Networking Operators

Procedure

1. Create a new project within your cluster for the AWS Load Balancer Operator:

   $ oc new-project aws-load-balancer-operator

   Copy to Clipboard Toggle word wrap

2. Create an AWS IAM policy for the AWS Load Balancer Operator.

   1. Download the appropriate IAM policy:

      $ curl -o ${SCRATCH}/operator-permission-policy.json https://raw.githubusercontent.com/openshift/aws-load-balancer-operator/refs/heads/main/hack/operator-permission-policy.json

      Copy to Clipboard Toggle word wrap

   2. Create the permission policy for the Operator:

      $ aws iam create-policy \
              --policy-name aws-load-balancer-operator-policy \
              --policy-document file://${SCRATCH}/operator-permission-policy.json \
              --region ${REGION}

      Copy to Clipboard Toggle word wrap

      Take note of the Operator policy ARN in the output. This is referred to as the $OPERATOR_POLICY_ARN for the remainder of this process.

3. Create an AWS IAM role for the AWS Load Balancer Operator:

   1. Create the trust policy for the Operator role:

      $ cat <<EOF > "${SCRATCH}/operator-trust-policy.json"
      {
       "Version": "2012-10-17",
       "Statement": [
       {
       "Effect": "Allow",
       "Condition": {
         "StringEquals" : {
           "${OIDC_ENDPOINT}:sub": ["system:serviceaccount:aws-load-balancer-operator:aws-load-balancer-operator-controller-manager", "system:serviceaccount:aws-load-balancer-operator:aws-load-balancer-controller-cluster"]
         }
       },
       "Principal": {
         "Federated": "arn:aws:iam::${AWS_ACCOUNT_ID}:oidc-provider/${OIDC_ENDPOINT}"
       },
       "Action": "sts:AssumeRoleWithWebIdentity"
       }
       ]
      }
      EOF

      Copy to Clipboard Toggle word wrap

   2. Create the Operator role using the trust policy:

      $ aws iam create-role --role-name "${CLUSTER_NAME}-alb-operator" \
          --assume-role-policy-document "file://${SCRATCH}/operator-trust-policy.json"

      Copy to Clipboard Toggle word wrap

      Take note of the Operator role ARN in the output. This is referred to as the $OPERATOR_ROLE_ARN for the remainder of this process.

   3. Associate the Operator role and policy:

      $ aws iam attach-role-policy --role-name "${CLUSTER_NAME}-alb-operator" \
          --policy-arn $OPERATOR_POLICY_ARN

      Copy to Clipboard Toggle word wrap

4. Install the AWS Load Balancer Operator by creating an OperatorGroup and a Subscription:

   $ cat <<EOF | oc apply -f -
   apiVersion: operators.coreos.com/v1
   kind: OperatorGroup
   metadata:
     name: aws-load-balancer-operator
     namespace: aws-load-balancer-operator
   spec:
     targetNamespaces: []
   ---
   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: aws-load-balancer-operator
     namespace: aws-load-balancer-operator
   spec:
     channel: stable-v1
     name: aws-load-balancer-operator
     source: redhat-operators
     sourceNamespace: openshift-marketplace
     config:
       env:
       - name: ROLEARN
         value: "${OPERATOR_ROLE_ARN}"
   EOF

   Copy to Clipboard Toggle word wrap

5. Create an AWS IAM policy for the AWS Load Balancer Controller.

   1. Download the appropriate IAM policy:

      $ curl -o ${SCRATCH}/controller-permission-policy.json https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.12.0/docs/install/iam_policy.json

      Copy to Clipboard Toggle word wrap

   2. Create the permission policy for the Controller:

      $ aws iam create-policy \
          --region ${REGION} \
          --policy-name aws-load-balancer-controller-policy \
          --policy-document file://${SCRATCH}/controller-permission-policy.json

      Copy to Clipboard Toggle word wrap

      Take note of the Controller policy ARN in the output. This is referred to as the $CONTROLLER_POLICY_ARN for the remainder of this process.

