Skip to content

Commit 14dda07

Browse files
johngmyersjohngmyers
authored
Add --default-target-type flag (#2840)
1 parent e238bd6 commit 14dda07

File tree

10 files changed

+451
-12
lines changed

10 files changed

+451
-12
lines changed

‎controllers/ingress/group_controller.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,8 @@ func NewGroupReconciler(cloud aws.Cloud, k8sClient client.Client, eventRecorder
5757
annotationParser, subnetsResolver,
5858
authConfigBuilder, enhancedBackendBuilder, trackingProvider, elbv2TaggingManager, controllerConfig.FeatureGates,
5959
cloud.VpcID(), controllerConfig.ClusterName, controllerConfig.DefaultTags, controllerConfig.ExternalManagedTags,
60-
controllerConfig.DefaultSSLPolicy, backendSGProvider, controllerConfig.EnableBackendSecurityGroup, controllerConfig.DisableRestrictedSGRules, controllerConfig.FeatureGates.Enabled(config.EnableIPTargetType), logger)
60+
controllerConfig.DefaultSSLPolicy, controllerConfig.DefaultTargetType, backendSGProvider,
61+
controllerConfig.EnableBackendSecurityGroup, controllerConfig.DisableRestrictedSGRules, controllerConfig.FeatureGates.Enabled(config.EnableIPTargetType), logger)
6162
stackMarshaller := deploy.NewDefaultStackMarshaller()
6263
stackDeployer := deploy.NewDefaultStackDeployer(cloud, k8sClient, networkingSGManager, networkingSGReconciler,
6364
controllerConfig, ingressTagPrefix, logger)

‎controllers/service/service_controller.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package service
33
import (
44
"context"
55
"fmt"
6+
67
"github.com/go-logr/logr"
78
"github.com/pkg/errors"
89
corev1 "k8s.io/api/core/v1"
@@ -43,7 +44,7 @@ func NewServiceReconciler(cloud aws.Cloud, k8sClient client.Client, eventRecorde
4344
elbv2TaggingManager := elbv2.NewDefaultTaggingManager(cloud.ELBV2(), cloud.VpcID(), controllerConfig.FeatureGates, logger)
4445
serviceUtils := service.NewServiceUtils(annotationParser, serviceFinalizer, controllerConfig.ServiceConfig.LoadBalancerClass, controllerConfig.FeatureGates)
4546
modelBuilder := service.NewDefaultModelBuilder(annotationParser, subnetsResolver, vpcInfoProvider, cloud.VpcID(), trackingProvider,
46-
elbv2TaggingManager, controllerConfig.FeatureGates, controllerConfig.ClusterName, controllerConfig.DefaultTags, controllerConfig.ExternalManagedTags, controllerConfig.DefaultSSLPolicy, controllerConfig.FeatureGates.Enabled(config.EnableIPTargetType), serviceUtils)
47+
elbv2TaggingManager, controllerConfig.FeatureGates, controllerConfig.ClusterName, controllerConfig.DefaultTags, controllerConfig.ExternalManagedTags, controllerConfig.DefaultSSLPolicy, controllerConfig.DefaultTargetType, controllerConfig.FeatureGates.Enabled(config.EnableIPTargetType), serviceUtils)
4748
stackMarshaller := deploy.NewDefaultStackMarshaller()
4849
stackDeployer := deploy.NewDefaultStackDeployer(cloud, k8sClient, networkingSGManager, networkingSGReconciler, controllerConfig, serviceTagPrefix, logger)
4950
return &serviceReconciler{

