Skip to content

Commit a622844

Browse files
author
Dennis Rausch
committed
Pull request kubernetes-sigs#7: IENGOC-39: Remediate http/2 vulnerability
Merge in DEL/aws-load-balancer-controller-fork from IENGOC-39 to main * commit '3e26f86e82a5d419a7f8adfc5c95dd45984be6f4': IENGOC-39: Remediate more bd vulnerabilities IENGOC-39: Remediate bd vulnerabilities cut v2.6.2 release (kubernetes-sigs#3453) update ci e2e script for cert IDs (kubernetes-sigs#3392) fix test failure doc updates (kubernetes-sigs#3426) Change of text "your-cluster-name" (kubernetes-sigs#3152) slice init style suggestion whitespace group errors, emit one event per reconcile, requeue on failure don't block TGB reconciliation loop on failed SG ingress reconciliation fix: remove service from function args feat: resolve health check port name for NLB Expose ingress configuration options for missing backends (kubernetes-sigs#3342) Stricter dependency/security review remove unnecessary patch requests (kubernetes-sigs#3380) increase timeout to 2h in ci scripts wait for the TG to be healthy before cleanup any resource
2 parents 4699ac4 + 3e26f86 commit a622844

32 files changed

+477
-264
lines changed

.github/workflows/deps.yml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: "Dependency Review"
2+
on: [push, pull_request, workflow_dispatch]
3+
permissions:
4+
contents: read
5+
jobs:
6+
dependency-review:
7+
runs-on: ubuntu-latest
8+
steps:
9+
- name: "Checkout Repository"
10+
uses: actions/checkout@v4
11+
with:
12+
show-progress: false
13+
- name: "Dependency Review"
14+
uses: actions/dependency-review-action@v3
15+
govulncheck:
16+
runs-on: ubuntu-latest
17+
steps:
18+
- name: "Checkout Repository"
19+
uses: actions/checkout@v4
20+
with:
21+
show-progress: false
22+
- id: govulncheck
23+
uses: golang/govulncheck-action@v1
24+
with:
25+
go-version-input: 1.21.3
26+
go-version-file: go.mod

.ko.yaml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
defaultBaseImage: repocache.nonprod.ppops.net/docker-ecr-public-remote/eks-distro-build-tooling/eks-distro-minimal-base-nonroot:2023-06-06-1686078098.2
1+
defaultBaseImage: repocache.nonprod.ppops.net/docker-ecr-public-remote/eks-distro-build-tooling/eks-distro-minimal-base-nonroot:2023-09-06-1694026927.2
22
builds:
33
- env:
44
- CGO_ENABLED=0
@@ -11,3 +11,4 @@ builds:
1111
- -X sigs.k8s.io/aws-load-balancer-controller/pkg/version.GitVersion={{.Env.GIT_VERSION}}
1212
- -X sigs.k8s.io/aws-load-balancer-controller/pkg/version.GitCommit={{.Env.GIT_COMMIT}}
1313
- -X sigs.k8s.io/aws-load-balancer-controller/pkg/version.BuildDate={{.Env.BUILD_DATE}}
14+

Makefile

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,13 @@
22
MAKEFILE_PATH = $(dir $(realpath -s $(firstword $(MAKEFILE_LIST))))
33

44
# Image URL to use all building/pushing image targets
5-
VERSION ?= v2.6.0
5+
VERSION ?= v2.6.2
66
DOCKER_REPO ?= repocache.nonprod.ppops.net/temp-docker-local
77
IMG ?= ${DOCKER_REPO}/aws-load-balancer-controller:${VERSION}
88
# Image URL to use for builder stage in Docker build
9-
BUILD_IMAGE ?= public.ecr.aws/docker/library/golang:1.20.5
9+
BUILD_IMAGE ?= public.ecr.aws/docker/library/golang:1.21.3
1010
# Image URL to use for base layer in Docker build
11-
BASE_IMAGE ?= public.ecr.aws/eks-distro-build-tooling/eks-distro-minimal-base-nonroot:2023-06-06-1686078098.2
11+
BASE_IMAGE ?= public.ecr.aws/eks-distro-build-tooling/eks-distro-minimal-base-nonroot:2023-09-06-1694026927.2
1212
IMG_PLATFORM ?= linux/amd64,linux/arm64
1313
# ECR doesn't appear to support SPDX SBOM
1414
IMG_SBOM ?= none

