Skip to content

Commit cc0b3a1

Browse files
stacksimplifystacksimplify
committed
Welcome to StackSimplify
1 parent f93c09a commit cc0b3a1

File tree

21 files changed

+1013
-0
lines changed

21 files changed

+1013
-0
lines changed

‎19-ELB-Network-LoadBalancers-with-LBC/19-01-LBC-NLB-Basic/README.md

+121
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
---
2+
title: AWS Load Balancer Controller - NLB Basics
3+
description: Learn to use AWS Network Load Balancer with AWS Load Balancer Controller
4+
---
5+
6+
## Step-01: Introduction
7+
- Understand more about
8+
- **AWS Cloud Provider Load Balancer Controller (Legacy):** Creates AWS CLB and NLB
9+
- **AWS Load Balancer Controller (Latest):** Creates AWS ALB and NLB
10+
- Understand how the Kubernetes Service of Type Load Balancer which can create AWS NLB to be associated with latest `AWS Load Balancer Controller`.
11+
- Understand various NLB Annotations
12+
13+
14+
## Step-02: Review 01-Nginx-App3-Deployment.yml
15+
- **File Name:** `kube-manifests/01-Nginx-App3-Deployment.yml`
16+
```yaml
17+
apiVersion: apps/v1
18+
kind: Deployment
19+
metadata:
20+
name: app3-nginx-deployment
21+
labels:
22+
app: app3-nginx
23+
spec:
24+
replicas: 1
25+
selector:
26+
matchLabels:
27+
app: app3-nginx
28+
template:
29+
metadata:
30+
labels:
31+
app: app3-nginx
32+
spec:
33+
containers:
34+
- name: app2-nginx
35+
image: stacksimplify/kubenginx:1.0.0
36+
ports:
37+
- containerPort: 80
38+
39+
```
40+
41+
## Step-03: Review 02-LBC-NLB-LoadBalancer-Service.yml
42+
- **File Name:** `kube-manifests\02-LBC-NLB-LoadBalancer-Service.yml`
43+
```yaml
44+
apiVersion: v1
45+
kind: Service
46+
metadata:
47+
name: basics-lbc-network-lb
48+
annotations:
49+
# Traffic Routing
50+
service.beta.kubernetes.io/aws-load-balancer-name: basics-lbc-network-lb
51+
service.beta.kubernetes.io/aws-load-balancer-type: external
52+
service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: instance
53+
#service.beta.kubernetes.io/aws-load-balancer-subnets: subnet-xxxx, mySubnet ## Subnets are auto-discovered if this annotation is not specified, see Subnet Discovery for further details.
54+
55+
# Health Check Settings
56+
service.beta.kubernetes.io/aws-load-balancer-healthcheck-protocol: http
57+
service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: traffic-port
58+
service.beta.kubernetes.io/aws-load-balancer-healthcheck-path: /index.html
59+
service.beta.kubernetes.io/aws-load-balancer-healthcheck-healthy-threshold: "3"
60+
service.beta.kubernetes.io/aws-load-balancer-healthcheck-unhealthy-threshold: "3"
61+
service.beta.kubernetes.io/aws-load-balancer-healthcheck-interval: "10" # The controller currently ignores the timeout configuration due to the limitations on the AWS NLB. The default timeout for TCP is 10s and HTTP is 6s.
62+
63+
# Access Control
64+
service.beta.kubernetes.io/load-balancer-source-ranges: 0.0.0.0/0
65+
service.beta.kubernetes.io/aws-load-balancer-scheme: "internet-facing"
66+
67+
# AWS Resource Tags
68+
service.beta.kubernetes.io/aws-load-balancer-additional-resource-tags: Environment=dev,Team=test
69+
spec:
70+
type: LoadBalancer
71+
selector:
72+
app: app3-nginx
73+
ports:
74+
- port: 80
75+
targetPort: 80
76+
```
77+
78+
## Step-04: Deploy all kube-manifests
79+
```t
80+
# Deploy kube-manifests
81+
kubectl apply -f kube-manifests/
82+
83+
# Verify Pods
84+
kubectl get pods
85+
86+
# Verify Services
87+
kubectl get svc
88+
Observation:
89+
1. Verify the network lb DNS name
90+
91+
# Verify AWS Load Balancer Controller pod logs
92+
kubectl -n kube-system get pods
93+
kubectl -n kube-system logs -f <aws-load-balancer-controller-POD-NAME>
94+
95+
# Verify using AWS Mgmt Console
96+
Go to Services -> EC2 -> Load Balancing -> Load Balancers
97+
1. Verify Description Tab - DNS Name matching output of "kubectl get svc" External IP
98+
2. Verify Listeners Tab
99+
100+
Go to Services -> EC2 -> Load Balancing -> Target Groups
101+
1. Verify Registered targets
102+
2. Verify Health Check path
103+
104+
# Access Application
105+
http://<NLB-DNS-NAME>
106+
```
107+
108+
## Step-05: Clean-Up
109+
```t
110+
# Delete or Undeploy kube-manifests
111+
kubectl delete -f kube-manifests/
112+
113+
# Verify if NLB deleted
114+
In AWS Mgmt Console,
115+
Go to Services -> EC2 -> Load Balancing -> Load Balancers
116+
```
117+
118+
## References
119+
- [Network Load Balancer](https://docs.aws.amazon.com/eks/latest/userguide/network-load-balancing.html)
120+
- [NLB Service](https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/guide/service/nlb/)
121+
- [NLB Service Annotations](https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/guide/service/annotations/)