6. Create an AWS IAM role for the AWS Load Balancer Controller:

   1. Create the trust policy for the Controller role:

      $ cat <<EOF > ${SCRATCH}/controller-trust-policy.json
      {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::${AWS_ACCOUNT_ID}:oidc-provider/${OIDC_ENDPOINT}"
              },
              "Action": "sts:AssumeRoleWithWebIdentity",
              "Condition": {
                "StringEquals": {
                  "${OIDC_ENDPOINT}:sub": "system:serviceaccount:aws-load-balancer-operator:aws-load-balancer-controller-cluster"
                  }
              }
            }
          ]
        }
      EOF

      Copy to Clipboard Toggle word wrap

   2. Create the Controller role using the trust policy:

      CONTROLLER_ROLE_ARN=$(aws iam create-role --role-name "${CLUSTER_NAME}-albo-controller" \ --assume-role-policy-document "file://${SCRATCH}/controller-trust-policy.json" \ --query Role.Arn --output text) echo ${CONTROLLER_ROLE_ARN}

      Copy to Clipboard Toggle word wrap

      Take note of the Controller role ARN in the output. This is referred to as the $CONTROLLER_ROLE_ARN for the remainder of this process.

   3. Associate the Controller role and policy:

      $ aws iam attach-role-policy \
          --role-name "${CLUSTER_NAME}-albo-controller" \
          --policy-arn ${CONTROLLER_POLICY_ARN}

      Copy to Clipboard Toggle word wrap

7. Deploy an instance of the AWS Load Balancer Controller:

   $ cat << EOF | oc apply -f -
   apiVersion: networking.olm.openshift.io/v1
   kind: AWSLoadBalancerController
   metadata:
    name: cluster
   spec:
    credentialsRequestConfig:
      stsIAMRoleARN: ${CONTROLLER_ROLE_ARN}
   EOF

   Copy to Clipboard Toggle word wrap
   Note

   If you get an error here wait a minute and try again, it means the Operator has not completed installing yet.

8. Confirm that the Operator and Controller pods are both running:

   $ oc -n aws-load-balancer-operator get pods

   Copy to Clipboard Toggle word wrap

   If you do not see output similar to the following, wait a few moments and retry.

   Example output

   NAME                                                             READY   STATUS    RESTARTS   AGE
   aws-load-balancer-controller-cluster-6ddf658785-pdp5d            1/1     Running   0          99s
   aws-load-balancer-operator-controller-manager-577d9ffcb9-w6zqn   2/2     Running   0          2m4s

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a new project:

   $ oc new-project hello-world

   Copy to Clipboard Toggle word wrap

2. Create a new hello-world application based on the hello-openshift image:

   $ oc new-app -n hello-world --image=docker.io/openshift/hello-openshift

   Copy to Clipboard Toggle word wrap

3. Configure a NodePort service for an AWS Application Load Balancer (ALB) to connect to:

   $ cat << EOF | oc apply -f -
   apiVersion: v1
   kind: Service
   metadata:
     name: hello-openshift-nodeport
     namespace: hello-world
   spec:
     ports:
       - port: 80
         targetPort: 8080
         protocol: TCP
     type: NodePort
     selector:
       deployment: hello-openshift
   EOF

   Copy to Clipboard Toggle word wrap

4. Deploy an AWS ALB for the application:

   $ cat << EOF | oc apply -f -
   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: hello-openshift-alb
     namespace: hello-world
     annotations:
       alb.ingress.kubernetes.io/scheme: internet-facing
   spec:
     ingressClassName: alb
     rules:
       - http:
           paths:
             - path: /
               pathType: Exact
               backend:
                 service:
                   name: hello-openshift-nodeport
                   port:
                     number: 80
   EOF

   Copy to Clipboard Toggle word wrap

5. Test access to the AWS ALB endpoint for the application:

   Note

   ALB provisioning takes a few minutes. If you receive an error that says curl: (6) Could not resolve host, please wait and try again.