config/controller/kustomization.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,4 +9,4 @@ kind: Kustomization
99
images:
1010
- name: controller
1111
newName: public.ecr.aws/eks/aws-load-balancer-controller
12-
newTag: v2.6.0
12+
newTag: v2.6.2

controllers/ingress/group_controller.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ func NewGroupReconciler(cloud aws.Cloud, k8sClient client.Client, eventRecorder
5151

5252
annotationParser := annotations.NewSuffixAnnotationParser(annotations.AnnotationPrefixIngress)
5353
authConfigBuilder := ingress.NewDefaultAuthConfigBuilder(annotationParser)
54-
enhancedBackendBuilder := ingress.NewDefaultEnhancedBackendBuilder(k8sClient, annotationParser, authConfigBuilder)
54+
enhancedBackendBuilder := ingress.NewDefaultEnhancedBackendBuilder(k8sClient, annotationParser, authConfigBuilder, controllerConfig.IngressConfig.TolerateNonExistentBackendService, controllerConfig.IngressConfig.TolerateNonExistentBackendAction)
5555
referenceIndexer := ingress.NewDefaultReferenceIndexer(enhancedBackendBuilder, authConfigBuilder, logger)
5656
trackingProvider := tracking.NewDefaultProvider(ingressTagPrefix, controllerConfig.ClusterName)
5757
elbv2TaggingManager := elbv2deploy.NewDefaultTaggingManager(cloud.ELBV2(), cloud.VpcID(), controllerConfig.FeatureGates, cloud.RGT(), logger)