‎19-ELB-Network-LoadBalancers-with-LBC/19-01-LBC-NLB-Basic/kube-manifests/01-Nginx-App3-Deployment.yml

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: app3-nginx-deployment
5+
labels:
6+
app: app3-nginx
7+
spec:
8+
replicas: 1
9+
selector:
10+
matchLabels:
11+
app: app3-nginx
12+
template:
13+
metadata:
14+
labels:
15+
app: app3-nginx
16+
spec:
17+
containers:
18+
- name: app2-nginx
19+
image: stacksimplify/kubenginx:1.0.0
20+
ports:
21+
- containerPort: 80

‎19-ELB-Network-LoadBalancers-with-LBC/19-01-LBC-NLB-Basic/kube-manifests/02-LBC-NLB-LoadBalancer-Service.yml

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: basics-lbc-network-lb
5+
annotations:
6+
# Traffic Routing
7+
service.beta.kubernetes.io/aws-load-balancer-name: basics-lbc-network-lb
8+
service.beta.kubernetes.io/aws-load-balancer-type: external
9+
service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: instance # specifies the target type to configure for NLB. You can choose between instance and ip
10+
#service.beta.kubernetes.io/aws-load-balancer-subnets: subnet-xxxx, mySubnet ## Subnets are auto-discovered if this annotation is not specified, see Subnet Discovery for further details.
11+
12+
# Health Check Settings
13+
service.beta.kubernetes.io/aws-load-balancer-healthcheck-protocol: http
14+
service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: traffic-port
15+
service.beta.kubernetes.io/aws-load-balancer-healthcheck-path: /index.html
16+
service.beta.kubernetes.io/aws-load-balancer-healthcheck-healthy-threshold: "3"
17+
service.beta.kubernetes.io/aws-load-balancer-healthcheck-unhealthy-threshold: "3"
18+
service.beta.kubernetes.io/aws-load-balancer-healthcheck-interval: "10" # The controller currently ignores the timeout configuration due to the limitations on the AWS NLB. The default timeout for TCP is 10s and HTTP is 6s.
19+
20+
# Access Control
21+
service.beta.kubernetes.io/load-balancer-source-ranges: 0.0.0.0/0 # specifies the CIDRs that are allowed to access the NLB.
22+
service.beta.kubernetes.io/aws-load-balancer-scheme: "internet-facing" # specifies whether the NLB will be internet-facing or internal
23+
24+
# AWS Resource Tags
25+
service.beta.kubernetes.io/aws-load-balancer-additional-resource-tags: Environment=dev,Team=test
26+
spec:
27+
type: LoadBalancer
28+
selector:
29+
app: app3-nginx
30+
ports:
31+
- port: 80
32+
targetPort: 80

