You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Merge in DEL/aws-load-balancer-controller-fork from IENGOC-39 to main
* commit '3e26f86e82a5d419a7f8adfc5c95dd45984be6f4':
IENGOC-39: Remediate more bd vulnerabilities
IENGOC-39: Remediate bd vulnerabilities
cut v2.6.2 release (kubernetes-sigs#3453)
update ci e2e script for cert IDs (kubernetes-sigs#3392)
fix test failure
doc updates (kubernetes-sigs#3426)
Change of text "your-cluster-name" (kubernetes-sigs#3152)
slice init style suggestion
whitespace
group errors, emit one event per reconcile, requeue on failure
don't block TGB reconciliation loop on failed SG ingress reconciliation
fix: remove service from function args
feat: resolve health check port name for NLB
Expose ingress configuration options for missing backends (kubernetes-sigs#3342)
Stricter dependency/security review
remove unnecessary patch requests (kubernetes-sigs#3380)
increase timeout to 2h in ci scripts
wait for the TG to be healthy before cleanup any resource
|default-ssl-policy | string | ELBSecurityPolicy-2016-08 | Default SSL Policy that will be applied to all Ingresses or Services that do not have the SSL Policy annotation |
77
77
|default-tags | stringMap | | AWS Tags that will be applied to all AWS resources managed by this controller. Specified Tags takes highest priority |
78
78
|default-target-type | string | instance | Default target type for Ingresses and Services - ip, instance |
79
79
|[disable-ingress-class-annotation](#disable-ingress-class-annotation) | boolean | false | Disable new usage of the `kubernetes.io/ingress.class` annotation |
80
80
|[disable-ingress-group-name-annotation](#disable-ingress-group-name-annotation) | boolean | false | Disallow new use of the `alb.ingress.kubernetes.io/group.name` annotation |
81
-
|disable-restricted-sg-rules | boolean | false | Disable the usage of restricted security group rules |
81
+
|disable-restricted-sg-rules | boolean | false | Disable the usage of restricted security group rules |
82
82
|enable-backend-security-group | boolean | true | Enable sharing of security groups for backend traffic |
83
83
|enable-endpoint-slices | boolean | false | Use EndpointSlices instead of Endpoints for pod endpoint and TargetGroupBinding resolution for load balancers with IP targets. |
84
84
|enable-leader-election | boolean | true | Enable leader election for the load balancer controller manager. Enabling this will ensure there is only one active controller manager |
@@ -98,9 +98,11 @@ Currently, you can set only 1 namespace to watch in this flag. See [this Kuberne
98
98
|log-level | string | info | Set the controller log level - info, debug |
99
99
|metrics-bind-addr | string | :8080 | The address the metric endpoint binds to |
100
100
|service-max-concurrent-reconciles | int | 3 | Maximum number of concurrently running reconcile loops for service |
101
-
|[sync-period](#sync-period) | duration | 10h0m0s | Period at which the controller forces the repopulation of its local object stores|
101
+
|[sync-period](#sync-period) | duration | 10h0m0s | Period at which the controller forces the repopulation of its local object stores|
102
102
|targetgroupbinding-max-concurrent-reconciles | int | 3 | Maximum number of concurrently running reconcile loops for targetGroupBinding |
103
103
|targetgroupbinding-max-exponential-backoff-delay | duration | 16m40s | Maximum duration of exponential backoff for targetGroupBinding reconcile failures |
104
+
|tolerate-non-existent-backend-service | boolean | true | Whether to allow rules which refer to backend services that do not exist |
105
+
|tolerate-non-existent-backend-action | boolean | true | Whether to allow rules which refer to backend actions that do not exist |
104
106
|watch-namespace | string | | Namespace the controller watches for updates to Kubernetes objects, If empty, all namespaces are watched. |
105
107
|webhook-bind-port | int | 9443 | The TCP port the Webhook server binds to |
106
108
|webhook-cert-dir | string | /tmp/k8s-webhook-server/serving-certs | The directory that contains the server key and certificate |
Copy file name to clipboardExpand all lines: docs/deploy/installation.md
+15-10Lines changed: 15 additions & 10 deletions
Original file line number
Diff line number
Diff line change
@@ -26,6 +26,9 @@ The LBC is supported by AWS. Some clusters may be using the legacy "in-tree" fun
26
26
* Ensure subnets are tagged appropriately for auto-discovery to work
27
27
* For IP targets, pods must have IPs from the VPC subnets. You can configure the [`amazon-vpc-cni-k8s`](https://github.com/aws/amazon-vpc-cni-k8s#readme) plugin for this purpose.
28
28
29
+
### Additional requirements for isolated cluster:
30
+
Isolated clusters are clusters without internet access, and instead reply on VPC endpoints for all required connects.