‎docs/deploy/configurations.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,7 @@ Currently, you can set only 1 namespace to watch in this flag. See [this Kuberne
7575
|cluster-name | string | | Kubernetes cluster name|
7676
|default-ssl-policy | string | ELBSecurityPolicy-2016-08 | Default SSL Policy that will be applied to all Ingresses or Services that do not have the SSL Policy annotation |
7777
|default-tags | stringMap | | AWS Tags that will be applied to all AWS resources managed by this controller. Specified Tags takes highest priority |
78+
|default-target-type | string | instance | Default target type for Ingresses and Services - ip, instance |
7879
|[disable-ingress-class-annotation](#disable-ingress-class-annotation) | boolean | false | Disable new usage of the `kubernetes.io/ingress.class` annotation |
7980
|[disable-ingress-group-name-annotation](#disable-ingress-group-name-annotation) | boolean | false | Disallow new use of the `alb.ingress.kubernetes.io/group.name` annotation |
8081
|disable-restricted-sg-rules | boolean | false | Disable the usage of restricted security group rules |

‎pkg/config/controller_config.go

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,14 @@ import (
99
"k8s.io/apimachinery/pkg/util/sets"
1010
"sigs.k8s.io/aws-load-balancer-controller/pkg/aws"
1111
"sigs.k8s.io/aws-load-balancer-controller/pkg/inject"
12+
"sigs.k8s.io/aws-load-balancer-controller/pkg/model/elbv2"
1213
)
1314

1415
const (
1516
flagLogLevel = "log-level"
1617
flagK8sClusterName = "cluster-name"
1718
flagDefaultTags = "default-tags"
19+
flagDefaultTargetType = "default-target-type"
1820
flagExternalManagedTags = "external-managed-tags"
1921
flagServiceMaxConcurrentReconciles = "service-max-concurrent-reconciles"
2022
flagTargetGroupBindingMaxConcurrentReconciles = "targetgroupbinding-max-concurrent-reconciles"
@@ -66,6 +68,9 @@ type ControllerConfig struct {
6668
// Default AWS Tags that will be applied to all AWS resources managed by this controller.
6769
DefaultTags map[string]string
6870

71+
// Default target type for Ingress and Service objects
72+
DefaultTargetType string
73+
6974
// List of Tag keys on AWS resources that will be managed externally.
7075
ExternalManagedTags []string
7176

@@ -103,6 +108,8 @@ func (cfg *ControllerConfig) BindFlags(fs *pflag.FlagSet) {
103108
fs.StringVar(&cfg.ClusterName, flagK8sClusterName, "", "Kubernetes cluster name")
104109
fs.StringToStringVar(&cfg.DefaultTags, flagDefaultTags, nil,
105110
"Default AWS Tags that will be applied to all AWS resources managed by this controller")
111+
fs.StringVar(&cfg.DefaultTargetType, flagDefaultTargetType, string(elbv2.TargetTypeInstance),
112+
"Default target type for Ingresses and Services - ip, instance")
106113
fs.StringSliceVar(&cfg.ExternalManagedTags, flagExternalManagedTags, nil,
107114
"List of Tag keys on AWS resources that will be managed externally")
108115
fs.IntVar(&cfg.ServiceMaxConcurrentReconciles, flagServiceMaxConcurrentReconciles, defaultMaxConcurrentReconciles,
@@ -147,6 +154,9 @@ func (cfg *ControllerConfig) Validate() error {
147154
if err := cfg.validateExternalManagedTagsCollisionWithDefaultTags(); err != nil {
148155
return err
149156
}
157+
if err := cfg.validateDefaultTargetType(); err != nil {
158+
return err
159+
}
150160
if err := cfg.validateBackendSecurityGroupConfiguration(); err != nil {
151161
return err
152162
}
@@ -181,6 +191,15 @@ func (cfg *ControllerConfig) validateExternalManagedTagsCollisionWithDefaultTags
181191
return nil
182192
}
183193

194+
func (cfg *ControllerConfig) validateDefaultTargetType() error {
195+
switch cfg.DefaultTargetType {
196+
case string(elbv2.TargetTypeInstance), string(elbv2.TargetTypeIP):
197+
return nil
198+
default:
199+
return errors.Errorf("invalid value %v for default target type", cfg.DefaultTargetType)
200+
}
201+
}
202+
184203
func (cfg *ControllerConfig) validateBackendSecurityGroupConfiguration() error {
185204
if len(cfg.BackendSecurityGroup) == 0 {
186205
return nil