‎19-ELB-Network-LoadBalancers-with-LBC/19-02-LBC-NLB-TLS/README.md

+77
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
---
2+
title: AWS Load Balancer Controller - NLB TLS
3+
description: Learn to use AWS Network Load Balancer TLS with AWS Load Balancer Controller
4+
---
5+
6+
## Step-01: Introduction
7+
- Understand about the 4 TLS Annotations for Network Load Balancers
8+
- aws-load-balancer-ssl-cert
9+
- aws-load-balancer-ssl-ports
10+
- aws-load-balancer-ssl-negotiation-policy
11+
- aws-load-balancer-ssl-negotiation-policy
12+
13+
## Step-02: Review TLS Annotations
14+
- **File Name:** `kube-manifests\02-LBC-NLB-LoadBalancer-Service.yml`
15+
- **Security Policies:** https://docs.aws.amazon.com/elasticloadbalancing/latest/network/create-tls-listener.html#describe-ssl-policies
16+
```yaml
17+
# TLS
18+
service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:us-east-1:180789647333:certificate/d86de939-8ffd-410f-adce-0ce1f5be6e0d
19+
service.beta.kubernetes.io/aws-load-balancer-ssl-ports: 443, # Specify this annotation if you need both TLS and non-TLS listeners on the same load balancer
20+
service.beta.kubernetes.io/aws-load-balancer-ssl-negotiation-policy: ELBSecurityPolicy-TLS13-1-2-2021-06
21+
service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
22+
```
23+
24+
25+
## Step-03: Deploy all kube-manifests
26+
```t
27+
# Deploy kube-manifests
28+
kubectl apply -f kube-manifests/
29+
30+
# Verify Pods
31+
kubectl get pods
32+
33+
# Verify Services
34+
kubectl get svc
35+
Observation:
36+
1. Verify the network lb DNS name
37+
38+
# Verify AWS Load Balancer Controller pod logs
39+
kubectl -n kube-system get pods
40+
kubectl -n kube-system logs -f <aws-load-balancer-controller-POD-NAME>
41+
42+
# Verify using AWS Mgmt Console
43+
Go to Services -> EC2 -> Load Balancing -> Load Balancers
44+
1. Verify Description Tab - DNS Name matching output of "kubectl get svc" External IP
45+
2. Verify Listeners Tab
46+
Observation: Should see two listeners Port 80 and 443
47+
48+
Go to Services -> EC2 -> Load Balancing -> Target Groups
49+
1. Verify Registered targets
50+
2. Verify Health Check path
51+
Observation: Should see two target groups. 1 Target group for 1 listener
52+
53+
# Access Application
54+
# Test HTTP URL
55+
http://<NLB-DNS-NAME>
56+
http://lbc-network-lb-tls-demo-a956479ba85953f8.elb.us-east-1.amazonaws.com
57+
58+
# Test HTTPS URL
59+
https://<NLB-DNS-NAME>
60+
https://lbc-network-lb-tls-demo-a956479ba85953f8.elb.us-east-1.amazonaws.com
61+
```
62+
63+
## Step-04: Clean-Up
64+
```t
65+
# Delete or Undeploy kube-manifests
66+
kubectl delete -f kube-manifests/
67+
68+
# Verify if NLB deleted
69+
In AWS Mgmt Console,
70+
Go to Services -> EC2 -> Load Balancing -> Load Balancers
71+
```
72+
73+
## References
74+
- [Network Load Balancer](https://docs.aws.amazon.com/eks/latest/userguide/network-load-balancing.html)
75+
- [NLB Service](https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/guide/service/nlb/)
76+
- [NLB Service Annotations](https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/guide/service/annotations/)
77+

‎19-ELB-Network-LoadBalancers-with-LBC/19-02-LBC-NLB-TLS/kube-manifests/01-Nginx-App3-Deployment.yml

