Chapter 2. AWS Load Balancer Operator

Procedure

1. To deploy the AWS Load Balancer Operator on-demand from OperatorHub, create a Subscription object by running the following command:

   $ oc -n aws-load-balancer-operator get sub aws-load-balancer-operator --template='{{.status.installplan.name}}{{"\n"}}'

   Copy to Clipboard Toggle word wrap

2. Check if the status of an install plan is Complete by running the following command:

   $ oc -n aws-load-balancer-operator get ip <install_plan_name> --template='{{.status.phase}}{{"\n"}}'

   Copy to Clipboard Toggle word wrap

3. View the status of the aws-load-balancer-operator-controller-manager deployment by running the following command:

   $ oc get -n aws-load-balancer-operator deployment/aws-load-balancer-operator-controller-manager

   Copy to Clipboard Toggle word wrap

   Example output

   NAME                                           READY     UP-TO-DATE   AVAILABLE   AGE
   aws-load-balancer-operator-controller-manager  1/1       1            1           23h

   Copy to Clipboard Toggle word wrap

Procedure

1. Create the aws-load-balancer-operator project by running the following command:

   $ oc new-project aws-load-balancer-operator

   Copy to Clipboard Toggle word wrap

2. Create the OperatorGroup object by running the following command:

   $ cat <<EOF | oc apply -f -
   apiVersion: operators.coreos.com/v1
   kind: OperatorGroup
   metadata:
     name: aws-load-balancer-operator
     namespace: aws-load-balancer-operator
   spec:
     targetNamespaces: []
   EOF

   Copy to Clipboard Toggle word wrap

3. Create the Subscription object by running the following command:

   $ cat <<EOF | oc apply -f -
   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: aws-load-balancer-operator
     namespace: aws-load-balancer-operator
   spec:
     channel: stable-v1
     name: aws-load-balancer-operator
     source: redhat-operators
     sourceNamespace: openshift-marketplace
     config:
       env:
       - name: ROLEARN
         value: "<albo_role_arn>"
   EOF

   Copy to Clipboard Toggle word wrap

   where:

   <albo_role_arn>

   Specifies the ARN role to be used in the CredentialsRequest to provision the AWS credentials for the AWS Load Balancer Operator. An example for <albo_role_arn> is arn:aws:iam::<aws_account_number>:role/albo-operator.

   Note

   The AWS Load Balancer Operator waits until the secret is created before moving to the Available status.

Procedure

1. Navigate to Operators OperatorHub in the OpenShift Container Platform web console.
2. Select the AWS Load Balancer Operator. You can use the Filter by keyword text box or the filter list to search for the AWS Load Balancer Operator from the list of Operators.
3. Select the aws-load-balancer-operator namespace.

4. On the Install Operator page, select the following options:

   1. For the Update the channel option, select stable-v1.
   2. For the Installation mode option, select All namespaces on the cluster (default).
   3. For the Installed Namespace option, select aws-load-balancer-operator. If the aws-load-balancer-operator namespace does not exist, it gets created during the Operator installation.
   4. Select Update approval as Automatic or Manual. By default, the Update approval is set to Automatic. If you select automatic updates, the Operator Lifecycle Manager (OLM) automatically upgrades the running instance of your Operator without any intervention. If you select manual updates, the OLM creates an update request. As a cluster administrator, you must then manually approve that update request to have the Operator update to the newer version.
5. Click Install.

Procedure

1. Create a Namespace object:

   1. Create a YAML file that defines the Namespace object:

      Example namespace.yaml file

      apiVersion: v1
      kind: Namespace
      metadata:
        name: aws-load-balancer-operator
      # ...

      Copy to Clipboard Toggle word wrap

   2. Create the Namespace object by running the following command:

      $ oc apply -f namespace.yaml

      Copy to Clipboard Toggle word wrap

2. Create an OperatorGroup object:

   1. Create a YAML file that defines the OperatorGroup object:

      Example operatorgroup.yaml file

      apiVersion: operators.coreos.com/v1
      kind: OperatorGroup
      metadata:
        name: aws-lb-operatorgroup
        namespace: aws-load-balancer-operator
      spec:
        upgradeStrategy: Default

      Copy to Clipboard Toggle word wrap

   2. Create the OperatorGroup object by running the following command:

      $ oc apply -f operatorgroup.yaml

      Copy to Clipboard Toggle word wrap

3. Create a Subscription object:

   1. Create a YAML file that defines the Subscription object:

      Example subscription.yaml file

      apiVersion: operators.coreos.com/v1alpha1
      kind: Subscription
      metadata:
        name: aws-load-balancer-operator
        namespace: aws-load-balancer-operator
      spec:
        channel: stable-v1
        installPlanApproval: Automatic
        name: aws-load-balancer-operator
        source: redhat-operators
        sourceNamespace: openshift-marketplace