docs/deploy/configurations.md

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -69,16 +69,16 @@ Currently, you can set only 1 namespace to watch in this flag. See [this Kuberne
6969
|aws-api-endpoints | AWS API Endpoints Config | | AWS API endpoints mapping, format: serviceID1=URL1,serviceID2=URL2 |
7070
|aws-api-throttle | AWS Throttle Config | [default value](#default-throttle-config ) | throttle settings for AWS APIs, format: serviceID1:operationRegex1=rate:burst,serviceID2:operationRegex2=rate:burst |
7171
|aws-max-retries | int | 10 | Maximum retries for AWS APIs |
72-
|aws-region | string | [instance metadata](#instance-metadata) | AWS Region for the kubernetes cluster |
73-
|aws-vpc-id | string | [instance metadata](#instance-metadata) | AWS VPC ID for the Kubernetes cluster |
72+
|aws-region | string | [instance metadata](#instance-metadata) | AWS Region for the kubernetes cluster |
73+
|aws-vpc-id | string | [instance metadata](#instance-metadata) | AWS VPC ID for the Kubernetes cluster |
7474
|backend-security-group | string | | Backend security group id to use for the ingress rules on the worker node SG|
7575
|cluster-name | string | | Kubernetes cluster name|
7676
|default-ssl-policy | string | ELBSecurityPolicy-2016-08 | Default SSL Policy that will be applied to all Ingresses or Services that do not have the SSL Policy annotation |
7777
|default-tags | stringMap | | AWS Tags that will be applied to all AWS resources managed by this controller. Specified Tags takes highest priority |
7878
|default-target-type | string | instance | Default target type for Ingresses and Services - ip, instance |
7979
|[disable-ingress-class-annotation](#disable-ingress-class-annotation) | boolean | false | Disable new usage of the `kubernetes.io/ingress.class` annotation |
8080
|[disable-ingress-group-name-annotation](#disable-ingress-group-name-annotation) | boolean | false | Disallow new use of the `alb.ingress.kubernetes.io/group.name` annotation |
81-
|disable-restricted-sg-rules | boolean | false | Disable the usage of restricted security group rules |
81+
|disable-restricted-sg-rules | boolean | false | Disable the usage of restricted security group rules |
8282
|enable-backend-security-group | boolean | true | Enable sharing of security groups for backend traffic |
8383
|enable-endpoint-slices | boolean | false | Use EndpointSlices instead of Endpoints for pod endpoint and TargetGroupBinding resolution for load balancers with IP targets. |
8484
|enable-leader-election | boolean | true | Enable leader election for the load balancer controller manager. Enabling this will ensure there is only one active controller manager |
@@ -98,9 +98,11 @@ Currently, you can set only 1 namespace to watch in this flag. See [this Kuberne
9898
|log-level | string | info | Set the controller log level - info, debug |
9999
|metrics-bind-addr | string | :8080 | The address the metric endpoint binds to |
100100
|service-max-concurrent-reconciles | int | 3 | Maximum number of concurrently running reconcile loops for service |
101-
|[sync-period](#sync-period) | duration | 10h0m0s | Period at which the controller forces the repopulation of its local object stores|
101+
|[sync-period](#sync-period) | duration | 10h0m0s | Period at which the controller forces the repopulation of its local object stores|
102102
|targetgroupbinding-max-concurrent-reconciles | int | 3 | Maximum number of concurrently running reconcile loops for targetGroupBinding |
103103
|targetgroupbinding-max-exponential-backoff-delay | duration | 16m40s | Maximum duration of exponential backoff for targetGroupBinding reconcile failures |
104+
|tolerate-non-existent-backend-service | boolean | true | Whether to allow rules which refer to backend services that do not exist |
105+
|tolerate-non-existent-backend-action | boolean | true | Whether to allow rules which refer to backend actions that do not exist |
104106
|watch-namespace | string | | Namespace the controller watches for updates to Kubernetes objects, If empty, all namespaces are watched. |
105107
|webhook-bind-port | int | 9443 | The TCP port the Webhook server binds to |
106108
|webhook-cert-dir | string | /tmp/k8s-webhook-server/serving-certs | The directory that contains the server key and certificate |

docs/deploy/installation.md

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,9 @@ The LBC is supported by AWS. Some clusters may be using the legacy "in-tree" fun
2626
* Ensure subnets are tagged appropriately for auto-discovery to work
2727
* For IP targets, pods must have IPs from the VPC subnets. You can configure the [`amazon-vpc-cni-k8s`](https://github.com/aws/amazon-vpc-cni-k8s#readme) plugin for this purpose.
2828

29+
### Additional requirements for isolated cluster:
30+
Isolated clusters are clusters without internet access, and instead reply on VPC endpoints for all required connects.
31+
When installing the AWS LBC in isolated clusters, you need to disable shield, waf and wafv2 via controller flags `--enable-shield=false, --enable-waf=false, --enable-wafv2=false`
2932
### Using the Amazon EC2 instance metadata server version 2 (IMDSv2)
3033
We recommend blocking the access to instance metadata by requiring the instance to use [IMDSv2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html) only. For more information, please refer to the AWS guidance [here](https://aws.github.io/aws-eks-best-practices/security/docs/iam/#restrict-access-to-the-instance-profile-assigned-to-the-worker-node). If you are using the IMDSv2, set the hop limit to 2 or higher in order to allow the LBC to perform the metadata introspection.
3134