‎pkg/ingress/model_builder.go

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ func NewDefaultModelBuilder(k8sClient client.Client, eventRecorder record.EventR
4040
annotationParser annotations.Parser, subnetsResolver networkingpkg.SubnetsResolver,
4141
authConfigBuilder AuthConfigBuilder, enhancedBackendBuilder EnhancedBackendBuilder,
4242
trackingProvider tracking.Provider, elbv2TaggingManager elbv2deploy.TaggingManager, featureGates config.FeatureGates,
43-
vpcID string, clusterName string, defaultTags map[string]string, externalManagedTags []string, defaultSSLPolicy string,
43+
vpcID string, clusterName string, defaultTags map[string]string, externalManagedTags []string, defaultSSLPolicy string, defaultTargetType string,
4444
backendSGProvider networkingpkg.BackendSGProvider, enableBackendSG bool, disableRestrictedSGRules bool, enableIPTargetType bool, logger logr.Logger) *defaultModelBuilder {
4545
certDiscovery := NewACMCertDiscovery(acmClient, logger)
4646
ruleOptimizer := NewDefaultRuleOptimizer(logger)
@@ -63,6 +63,7 @@ func NewDefaultModelBuilder(k8sClient client.Client, eventRecorder record.EventR
6363
defaultTags: defaultTags,
6464
externalManagedTags: sets.NewString(externalManagedTags...),
6565
defaultSSLPolicy: defaultSSLPolicy,
66+
defaultTargetType: elbv2model.TargetType(defaultTargetType),
6667
enableBackendSG: enableBackendSG,
6768
disableRestrictedSGRules: disableRestrictedSGRules,
6869
enableIPTargetType: enableIPTargetType,
@@ -94,6 +95,7 @@ type defaultModelBuilder struct {
9495
defaultTags map[string]string
9596
externalManagedTags sets.String
9697
defaultSSLPolicy string
98+
defaultTargetType elbv2model.TargetType
9799
enableBackendSG bool
98100
disableRestrictedSGRules bool
99101
enableIPTargetType bool
@@ -133,7 +135,7 @@ func (b *defaultModelBuilder) Build(ctx context.Context, ingGroup Group) (core.S
133135
defaultIPAddressType: elbv2model.IPAddressTypeIPV4,
134136
defaultScheme: elbv2model.LoadBalancerSchemeInternal,
135137
defaultSSLPolicy: b.defaultSSLPolicy,
136-
defaultTargetType: elbv2model.TargetTypeInstance,
138+
defaultTargetType: b.defaultTargetType,
137139
defaultBackendProtocol: elbv2model.ProtocolHTTP,
138140
defaultBackendProtocolVersion: elbv2model.ProtocolVersionHTTP1,
139141
defaultHealthCheckPathHTTP: "/",