      Copy to Clipboard Toggle word wrap

   2. Create the Subscription object by running the following command:

      $ oc apply -f subscription.yaml

      Copy to Clipboard Toggle word wrap

Verification

1. Get the name of the install plan from the subscription:

   $ oc -n aws-load-balancer-operator \
     get subscription aws-load-balancer-operator \
     --template='{{.status.installplan.name}}{{"\n"}}'

   Copy to Clipboard Toggle word wrap

2. Check the status of the install plan:

   $ oc -n aws-load-balancer-operator \
     get ip <install_plan_name> \
     --template='{{.status.phase}}{{"\n"}}'

   Copy to Clipboard Toggle word wrap

   The output must be Complete.

Procedure

1. Create a YAML file that defines the AWSLoadBalancerController object:

   Example sample-aws-lb.yaml file

   apiVersion: networking.olm.openshift.io/v1
   kind: AWSLoadBalancerController
   metadata:
     name: cluster
   spec:
     subnetTagging: Auto
     additionalResourceTags:
     - key: example.org/security-scope
       value: staging
     ingressClass: alb
     config:
       replicas: 2
     enabledAddons:
       - AWSWAFv2

   Copy to Clipboard Toggle word wrap

   where:

   kind

   Specifies the AWSLoadBalancerController object.

   metadata.name

   Specifies the AWS Load Balancer Controller name. The Operator adds this instance name as a suffix to all related resources.

   spec.subnetTagging

   Specifies the subnet tagging method for the AWS Load Balancer Controller. The following values are valid:

   • Auto: The AWS Load Balancer Operator determines the subnets that belong to the cluster and tags them appropriately. The Operator cannot determine the role correctly if the internal subnet tags are not present on internal subnet.
   • Manual: You manually tag the subnets that belong to the cluster with the appropriate role tags. Use this option if you installed your cluster on user-provided infrastructure.

   spec.additionalResourceTags

   Specifies the tags used by the AWS Load Balancer Controller when it provisions AWS resources.

   ingressClass

   Specifies the ingress class name. The default value is alb.

   config.replicas

   Specifies the number of replicas of the AWS Load Balancer Controller.

   enabledAddons

   Specifies annotations as an add-on for the AWS Load Balancer Controller.

   AWSWAFv2

   Specifies that enablement of the alb.ingress.kubernetes.io/wafv2-acl-arn annotation.

2. Create the AWSLoadBalancerController object by running the following command:

   $ oc create -f sample-aws-lb.yaml

   Copy to Clipboard Toggle word wrap

3. Create a YAML file that defines the Deployment resource:

   Example sample-aws-lb.yaml file

   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: <echoserver>
     namespace: echoserver
   spec:
     selector:
       matchLabels:
         app: echoserver
     replicas: 3
     template:
       metadata:
         labels:
           app: echoserver
       spec:
         containers:
           - image: openshift/origin-node
             command:
              - "/bin/socat"
             args:
               - TCP4-LISTEN:8080,reuseaddr,fork
               - EXEC:'/bin/bash -c \"printf \\\"HTTP/1.0 200 OK\r\n\r\n\\\"; sed -e \\\"/^\r/q\\\"\"'
             imagePullPolicy: Always
             name: echoserver
             ports:
               - containerPort: 8080

   Copy to Clipboard Toggle word wrap

   where:

   kind

   Specifies the deployment resource.

   metadata.name

   Specifies the deployment name.

   spec.replicas

   Specifies the number of replicas of the deployment.

4. Create a YAML file that defines the Service resource:

   Example service-albo.yaml file

   apiVersion: v1
   kind: Service
   metadata:
     name: <echoserver>
     namespace: echoserver
   spec:
     ports:
       - port: 80
         targetPort: 8080
         protocol: TCP
     type: NodePort
     selector:
       app: echoserver

   Copy to Clipboard Toggle word wrap

   where:

   apiVersion

   Specifies the service resource.

   metadata.name

   Specifies the service name.

5. Create a YAML file that defines the Ingress resource:

   Example ingress-albo.yaml file

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: <name>
     namespace: echoserver
     annotations:
       alb.ingress.kubernetes.io/scheme: internet-facing
       alb.ingress.kubernetes.io/target-type: instance
   spec:
     ingressClassName: alb
     rules:
       - http:
           paths:
             - path: /
               pathType: Exact
               backend:
                 service:
                   name: <echoserver>
                   port:
                     number: 80

   Copy to Clipboard Toggle word wrap

   where:

   metadata.name

   Specifies a name for the Ingress resource.

   service.name

   Specifies the service name.