   $ ALB_INGRESS=$(oc -n hello-world get ingress hello-openshift-alb \
       -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')
   $ curl "http://${ALB_INGRESS}"

   Copy to Clipboard Toggle word wrap

   Example output

   Hello OpenShift!

   Copy to Clipboard Toggle word wrap

6. Deploy an AWS Network Load Balancer (NLB) for the application:

   $ cat << EOF | oc apply -f -
   apiVersion: v1
   kind: Service
   metadata:
     name: hello-openshift-nlb
     namespace: hello-world
     annotations:
       service.beta.kubernetes.io/aws-load-balancer-type: external
       service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: instance
       service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
   spec:
     ports:
       - port: 80
         targetPort: 8080
         protocol: TCP
     type: LoadBalancer
     selector:
       deployment: hello-openshift
   EOF

   Copy to Clipboard Toggle word wrap

7. Test access to the NLB endpoint for the application:

   Note

   NLB provisioning takes a few minutes. If you receive an error that says curl: (6) Could not resolve host, please wait and try again.

   $ NLB=$(oc -n hello-world get service hello-openshift-nlb \
     -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')
   $ curl "http://${NLB}"

   Copy to Clipboard Toggle word wrap

   Example output

   Hello OpenShift!

   Copy to Clipboard Toggle word wrap

8. You can now delete the sample application and all resources in the hello-world namespace.

   $ oc delete project hello-world

   Copy to Clipboard Toggle word wrap

Procedure

1. Delete the Operator Subscription:

   $ oc delete subscription aws-load-balancer-operator -n aws-load-balancer-operator

   Copy to Clipboard Toggle word wrap

2. Detach and delete the relevant AWS IAM roles:

   $ aws iam detach-role-policy \
     --role-name "<cluster-id>-alb-operator" \
     --policy-arn <operator-policy-arn>
   $ aws iam delete-role \
     --role-name "<cluster-id>-alb-operator"

   Copy to Clipboard Toggle word wrap

3. Delete the AWS IAM policy:

   $ aws iam delete-policy --policy-arn <operator-policy-arn>

   Copy to Clipboard Toggle word wrap

1. Create the IngressNodeFirewallConfig inside the openshift-ingress-node-firewall namespace named ingressnodefirewallconfig.

2. Run the following command to deploy Ingress Node Firewall Operator rules:

   $ oc apply -f rule.yaml

   Copy to Clipboard Toggle word wrap

Procedure

1. Apply the following labels to the ingress-node-firewall-system namespace:

   $ oc label namespace openshift-ingress-node-firewall \
       pod-security.kubernetes.io/enforce=privileged \
       pod-security.kubernetes.io/warn=privileged --overwrite

   Copy to Clipboard Toggle word wrap

2. Edit the IngressNodeFirewallConfig object named ingressnodefirewallconfig and set the ebpfProgramManagerMode field:

   Ingress Node Firewall Operator configuration object

   apiVersion: ingressnodefirewall.openshift.io/v1alpha1
   kind: IngressNodeFirewallConfig
   metadata:
     name: ingressnodefirewallconfig
     namespace: openshift-ingress-node-firewall
   spec:
     nodeSelector:
       node-role.kubernetes.io/worker: ""
     ebpfProgramManagerMode: <ebpf_mode>

   Copy to Clipboard Toggle word wrap

   where:

   <ebpf_mode>: Specifies whether or not the Ingress Node Firewall Operator uses the eBPF Manager Operator to manage eBPF programs. Must be either true or false. If unset, eBPF Manager is not used.

Procedure

1. Run the following command to view all current rules :

   $ oc get ingressnodefirewall

   Copy to Clipboard Toggle word wrap

2. Choose one of the returned <resource> names and run the following command to view the rules or configs:

   $ oc get <resource> <name> -o yaml

   Copy to Clipboard Toggle word wrap