Skip to content

Commit a3f3744

Browse files
kishorjkishorj
authored
user guide for NLB-IP support (#1430)
1 parent 6521c59 commit a3f3744

File tree

1 file changed

+76
-0
lines changed

1 file changed

+76
-0
lines changed

‎docs/guide/nlb-ip.md

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
# NLB IP mode
2+
AWS Load Balancer Controller supports Network Load Balancer (NLB) with IP targets for pods running on Amazon EC2 instances and AWS Fargate through Kubernetes service of type `LoadBalancer` with proper annotation. In this mode, the AWS NLB targets traffic directly to the Kubernetes pods behind the service, eliminating the need for an extra network hop through the worker nodes in the Kubernetes cluster.
3+
4+
## Prerequisites
5+
* Kubernetes 1.20 and later with the AWS cloudprovider fix to allow external management of load balancers
6+
* AWS Loadbalancer Controller v2.0
7+
* Pods have native AWS VPC networking configured, see [Amazon VPC CNI plugin](https://github.com/aws/amazon-vpc-cni-k8s)
8+
9+
## Configuration
10+
The NLB IP mode is determined based on the annotations added to the service object. For NLB in IP mode, apply the following annotation to the service:
11+
```yaml
12+
metadata:
13+
name: my-service
14+
annotations:
15+
service.beta.kubernetes.io/aws-load-balancer-type: "nlb-ip"
16+
```
17+
18+
**NOTE**: Do not modify the service annotation `service.beta.kubernetes.io/aws-load-balancer-type` on an existing service object. If you need to modify the underlying AWS LoadBalancer type, for example from classic to NLB, delete the kubernetes service first and create again with the correct annotation. Failure to do so will result in leaked AWS load balancer resources.
19+
20+
The default load balancer is internet-facing. To create an internal load balancer, apply the following annotation to your service:
21+
22+
```
23+
service.beta.kubernetes.io/aws-load-balancer-internal: "true"
24+
```
25+
26+
## Subnet tagging for load balancers
27+
28+
You must have at least one tagged subnet in your VPC for NLB IP mode. If an AZ has multiple tagged subnets, the first one in lexicographical order by subnet ID is choosen.
29+
For internet-facing load balancer, you must tag the public subnets as folows:
30+
31+
| Key | Value |
32+
| --- | --- |
33+
| `kubernetes.io/role/elb` | `1` |
34+
35+
For internal load balancer, you must tag the private subnets as follows:
36+
37+
| Key | Value |
38+
| --- | --- |
39+
| `kubernetes.io/role/internal-elb` | `1` |
40+
41+
## Protocols
42+
Support is available for both TCP and UDP protocols. In case of TCP, NLB in IP mode does not pass the client source IP address to the pods. You can configure protocol v2 via annotation if you need the client source IP address.
43+
44+
## Security group
45+
NLB does not currently support a managed security group. For ingress access, the controller will resolve the security group for the ENI corresponding tho the endpoint pod. If the ENI has a single security group, it gets used. In case of multiple security gropus, the controller expects to find only one security group tagged with the Kubernetes cluster id. Controller will update the ingress rules on the security groups as per the service spec.
46+
47+
## Annotations
48+
Support is available for all of the NLB instance mode annotations. Annotation values must be strings,
49+
* boolean: 'true'
50+
* integer: '42'
51+
* stringMap: k1=v1,k2=v2
52+
* stringList: s1,s2,s3
53+
* json: 'jsonContent'
54+
55+
|Name | Type | Default |
56+
|-----------------------------------------------------------------------------------|-------------------|---------------|
57+
|service.beta.kubernetes.io/aws-load-balancer-type | string | |
58+
|service.beta.kubernetes.io/aws-load-balancer-internal | boolean | false |
59+
|service.beta.kubernetes.io/aws-load-balancer-proxy-protocol | string | |
60+
|service.beta.kubernetes.io/aws-load-balancer-access-log-enabled | boolean | false |
61+
|service.beta.kubernetes.io/aws-load-balancer-access-log-s3-bucket-name | string | |
62+
|service.beta.kubernetes.io/aws-load-balancer-access-log-s3-bucket-prefix | string | |
63+
|service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled | boolean | false |
64+
|service.beta.kubernetes.io/aws-load-balancer-ssl-cert | stringList | |
65+
|service.beta.kubernetes.io/aws-load-balancer-ssl-ports | stringList | |
66+
|service.beta.kubernetes.io/aws-load-balancer-ssl-negotiation-policy | string | ELBSecurityPolicy-2016-08 |
67+
|service.beta.kubernetes.io/aws-load-balancer-backend-protocol | string | |
68+
|service.beta.kubernetes.io/aws-load-balancer-additional-resource-tags | stringMap | |
69+
|service.beta.kubernetes.io/aws-load-balancer-healthcheck-healthy-threshold | integer | 3 |
70+
|service.beta.kubernetes.io/aws-load-balancer-healthcheck-unhealthy-threshold | integer | 3 |
71+
|service.beta.kubernetes.io/aws-load-balancer-healthcheck-timeout | integer | 10 |
72+
|service.beta.kubernetes.io/aws-load-balancer-healthcheck-interval | integer | 10 |
73+
|service.beta.kubernetes.io/aws-load-balancer-healthcheck-protocol | string | TCP |
74+
|service.beta.kubernetes.io/aws-load-balancer-healthcheck-port | string | traffic-port |
75+
|service.beta.kubernetes.io/aws-load-balancer-healthcheck-path | string | "/" for HTTP(S) protocols |
76+
|service.beta.kubernetes.io/aws-load-balancer-eip-allocations | stringList | |

0 commit comments

Comments
 (0)