Procedure

1. Create the config map to contain the certificate authority (CA) bundle in the aws-load-balancer-operator namespace by running the following command:

   $ oc -n aws-load-balancer-operator create configmap trusted-ca

   Copy to Clipboard Toggle word wrap

2. To inject the trusted CA bundle into the config map, add the config.openshift.io/inject-trusted-cabundle=true label to the config map by running the following command:

   $ oc -n aws-load-balancer-operator label cm trusted-ca config.openshift.io/inject-trusted-cabundle=true

   Copy to Clipboard Toggle word wrap

3. Update the AWS Load Balancer Operator subscription to access the config map in the AWS Load Balancer Operator deployment by running the following command:

   $ oc -n aws-load-balancer-operator patch subscription aws-load-balancer-operator --type='merge' -p '{"spec":{"config":{"env":[{"name":"TRUSTED_CA_CONFIGMAP_NAME","value":"trusted-ca"}],"volumes":[{"name":"trusted-ca","configMap":{"name":"trusted-ca"}}],"volumeMounts":[{"name":"trusted-ca","mountPath":"/etc/pki/tls/certs/albo-tls-ca-bundle.crt","subPath":"ca-bundle.crt"}]}}}'

   Copy to Clipboard Toggle word wrap

4. After the AWS Load Balancer Operator is deployed, verify that the CA bundle is added to the aws-load-balancer-operator-controller-manager deployment by running the following command:

   $ oc -n aws-load-balancer-operator exec deploy/aws-load-balancer-operator-controller-manager -c manager -- bash -c "ls -l /etc/pki/tls/certs/albo-tls-ca-bundle.crt; printenv TRUSTED_CA_CONFIGMAP_NAME"

   Copy to Clipboard Toggle word wrap

   Example output

   -rw-r--r--. 1 root 1000690000 5875 Jan 11 12:25 /etc/pki/tls/certs/albo-tls-ca-bundle.crt
   trusted-ca

   Copy to Clipboard Toggle word wrap

5. Optional: Restart deployment of the AWS Load Balancer Operator every time the config map changes by running the following command:

   $ oc -n aws-load-balancer-operator rollout restart deployment/aws-load-balancer-operator-controller-manager

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a YAML file that defines the AWSLoadBalancerController resource:

   Example add-tls-termination-albc.yaml file

   apiVersion: networking.olm.openshift.io/v1
   kind: AWSLoadBalancerController
   metadata:
     name: cluster
   spec:
     subnetTagging: Auto
     ingressClass: tls-termination
   # ...

   Copy to Clipboard Toggle word wrap

   where:

   spec.ingressClass

   Specifies the ingress class name. If the ingress class is not present in your cluster the AWS Load Balancer Controller creates one. The AWS Load Balancer Controller reconciles the additional ingress class values if spec.controller is set to ingress.k8s.aws/alb.

2. Create a YAML file that defines the Ingress resource:

   Example add-tls-termination-ingress.yaml file

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: <example>
     annotations:
       alb.ingress.kubernetes.io/scheme: internet-facing
       alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-west-2:xxxxx
   spec:
     ingressClassName: tls-termination
     rules:
     - host: example.com
       http:
           paths:
             - path: /
               pathType: Exact
               backend:
                 service:
                   name: <example_service>
                   port:
                     number: 80
   # ...

   Copy to Clipboard Toggle word wrap

   where:

   metadata.name

   Specifies the ingress name.

   annotations.alb.ingress.kubernetes.io/scheme

   Specifies the controller that provisions the load balancer for ingress. The provisioning happens in a public subnet to access the load balancer over the internet.

   annotations.alb.ingress.kubernetes.io/certificate-arn

   Specifies the Amazon Resource Name (ARN) of the certificate that you attach to the load balancer.

   spec.ingressClassName

   Specifies the ingress class name.

   rules.host

   Specifies the domain for traffic routing.

   backend.service

   Specifies the service for traffic routing.

Procedure

1. Create an IngressClassParams resource YAML file, for example, sample-single-lb-params.yaml, as follows:

   apiVersion: elbv2.k8s.aws/v1beta1
   kind: IngressClassParams
   metadata:
     name: single-lb-params
   spec:
     group:
       name: single-lb

   Copy to Clipboard Toggle word wrap

   where:

   apiVersion

   Specifies the API group and version of the IngressClassParams resource.

   metadata.name

   Specifies the IngressClassParams resource name.

   spec.group.name

   Specifies the IngressGroup resource name. All of the Ingress resources of this class belong to this IngressGroup.