‎pkg/ingress/model_builder_test.go

Lines changed: 227 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -197,6 +197,7 @@ func Test_defaultModelBuilder_Build(t *testing.T) {
197197
tests := []struct {
198198
name string
199199
env env
200+
defaultTargetType string
200201
enableIPTargetType *bool
201202
args args
202203
fields fields
@@ -3886,6 +3887,226 @@ func Test_defaultModelBuilder_Build(t *testing.T) {
38863887
}
38873888
}
38883889
}
3890+
}`,
3891+
},
3892+
{
3893+
name: "default target type IP with named target port",
3894+
env: env{
3895+
svcs: []*corev1.Service{svcWithNamedTargetPort},
3896+
},
3897+
fields: fields{
3898+
resolveViaDiscoveryCalls: []resolveViaDiscoveryCall{resolveViaDiscoveryCallForInternalLB},
3899+
listLoadBalancersCalls: []listLoadBalancersCall{listLoadBalancerCallForEmptyLB},
3900+
enableBackendSG: true,
3901+
},
3902+
args: args{
3903+
ingGroup: Group{
3904+
ID: GroupID{Namespace: "ns-1", Name: "ing-1"},
3905+
Members: []ClassifiedIngress{
3906+
{
3907+
Ing: &networking.Ingress{ObjectMeta: metav1.ObjectMeta{
3908+
Namespace: "ns-1",
3909+
Name: "ing-1",
3910+
},
3911+
Spec: networking.IngressSpec{
3912+
Rules: []networking.IngressRule{
3913+
{
3914+
IngressRuleValue: networking.IngressRuleValue{
3915+
HTTP: &networking.HTTPIngressRuleValue{
3916+
Paths: []networking.HTTPIngressPath{
3917+
{
3918+
Path: "/",
3919+
Backend: networking.IngressBackend{
3920+
Service: &networking.IngressServiceBackend{
3921+
Name: svcWithNamedTargetPort.Name,
3922+
Port: networking.ServiceBackendPort{
3923+
Name: "https",
3924+
},
3925+
},
3926+
},
3927+
},
3928+
},
3929+
},
3930+
},
3931+
},
3932+
},
3933+
},
3934+
},
3935+
},
3936+
},
3937+
},
3938+
},
3939+
defaultTargetType: "ip",
3940+
wantStackJSON: `
3941+
{
3942+
"id":"ns-1/ing-1",
3943+
"resources":{
3944+
"AWS::EC2::SecurityGroup":{
3945+
"ManagedLBSecurityGroup":{
3946+
"spec":{
3947+
"groupName":"k8s-ns1-ing1-bd83176788",
3948+
"description":"[k8s] Managed SecurityGroup for LoadBalancer",
3949+
"ingress":[
3950+
{
3951+
"ipProtocol":"tcp",
3952+
"fromPort":80,
3953+
"toPort":80,
3954+
"ipRanges":[
3955+
{
3956+
"cidrIP":"0.0.0.0/0"
3957+
}
3958+
]
3959+
}
3960+
]
3961+
}
3962+
}
3963+
},
3964+
"AWS::ElasticLoadBalancingV2::Listener":{
3965+
"80":{
3966+
"spec":{
3967+
"loadBalancerARN":{
3968+
"$ref":"#/resources/AWS::ElasticLoadBalancingV2::LoadBalancer/LoadBalancer/status/loadBalancerARN"
3969+
},
3970+
"port":80,
3971+
"protocol":"HTTP",
3972+
"defaultActions":[
3973+
{
3974+
"type":"fixed-response",
3975+
"fixedResponseConfig":{
3976+
"contentType":"text/plain",
3977+
"statusCode":"404"
3978+
}
3979+
}
3980+
]
3981+
}
3982+
}
3983+
},
3984+
"AWS::ElasticLoadBalancingV2::ListenerRule":{
3985+
"80:1":{
3986+
"spec":{
3987+
"listenerARN":{
3988+
"$ref":"#/resources/AWS::ElasticLoadBalancingV2::Listener/80/status/listenerARN"
3989+
},
3990+
"priority":1,
3991+
"actions":[
3992+
{
3993+
"type":"forward",
3994+
"forwardConfig":{
3995+
"targetGroups":[
3996+
{
3997+
"targetGroupARN":{
3998+
"$ref":"#/resources/AWS::ElasticLoadBalancingV2::TargetGroup/ns-1/ing-1-svc-named-targetport:https/status/targetGroupARN"
