next Steps
+
+1. **Configure your DNS records**:  
+   Point your application’s domain name (e.g. `myapp.example.com`) to the LoadBalancer external IP/hostname obtained in the previous step.
+
+2. **Create an Ingress resource** to route traffic to your application.  
+   Deploy your Ingress using the example `ingress_base.yaml` with TLS using Cert-Manager and Let’s Encrypt:
+   ```yaml
+   apiVersion: networking.k8s.io/v1
+   kind: Ingress
+   metadata:
+     annotations:
+       cert-manager.io/cluster-issuer: "main"
+     name: ngx-deploy-ingress
+   spec:
+     ingressClassName: nginx
+     tls:
+     - hosts:
+       - myapp.example.com
+       secretName: publicCloudLB-secret
+     rules:
+     - host: myapp.example.com
+       http:
+         paths:
+         - path: /
+           pathType: Prefix
+           backend:
+             service:
+               name: nginx-deployment
+               port:
+                 number: 80
+   ```
+
+---
+
+## Useful Links
+- [Nginx Ingress Controller Documentation](https://kubernetes.github.io/ingress-nginx/)
+- [Helm Documentation](https://helm.sh/docs/)
+- [Cert-Manager Documentation](https://cert-manager.io/docs/)
diff --git a/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/nginx_ingress/acme-config.yml b/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/nginx_ingress/acme-config.yml
@@ -0,0 +1,18 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: main
+spec:
+  acme:
+    # The ACME server URL
+    server: https://acme-v02.api.letsencrypt.org/directory
+    # Email address used for ACME registration
+    email: email@example.com
+    # Name of a secret used to store the ACME account private key
+    privateKeySecretRef:
+      name: letsencrypt-prod
+    # Enable the HTTP-01 challenge provider
+    solvers:
+    - http01:
+        ingress:
+          class: nginx
diff --git a/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/nginx_ingress/deploy_nginx.bash b/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/nginx_ingress/deploy_nginx.bash
@@ -0,0 +1,3 @@
+#!/bin/bash
+cd "$(dirname "$0")"
+helm upgrade --install ingress-nginx ingress-nginx/ingress-nginx --namespace ingress-nginx --create-namespace --values ./value.yaml
diff --git a/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/nginx_ingress/ingress_base.yaml b/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/nginx_ingress/ingress_base.yaml
@@ -0,0 +1,23 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    cert-manager.io/cluster-issuer: "main"
+  name: ngx-deploy-ingress
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - myapp.example.com
+    secretName: publicCloudLB-secret
+  rules:
+  - host: myapp.example.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: nginx-deployment
+            port:
+              number: 80
diff --git a/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/nginx_ingress/value.yaml b/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/nginx_ingress/value.yaml
@@ -0,0 +1,7 @@
+controller:
+  service:
+    annotations:
+      loadbalancer.openstack.org/proxy-protocol: "true"
+      loadbalancer.ovhcloud.com/flavor: "large" # OVHcloud Public Cloud loadbalancer flavor list: https://help.ovhcloud.com/csm/en-ie-public-cloud-network-octavia-use-lbaas-openstack?id=kb_article_view&sysparm_article=KB0050296
+  config:
+    use-proxy-protocol: "true"
diff --git a/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/private_lb/lb_private.yaml b/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/private_lb/lb_private.yaml
@@ -0,0 +1,18 @@
+# Only available with a MKS cluster attached to a Private network
+apiVersion: v1
+kind: Service
+metadata:
+  name: publicCloudLB-private
+  annotations:
+    service.beta.kubernetes.io/openstack-internal-load-balancer: "true"
+  labels:
+    app: test-publicCloudLB
+spec:
+  ports:
+  - name: client
+    port: 80
+    protocol: TCP
+    targetPort: 80
+  selector:
+    app: nginx
+  type: LoadBalancer
diff --git a/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/private_lb/lb_private_with_openstack_port.yaml b/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/private_lb/lb_private_with_openstack_port.yaml
@@ -0,0 +1,19 @@
+# Only available with a MKS cluster attached to a Private network
+apiVersion: v1
+kind: Service
+metadata:
+  name: publicCloudLB-private-with-openstack-port
+  annotations:
+    service.beta.kubernetes.io/openstack-internal-load-balancer: "true"
+    loadbalancer.openstack.org/port-id: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  labels:
+    app: test-publicCloudLB
+spec:
+  ports:
+  - name: client
+    port: 80
+    protocol: TCP
+    targetPort: 80
+  selector:
+    app: nginx
+  type: LoadBalancer
diff --git a/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/private_lb/readme.md b/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/private_lb/readme.md
@@ -0,0 +1,26 @@
+# Private Load Balancer Demo
+
+## Description
+Here is a basic example of how to expose your application using a Service type LoadBalancer in a private way.
+
+## Create a private Load Balancer:
+You have to provide the following annotation:
+`service.beta.kubernetes.io/openstack-internal-load-balancer: "true"`
+
+## Specify the private IP
+You need to provide a PortID and to set it on the `loadbalancer.openstack.org/port-id` annotation. 
+
+1. Create a OpenStack port and use this as LB Ip address
+
+  Without specifying the IP\
+  `$ openstack port create --network bdd4fc7c-6a27-43d6-940a-8ed51e1fd22c --fixed-ip subnet=187dc936-c4ea-49ca-aff5-0a5eb7062ed9 my-lb-app-port`\
+  Where: --network = network name or ID, subnet= subnet name or ID
+
+  Or with a specific IP of your subnet \
+  `$ openstack port create --network bdd4fc7c-6a27-43d6-940a-8ed51e1fd22c --fixed-ip subnet=187dc936-c4ea-49ca-aff5-0a5eb7062ed9, ip-address=10.0.2.2 my-lb-app-port-2`
+
+  Retrieve the portID :
+  `$openstack port list --name my-lb-app-port-2`
+
+2. Add the portID to your Kubernetes Service manifest (cf. [exemple](./lb_private_with_openstack_port.yaml))\
+`loadbalancer.openstack.org/port-id: "4c758644-af77-4e60-9e24-bc5e67295ac0"`
diff --git a/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/readme.md b/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/readme.md
diff --git a/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/resize_lb/1_small_service.yaml b/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/resize_lb/1_small_service.yaml
diff --git a/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/resize_lb/2_small_service.yaml b/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/resize_lb/2_small_service.yaml
diff --git a/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/resize_lb/3_medium_service_deploy.yaml b/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/resize_lb/3_medium_service_deploy.yaml
diff --git a/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/resize_lb/README.md b/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/resize_lb/README.md
diff --git a/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/tcp_tweak_lb/README.md b/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/tcp_tweak_lb/README.md
diff --git a/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/tcp_tweak_lb/lb_customer_tcp_parameters.yaml b/containers-orchestration/managed-kubernetes/use-public-cloud-load-balancer/tcp_tweak_lb/lb_customer_tcp_parameters.yaml
