aws-load-balancer-controller

I am curious what firewall configurations one would recommend for internet facing network traffic in a kubernetes cluster? I am using EKS but would love to hear any and all options, suggestions regardless if only available from another cloud vender managed solution. My first instinct was to use the new AWS Load Balancer Controller which can create an ALB + WAF setup. This guide seems like exactly what I was thinking of: https://aws.amazon.com/premiumsupport/knowledge-center/eks-alb-ingress-aws-waf/. However, I learned that the only certs the ALB works with are from ACM. So I looked into setting up my hands free dns + cert management (external-dns + cert-manager) with a ACM cert manager Issuer. But seems like that not possible?! https://github.com/kubernetes-sigs/aws-load-balancer-controller/issues/1143 https://github.com/kubernetes-sigs

I don't think it's that simple: Here's an example of an AWS open source project, written in Go and hosted on GitHub: https://github.com/kubernetes-sigs/aws-load-balancer-control...

I agree with you that we still have some ways to go with getting LB right, especially WRT to K8S. I think one of the problems is that it seems like every different app is a snowflake with different requirements, so all of these libraries try to be the jack of all trades, leaving the mastery to custom scripts (if it's even obtainable). For instance: https://github.com/kubernetes-sigs/aws-alb-ingress-controlle... Also, and you probably already know about this, but it's true that ingress won't create the record automatically for you - but external-dns ( https://github.com/kubernetes-sigs/external-dns ) will - with the correct annotations (pretty simple), external-dns will watch for changes to ingress and publish the dns records on R53 (and many other DNS providers) for you. It works really well for us, even when the subdomain is shared with

Just to note, the CoreOS ALB controller [0] has very little in common with the design of Skipper. The ALB controller configures Amazon Cloud "Application Load Balancers" and adds a Kubernetes service as the upstream. There's nothing in the data path. [0] Now adopted by SIG-AWS as https://github.com/kubernetes-sigs/aws-alb-ingress-controlle...

For special reazon, our project should use AWS ALB(not ELB) or NLB to catch an application in k8s cluster. We are using kops to manage the k8s cluster. It seems its load balancer stategy is using ELB for AWS cloud. I have researched some approach to realize it: - ELB https://github.com/kubernetes/kops/tree/master/addons/ingress-nginx - ALB https://github.com/coreos/alb-ingress-controller - External-DNS https://github.com/kubernetes-incubator/external-dns About the second ALB, it shows: NOTE: This controller is in alpha state as we attempt to move to our first 1.0 release. The current image version is 1.0-alpha.3. Please file any issues you find and note the version used. So it seems that it isn't a good choice for production environment. Then, what's the good way?

Or something akin to this: https://github.com/coreos/alb-ingress-controller And the blog post with a full writeup: https://aws.amazon.com/blogs/apn/coreos-and-ticketmaster-col... Or for the ELB stuff and not the ALBs: https://github.com/sky-uk/feed

Tectonic is Enterprise Kubernetes. We start with pure upstream Kubernetes at the core and install it in a production ready setup with the Tectonic Installer[1] across clouds or bare metal. On top of those basics Tectonic provides things most organizations need: - Authentication backed by LDAP/SAML/etc - One-click automated updates of the entire cluster - Pre-configured cluster monitoring/alerting There is a bunch more in there and in the roadmap too but that gives you a taste. The other thing is that we provide professional services, training, and support to customers on the whole stack from the VM or machine on up to the Kubernetes API. We have done neat collaborations with customers like the ALB Ingress Controller[2] too. [1] https://github.com/coreos/tectonic-installer [2] https://github.com/coreos/alb-ingress-controller

Yes, it's not specifically a criticism of kops. Supporting ALB as an ingress controller seems to be the direction, with the coreos contributed code the likely winner.[1] Thought it worth mentioning though, as the older ELB+k8s isn't great, and because the ALB support hasn't shaken out yet, a cluster created with kops could be suboptimal unless you address it afterwards. I assume once it all shakes out, kops would support whatever the direction is. [1] https://github.com/coreos/alb-ingress-controller

For Route53 integration, have you looked at https://github.com/kubernetes-incubator/external-dns? (or its progenitors Mate and DNS-Controller) Looks like CoreOS just contributed an ALB Ingress implementation: https://github.com/coreos/alb-ingress-controller