3999+
}
4000+
}
4001+
]
4002+
}
4003+
}
4004+
],
4005+
"conditions":[
4006+
{
4007+
"field":"path-pattern",
4008+
"pathPatternConfig":{
4009+
"values":[
4010+
"/"
4011+
]
4012+
}
4013+
}
4014+
]
4015+
}
4016+
}
4017+
},
4018+
"AWS::ElasticLoadBalancingV2::LoadBalancer":{
4019+
"LoadBalancer":{
4020+
"spec":{
4021+
"name":"k8s-ns1-ing1-b7e914000d",
4022+
"type":"application",
4023+
"scheme":"internal",
4024+
"ipAddressType":"ipv4",
4025+
"subnetMapping":[
4026+
{
4027+
"subnetID":"subnet-a"
4028+
},
4029+
{
4030+
"subnetID":"subnet-b"
4031+
}
4032+
],
4033+
"securityGroups":[
4034+
{
4035+
"$ref":"#/resources/AWS::EC2::SecurityGroup/ManagedLBSecurityGroup/status/groupID"
4036+
},
4037+
"sg-auto"
4038+
]
4039+
}
4040+
}
4041+
},
4042+
"AWS::ElasticLoadBalancingV2::TargetGroup":{
4043+
"ns-1/ing-1-svc-named-targetport:https":{
4044+
"spec":{
4045+
"name":"k8s-ns1-svcnamed-3430e53ee8",
4046+
"targetType":"ip",
4047+
"ipAddressType":"ipv4",
4048+
"port":1,
4049+
"protocol":"HTTP",
4050+
"protocolVersion":"HTTP1",
4051+
"healthCheckConfig":{
4052+
"port":"traffic-port",
4053+
"protocol":"HTTP",
4054+
"path":"/",
4055+
"matcher":{
4056+
"httpCode":"200"
4057+
},
4058+
"intervalSeconds":15,
4059+
"timeoutSeconds":5,
4060+
"healthyThresholdCount":2,
4061+
"unhealthyThresholdCount":2
4062+
}
4063+
}
4064+
}
4065+
},
4066+
"K8S::ElasticLoadBalancingV2::TargetGroupBinding":{
4067+
"ns-1/ing-1-svc-named-targetport:https":{
4068+
"spec":{
4069+
"template":{
4070+
"metadata":{
4071+
"name":"k8s-ns1-svcnamed-3430e53ee8",
4072+
"namespace":"ns-1",
4073+
"creationTimestamp":null
4074+
},
4075+
"spec":{
4076+
"targetGroupARN":{
4077+
"$ref":"#/resources/AWS::ElasticLoadBalancingV2::TargetGroup/ns-1/ing-1-svc-named-targetport:https/status/targetGroupARN"
4078+
},
4079+
"targetType":"ip",
4080+
"ipAddressType":"ipv4",
4081+
"serviceRef":{
4082+
"name":"svc-named-targetport",
4083+
"port":"https"
4084+
},
4085+
"networking":{
4086+
"ingress":[
4087+
{
4088+
"from":[
4089+
{
4090+
"securityGroup":{
4091+
"groupID": "sg-auto"
4092+
}
4093+
}
4094+
],
4095+
"ports":[
4096+
{
4097+
"port": "target-port",
4098+
"protocol":"TCP"
4099+
}
4100+
]
4101+
}
4102+
]
4103+
}
4104+
}
4105+
}
4106+
}
4107+
}
4108+
}
4109+
}
38894110
}`,
38904111
},
38914112
}
@@ -3933,6 +4154,10 @@ func Test_defaultModelBuilder_Build(t *testing.T) {
39334154
}
39344155
backendSGProvider.EXPECT().Release(gomock.Any()).Return(nil).AnyTimes()
39354156
}
4157+
defaultTargetType := tt.defaultTargetType
4158+
if defaultTargetType == "" {
4159+
defaultTargetType = "instance"
4160+
}
39364161

39374162
b := &defaultModelBuilder{
39384163
k8sClient: k8sClient,
@@ -3953,7 +4178,8 @@ func Test_defaultModelBuilder_Build(t *testing.T) {
39534178
featureGates: config.NewFeatureGates(),
39544179
logger: &log.NullLogger{},
39554180

3956-
defaultSSLPolicy: "ELBSecurityPolicy-2016-08",
4181+
defaultSSLPolicy: "ELBSecurityPolicy-2016-08",
4182+
defaultTargetType: elbv2model.TargetType(defaultTargetType),
39574183
}
39584184

39594185
if tt.enableIPTargetType == nil {

0 commit comments

Comments
 (0)