2. Create the IngressClassParams resource by running the following command:

   $ oc create -f sample-single-lb-params.yaml

   Copy to Clipboard Toggle word wrap

3. Create the IngressClass resource YAML file, for example, sample-single-lb-class.yaml, as follows:

   apiVersion: networking.k8s.io/v1
   kind: IngressClass
   metadata:
     name: single-lb
   spec:
     controller: ingress.k8s.aws/alb
     parameters:
       apiGroup: elbv2.k8s.aws
       kind: IngressClassParams
       name: single-lb-params

   Copy to Clipboard Toggle word wrap

   where:

   apiVersion

   Specifies the API group and version of the IngressClass resource.

   metadata.name

   Specifies the ingress class name.

   spec.controller

   Specifies the controller name. The ingress.k8s.aws/alb value denotes that all ingress resources of this class should be managed by the AWS Load Balancer Controller.

   parameters.apiGroup

   Specifies the API group of the IngressClassParams resource.

   parameters.kind

   Specifies the resource type of the IngressClassParams resource.

   parameters.name

   Specifies the IngressClassParams resource name.

4. Create the IngressClass resource by running the following command:

   $ oc create -f sample-single-lb-class.yaml

   Copy to Clipboard Toggle word wrap

5. Create the AWSLoadBalancerController resource YAML file, for example, sample-single-lb.yaml, as follows:

   apiVersion: networking.olm.openshift.io/v1
   kind: AWSLoadBalancerController
   metadata:
     name: cluster
   spec:
     subnetTagging: Auto
     ingressClass: single-lb

   Copy to Clipboard Toggle word wrap

   where:

   spec.ingressClass

   Specifies the name of the IngressClass resource.

6. Create the AWSLoadBalancerController resource by running the following command:

   $ oc create -f sample-single-lb.yaml

   Copy to Clipboard Toggle word wrap

7. Create the Ingress resource YAML file, for example, sample-multiple-ingress.yaml, as follows:

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: example-1
     annotations:
       alb.ingress.kubernetes.io/scheme: internet-facing
       alb.ingress.kubernetes.io/group.order: "1"
       alb.ingress.kubernetes.io/target-type: instance
   spec:
     ingressClassName: single-lb
     rules:
     - host: example.com
       http:
           paths:
           - path: /blog
             pathType: Prefix
             backend:
               service:
                 name: example-1
                 port:
                   number: 80
   ---
   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: example-2
     annotations:
       alb.ingress.kubernetes.io/scheme: internet-facing
       alb.ingress.kubernetes.io/group.order: "2"
       alb.ingress.kubernetes.io/target-type: instance
   spec:
     ingressClassName: single-lb
     rules:
     - host: example.com
       http:
           paths:
           - path: /store
             pathType: Prefix
             backend:
               service:
                 name: example-2
                 port:
                   number: 80
   ---
   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: example-3
     annotations:
       alb.ingress.kubernetes.io/scheme: internet-facing
       alb.ingress.kubernetes.io/group.order: "3"
       alb.ingress.kubernetes.io/target-type: instance
   spec:
     ingressClassName: single-lb
     rules:
     - host: example.com
       http:
           paths:
           - path: /
             pathType: Prefix
             backend:
               service:
                 name: example-3
                 port:
                   number: 80

   Copy to Clipboard Toggle word wrap

   where:

   metadata.name

   Specifies the ingress name.

   alb.ingress.kubernetes.io/scheme

   Specifies the load balancer to provision in the public subnet to access the internet.

   alb.ingress.kubernetes.io/group.order

   Specifies the order in which the rules from the multiple ingress resources are matched when the request is received at the load balancer.

   alb.ingress.kubernetes.io/target-type

   Specifies that the load balancer will target OpenShift Container Platform nodes to reach the service.

   spec.ingressClassName

   Specifies the ingress class that belongs to this ingress.

   rules.host

   Specifies a domain name used for request routing.

   http.paths.path

   Specifies the path that must route to the service.

   backend.service.name

   Specifies the service name that serves the endpoint configured in the Ingress resource.

   port.number

   Specifies the port on the service that serves the endpoint.

8. Create the Ingress resource by running the following command:

   $ oc create -f sample-multiple-ingress.yaml

   Copy to Clipboard Toggle word wrap