@@ -87,15 +90,15 @@ Example condition for cluster name resource tag:
8790
2. Download an IAM policy for the LBC using one of the following commands:<p>
8891
If your cluster is in a US Gov Cloud region:
8992
```
90-
curl -o iam-policy.json https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.6.0/docs/install/iam_policy_us-gov.json
93+
curl -o iam-policy.json https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.6.2/docs/install/iam_policy_us-gov.json
9194
```
9295
If your cluster is in a China region:
9396
```
94-
curl -o iam-policy.json https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.6.0/docs/install/iam_policy_cn.json
97+
curl -o iam-policy.json https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.6.2/docs/install/iam_policy_cn.json
9598
```
9699
If your cluster is in any other region:
97100
```
98-
curl -o iam-policy.json https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.6.0/docs/install/iam_policy.json
101+
curl -o iam-policy.json https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.6.2/docs/install/iam_policy.json
99102
```
100103
101104
3. Create an IAM policy named `AWSLoadBalancerControllerIAMPolicy`. If you downloaded a different policy, replace `iam-policy` with the name of the policy that you downloaded.
@@ -121,7 +124,7 @@ Example condition for cluster name resource tag:
121124
### Option B: Attach IAM policies to nodes
122125
If you're not setting up IAM roles for service accounts, apply the IAM policies from the following URL at a minimum. Please be aware of the possibility that the controller permissions may be assumed by other users in a pod after retrieving the node role credentials, so the best practice would be using IRSA instead of attaching IAM policy directly.
123126
```
124-
curl -o iam-policy.json https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.6.0/docs/install/iam_policy.json
127+
curl -o iam-policy.json https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.6.2/docs/install/iam_policy.json
125128
```
126129
127130
The following IAM permissions subset is for those using `TargetGroupBinding` only and don't plan to use the LBC to manage security group rules:
@@ -155,6 +158,7 @@ Review the [worker nodes security group](https://docs.aws.amazon.com/eks/latest/
155158
156159
If you use [eksctl](https://eksctl.io/usage/vpc-networking/), this is the default configuration.
157160
161+
If you use custom networking, please refer to the [EKS Best Practices Guides](https://aws.github.io/aws-eks-best-practices/networking/custom-networking/#use-custom-networking-when) for network configuration.
158162
## Add controller to cluster
159163
160164
We recommend using the Helm chart to install the controller. The chart supports Fargate and facilitates updating the controller.
@@ -174,7 +178,8 @@ We recommend using the Helm chart to install the controller. The chart supports
174178
```
175179
2. If upgrading the chart via `helm upgrade`, install the `TargetGroupBinding` CRDs.
176180
```
177-
kubectl apply -k "github.com/aws/eks-charts/stable/aws-load-balancer-controller//crds?ref=master"
181+
wget https://raw.githubusercontent.com/aws/eks-charts/master/stable/aws-load-balancer-controller/crds/crds.yaml
182+
kubectl apply -f crds.yaml
178183
```
179184
180185
!!!tip
@@ -204,7 +209,7 @@ We recommend using the Helm chart to install the controller. The chart supports
204209
### Apply YAML
205210
1. Download the spec for the LBC.
206211
```
207-
wget https://github.com/kubernetes-sigs/aws-load-balancer-controller/releases/download/v2.6.0/v2_6_0_full.yaml
212+
wget https://github.com/kubernetes-sigs/aws-load-balancer-controller/releases/download/v2.6.2/v2_6_2_full.yaml
208213
```
209214
2. Edit the saved yaml file, go to the Deployment spec, and set the controller `--cluster-name` arg value to your EKS cluster name
210215
```
@@ -219,7 +224,7 @@ We recommend using the Helm chart to install the controller. The chart supports
219224
spec:
220225
containers:
221226
- args:
222-
- --cluster-name=<INSERT_CLUSTER_NAME>
227+
- --cluster-name=<your-cluster-name>
223228
```
224229
3. If you use IAM roles for service accounts, we recommend that you delete the `ServiceAccount` from the yaml spec. If you delete the installation section from the yaml spec, deleting the `ServiceAccount` preserves the `eksctl` created `iamserviceaccount`.
225230
```
