入口注解提供不必要的 AWS 经典负载均衡器

Question

在我的 AWS EKS 集群中使用 Ingress 对象上的注释配置 AWS 应用程序负载均衡器。此外，还提供了一个不必要的经典负载平衡器。关于如何防止这种情况的任何想法或最佳做法？

resource "kubernetes_service" "api" {
  metadata {
     name = "${var.project_prefix}-api-service"
  }
  spec {
    selector = {
      app = "${var.project_prefix}-api"
    }
    port {
      name = "http"
      port        = 80
      target_port = 1337
    }
    port {
      name = "https"
      port = 443
      target_port = 1337
    }
    type = "LoadBalancer"
  }
}

resource "kubernetes_ingress" "api" {
  wait_for_load_balancer = true
  metadata {
    name = "${var.project_prefix}-api"
    annotations = {
      "kubernetes.io/ingress.class" = "alb"
      "alb.ingress.kubernetes.io/scheme" = "internet-facing"
      "alb.ingress.kubernetes.io/target-type" = "instance"
      "alb.ingress.kubernetes.io/certificate-arn" = local.api-certificate_arn
      "alb.ingress.kubernetes.io/load-balancer-name" = "${var.project_prefix}-api"
      "alb.ingress.kubernetes.io/listen-ports" = "[{\"HTTP\": 80}, {\"HTTPS\":443}]"
      "alb.ingress.kubernetes.io/actions.ssl-redirect" = "{\"Type\": \"redirect\", \"RedirectConfig\": { \"Protocol\": \"HTTPS\", \"Port\": \"443\", \"StatusCode\": \"HTTP_301\"}}"
    }
  }
  spec {
    backend {
      service_name = kubernetes_service.api.metadata.0.name
      service_port = 80
    }
    rule {
      http {
        path {
          path = "/*"
           backend {
            service_name = "ssl-redirect"
            service_port = "use-annotation"
          }
        }
      }
     }
  }
}

Answer 1

您的 LoadBalancer 服务负责部署经典负载均衡器，如果您只是需要一个应用程序负载均衡器，则不需要。

resource "kubernetes_service" "api" {
  metadata {
     name = "${var.project_prefix}-api-service"
  }
  spec {
    selector = {
      app = "${var.project_prefix}-api"
    }
    port {
      name = "http"
      port        = 80
      target_port = 1337
    }
    port {
      name = "https"
      port = 443
      target_port = 1337
    }
    type = "ClusterIP" # See comments below
  }
}

resource "kubernetes_ingress" "api" {
  wait_for_load_balancer = true
  metadata {
    name = "${var.project_prefix}-api"
    annotations = {
      "kubernetes.io/ingress.class" = "alb"
      "alb.ingress.kubernetes.io/target-type" = "ip" # See comments below
      "alb.ingress.kubernetes.io/scheme" = "internet-facing"
      "alb.ingress.kubernetes.io/target-type" = "instance"
      "alb.ingress.kubernetes.io/certificate-arn" = local.api-certificate_arn
      "alb.ingress.kubernetes.io/load-balancer-name" = "${var.project_prefix}-api"
      "alb.ingress.kubernetes.io/listen-ports" = "[{\"HTTP\": 80}, {\"HTTPS\":443}]"
      "alb.ingress.kubernetes.io/actions.ssl-redirect" = "{\"Type\": \"redirect\", \"RedirectConfig\": { \"Protocol\": \"HTTPS\", \"Port\": \"443\", \"StatusCode\": \"HTTP_301\"}}"
    }
  }
  spec {
    backend {
      service_name = kubernetes_service.api.metadata.0.name
      service_port = 80
    }
    rule {
      http {
        path {
          path = "/*"
           backend {
            service_name = "ssl-redirect"
            service_port = "use-annotation"
          }
        }
      }
     }
  }
}

交通模式

根据您的集群和网络设置，您可以使用 ip 目标类型，其中负载均衡器可以通过其 IP 直接与 Kubernetes pods 通信（因此 ClusterIP 服务类型很好）如果您有 CNI 配置，或者将 instance 与 NodePort 服务类型结合使用，因为负载均衡器无法直接访问 pod IP。下面是一些相关链接：

ALB Target Types

VPC CNI EKS Plugin

负载均衡器类型

关于 Kubernetes 负载均衡和 EKS 负载均衡器的一些相关链接。请注意，入口资源是第 7 层，负载均衡服务资源是第 4 层，因此为 EKS 入口资源部署的 ALB 和为负载均衡服务资源部署的 NLB：

Rancher Kubernetes Load Balancers

AWS Load Balancer Comparison

入口注解提供不必要的 AWS 经典负载均衡器

Ingress annotations provisions unnecessary AWS classic load balancer

amazon-web-services

kubernetes

aws-load-balancer

amazon-eks

交通模式

负载均衡器类型