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: app3-nginx-deployment
5+
labels:
6+
app: app3-nginx
7+
spec:
8+
replicas: 1
9+
selector:
10+
matchLabels:
11+
app: app3-nginx
12+
template:
13+
metadata:
14+
labels:
15+
app: app3-nginx
16+
spec:
17+
containers:
18+
- name: app2-nginx
19+
image: stacksimplify/kubenginx:1.0.0
20+
ports:
21+
- containerPort: 80

‎19-ELB-Network-LoadBalancers-with-LBC/19-02-LBC-NLB-TLS/kube-manifests/02-LBC-NLB-LoadBalancer-Service.yml

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: tls-lbc-network-lb
5+
annotations:
6+
# Traffic Routing
7+
service.beta.kubernetes.io/aws-load-balancer-name: tls-lbc-network-lb
8+
service.beta.kubernetes.io/aws-load-balancer-type: external
9+
service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: instance
10+
#service.beta.kubernetes.io/aws-load-balancer-subnets: subnet-xxxx, mySubnet ## Subnets are auto-discovered if this annotation is not specified, see Subnet Discovery for further details.
11+
12+
# Health Check Settings
13+
service.beta.kubernetes.io/aws-load-balancer-healthcheck-protocol: http
14+
service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: traffic-port
15+
service.beta.kubernetes.io/aws-load-balancer-healthcheck-path: /index.html
16+
service.beta.kubernetes.io/aws-load-balancer-healthcheck-healthy-threshold: "3"
17+
service.beta.kubernetes.io/aws-load-balancer-healthcheck-unhealthy-threshold: "3"
18+
service.beta.kubernetes.io/aws-load-balancer-healthcheck-interval: "10" # The controller currently ignores the timeout configuration due to the limitations on the AWS NLB. The default timeout for TCP is 10s and HTTP is 6s.
19+
20+
# Access Control
21+
service.beta.kubernetes.io/load-balancer-source-ranges: 0.0.0.0/0
22+
service.beta.kubernetes.io/aws-load-balancer-scheme: "internet-facing"
23+
24+
# AWS Resource Tags
25+
service.beta.kubernetes.io/aws-load-balancer-additional-resource-tags: Environment=dev,Team=test
26+
27+
# TLS
28+
service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:us-east-1:180789647333:certificate/d86de939-8ffd-410f-adce-0ce1f5be6e0d # specifies the ARN of one or more certificates managed by the AWS Certificate Manager.
29+
service.beta.kubernetes.io/aws-load-balancer-ssl-ports: 443, # Specify this annotation if you need both TLS and non-TLS listeners on the same load balancer
30+
service.beta.kubernetes.io/aws-load-balancer-ssl-negotiation-policy: ELBSecurityPolicy-TLS13-1-2-2021-06 # specifies the Security Policy for NLB frontend connections, allowing you to control the protocol and ciphers.
31+
service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp # specifies whether to use TLS or TCP for the backend traffic between the load balancer and the kubernetes pods.
32+
spec:
33+
type: LoadBalancer
34+
selector:
35+
app: app3-nginx
36+
ports:
37+
- name: http
38+
port: 80 # Creates NLB Port 80 Listener
39+
targetPort: 80 # Creates NLB Port 80 Target Group-1
40+
- name: https
41+
port: 443 # Creates NLB Port 443 Listener
42+
targetPort: 80 # Creates NLB Port 80 Target Group-2
43+
- name: http81
44+
port: 81 # Creates NLB Port 81 Listener
45+
targetPort: 80 # Creates NLB Port 80 Target Group-3
46+
- name: http82
47+
port: 82 # Creates NLB Port 82 Listener
48+
targetPort: 80 # Creates NLB Port 80 Target Group-4
49+
50+
# Note-1: Listener to Target Group is a one to one Mapping
51+
# Note-2: Every listener will have its own new Target Group created with that port mentioned in targetPort field
52+
# Note-3: This might not be a effective way but unfortunately when you create via kubernetes service, thats the behavior

0 commit comments

Comments
 (0)