@@ -228,15 +233,15 @@ We recommend using the Helm chart to install the controller. The chart supports
228233
```
229234
4. Apply the yaml file
230235
```
231-
kubectl apply -f v2_6_0_full.yaml
236+
kubectl apply -f v2_6_2_full.yaml
232237
```
233238
5. Optionally download the default ingressclass and ingressclass params
234239
```
235-
wget https://github.com/kubernetes-sigs/aws-load-balancer-controller/releases/download/v2.6.0/v2_6_0_ingclass.yaml
240+
wget https://github.com/kubernetes-sigs/aws-load-balancer-controller/releases/download/v2.6.2/v2_6_2_ingclass.yaml
236241
```
237242
6. Apply the ingressclass and params
238243
```
239-
kubectl apply -f v2_6_0_ingclass.yaml
244+
kubectl apply -f v2_6_2_ingclass.yaml
240245
```
241246
242247
## Create Update Strategy

docs/examples/echo_server.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -87,9 +87,9 @@ In this walkthrough, you'll
8787
1. Deploy all the echoserver resources (namespace, service, deployment)
8888

8989
```bash
90-
kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.6.0/docs/examples/echoservice/echoserver-namespace.yaml &&\
91-
kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.6.0/docs/examples/echoservice/echoserver-service.yaml &&\
92-
kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.6.0/docs/examples/echoservice/echoserver-deployment.yaml
90+
kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.6.2/docs/examples/echoservice/echoserver-namespace.yaml &&\
91+
kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.6.2/docs/examples/echoservice/echoserver-service.yaml &&\
92+
kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.6.2/docs/examples/echoservice/echoserver-deployment.yaml
9393
```
9494

9595
1. List all the resources to ensure they were created.
@@ -113,7 +113,7 @@ In this walkthrough, you'll
113113
1. Download the echoserver ingress manifest locally.
114114

115115
```bash
116-
wget https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.6.0/docs/examples/echoservice/echoserver-ingress.yaml
116+
wget https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.6.2/docs/examples/echoservice/echoserver-ingress.yaml
117117
```
118118

119119
1. Configure the subnets, either by add annotation to the ingress or add tags to subnets. This step is optional in lieu of auto-discovery.
@@ -300,7 +300,7 @@ You should get back a valid response.
300300
follow below steps if you want to use kube2iam to provide the AWS credentials
301301

302302
1. configure the proper policy
303-
The policy to be used can be fetched from https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.6.0/docs/install/iam_policy.json
303+
The policy to be used can be fetched from https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.6.2/docs/install/iam_policy.json
304304

305305
1. configure the proper role and create the trust relationship
306306
You have to find which role is associated with your K8S nodes. Once you found take note of the full arn:

docs/guide/ingress/ingress_class.md

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,33 @@ You can use IngressClassParams to enforce settings for a set of Ingresses.
104104
- key: idle_timeout.timeout_seconds
105105
value: "120"
106106
```
107+
- with subnets.ids
108+
```
109+
apiVersion: elbv2.k8s.aws/v1beta1
110+
kind: IngressClassParams
111+
metadata:
112+
name: awesome-class
113+
spec:
114+
subnets:
115+
ids:
116+
- subnet-xxx
117+
- subnet-123
118+
```
119+
- with subnets.tags
120+
```
121+
apiVersion: elbv2.k8s.aws/v1beta1
122+
kind: IngressClassParams
123+
metadata:
124+
name: class2048-config
125+
spec:
126+
subnets:
127+
tags:
128+
kubernetes.io/role/internal-elb:
129+
- "1"
130+
myKey:
131+
- myVal0
132+
- myVal1
133+
```
107134

108135
### IngressClassParams specification
109136

docs/index.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,3 +52,5 @@ This project was formerly known as "AWS ALB Ingress Controller", we rebranded it
5252

5353
If you think you’ve found a potential security issue, please do not post it in the Issues. Instead, please follow the instructions [here](https://aws.amazon.com/security/vulnerability-reporting/) or [email AWS security directly](mailto:[email protected]).
5454

55+
## Support Policy
56+
Currently, AWS provides security updates and bug fixes to the latest available minor versions of AWS LBC. For other ad-hoc supports on older versions, please reach out through AWS support ticket.

0 commit comments

Comments
 (0)