31
+
When installing the AWS LBC in isolated clusters, you need to disable shield, waf and wafv2 via controller flags `--enable-shield=false, --enable-waf=false, --enable-wafv2=false`
29
32
### Using the Amazon EC2 instance metadata server version 2 (IMDSv2)
30
33
We recommend blocking the access to instance metadata by requiring the instance to use [IMDSv2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html) only. For more information, please refer to the AWS guidance [here](https://aws.github.io/aws-eks-best-practices/security/docs/iam/#restrict-access-to-the-instance-profile-assigned-to-the-worker-node). If you are using the IMDSv2, set the hop limit to 2 or higher in order to allow the LBC to perform the metadata introspection.
31
34
@@ -87,15 +90,15 @@ Example condition for cluster name resource tag:
87
90
2. Download an IAM policy for the LBC using one of the following commands:<p>
3. Create an IAM policy named `AWSLoadBalancerControllerIAMPolicy`. If you downloaded a different policy, replace `iam-policy` with the name of the policy that you downloaded.
@@ -121,7 +124,7 @@ Example condition for cluster name resource tag:
121
124
### Option B: Attach IAM policies to nodes
122
125
If you're not setting up IAM roles for service accounts, apply the IAM policies from the following URL at a minimum. Please be aware of the possibility that the controller permissions may be assumed by other users in a pod after retrieving the node role credentials, so the best practice would be using IRSA instead of attaching IAM policy directly.
The following IAM permissions subset is for those using `TargetGroupBinding` only and don't plan to use the LBC to manage security group rules:
@@ -155,6 +158,7 @@ Review the [worker nodes security group](https://docs.aws.amazon.com/eks/latest/
155
158
156
159
If you use [eksctl](https://eksctl.io/usage/vpc-networking/), this is the default configuration.
157
160
161
+
If you use custom networking, please refer to the [EKS Best Practices Guides](https://aws.github.io/aws-eks-best-practices/networking/custom-networking/#use-custom-networking-when) for network configuration.
158
162
## Add controller to cluster
159
163
160
164
We recommend using the Helm chart to install the controller. The chart supports Fargate and facilitates updating the controller.
@@ -174,7 +178,8 @@ We recommend using the Helm chart to install the controller. The chart supports
174
178
```
175
179
2. If upgrading the chart via `helm upgrade`, install the `TargetGroupBinding` CRDs.
2. Edit the saved yaml file, go to the Deployment spec, and set the controller `--cluster-name` arg value to your EKS cluster name
210
215
```
@@ -219,7 +224,7 @@ We recommend using the Helm chart to install the controller. The chart supports
219
224
spec:
220
225
containers:
221
226
- args:
222
-
- --cluster-name=<INSERT_CLUSTER_NAME>
227
+
- --cluster-name=<your-cluster-name>
223
228
```
224
229
3. If you use IAM roles for service accounts, we recommend that you delete the `ServiceAccount` from the yaml spec. If you delete the installation section from the yaml spec, deleting the `ServiceAccount` preserves the `eksctl` created `iamserviceaccount`.
225
230
```
@@ -228,15 +233,15 @@ We recommend using the Helm chart to install the controller. The chart supports
228
233
```
229
234
4. Apply the yaml file
230
235
```
231
-
kubectl apply -f v2_6_0_full.yaml
236
+
kubectl apply -f v2_6_2_full.yaml
232
237
```
233
238
5. Optionally download the default ingressclass and ingressclass params
1. Configure the subnets, either by add annotation to the ingress or add tags to subnets. This step is optional in lieu of auto-discovery.
@@ -300,7 +300,7 @@ You should get back a valid response.
300
300
follow below steps if you want to use kube2iam to provide the AWS credentials
301
301
302
302
1. configure the proper policy
303
-
The policy to be used can be fetched from https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.6.0/docs/install/iam_policy.json
303
+
The policy to be used can be fetched from https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.6.2/docs/install/iam_policy.json
304
304
305
305
1. configure the proper role and create the trust relationship
306
306
You have to find which role is associated with your K8S nodes. Once you found take note of the full arn:
Copy file name to clipboardExpand all lines: docs/index.md
+2Lines changed: 2 additions & 0 deletions
Original file line number
Diff line number
Diff line change
@@ -52,3 +52,5 @@ This project was formerly known as "AWS ALB Ingress Controller", we rebranded it
52
52
53
53
If you think you’ve found a potential security issue, please do not post it in the Issues. Instead, please follow the instructions [here](https://aws.amazon.com/security/vulnerability-reporting/) or [email AWS security directly](mailto:[email protected]).
54
54
55
+
## Support Policy
56
+
Currently, AWS provides security updates and bug fixes to the latest available minor versions of AWS LBC. For other ad-hoc supports on older versions, please reach out through AWS support ticket.
0 commit comments