Configuring the Application Load Balancer Ingress controller

To set up a backend group, use CustomResourceDefinition HttpBackendGroup. As a backend, you can use a target group in the Application Load Balancer or a bucket in Object Storage.

To configure Application Load Balancer to work with a backend group:

1. Create a backend group with a bucket:

   1. Create a public bucket in Object Storage.
   2. Configure the website homepage and error page.

2. Create a configuration file named demo-app-1.yaml for your application:

   demo-app1.yaml

   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: alb-demo-1
   data:
     nginx.conf: |
       worker_processes auto;
       events {
       }
       http {
         server {
           listen 80 ;
           location = /_healthz {
             add_header Content-Type text/plain;
             return 200 'ok';
           }
           location / {
             add_header Content-Type text/plain;
             return 200 'Index';
           }
           location = /app1 {
             add_header Content-Type text/plain;
             return 200 'This is APP#1';
           }
         }
       }
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: alb-demo-1
     labels:
       app: alb-demo-1
       version: v1
   spec:
     replicas: 2
     selector:
       matchLabels:
         app: alb-demo-1
     strategy:
       type: RollingUpdate
       rollingUpdate:
         maxSurge: 1
         maxUnavailable: 0
     template:
       metadata:
         labels:
           app: alb-demo-1
           version: v1
       spec:
         terminationGracePeriodSeconds: 5
         volumes:
           - name: alb-demo-1
             configMap:
               name: alb-demo-1
         containers:
           - name: alb-demo-1
             image: nginx:latest
             ports:
               - name: http
                 containerPort: 80
             livenessProbe:
               httpGet:
                 path: /_healthz
                 port: 80
               initialDelaySeconds: 3
               timeoutSeconds: 2
               failureThreshold: 2
             volumeMounts:
               - name: alb-demo-1
                 mountPath: /etc/nginx
                 readOnly: true
             resources:
               limits:
                 cpu: 250m
                 memory: 128Mi
               requests:
                 cpu: 100m
                 memory: 64Mi
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: alb-demo-1
   spec:
     selector:
       app: alb-demo-1
     type: NodePort
     ports:
       - name: http
         port: 80
         targetPort: 80
         protocol: TCP
         nodePort: 30081
   

3. In a separate directory, create a file called http-group.yaml containing the HttpBackendGroup object settings:

   apiVersion: alb.yc.io/v1alpha1
   kind: HttpBackendGroup
   metadata:
     name: example-backend-group
   spec:
     backends: # The list of backends.
       - name: alb-demo-1
         weight: 70 # The relative weight of the backend when distributing traffic. The load will be distributed proportionally to the weight of other backends in the group. Be sure to specify the weight even if you have only one backend in the group.
         service:
            name: alb-demo-1
            port:
              number: 80
       - name: bucket-backend
         weight: 30
         storageBucket:
           name: <bucket name>
   

   (Optional) Enter the advanced settings for the controller:

   • spec.backends.useHttp2: The mode using the HTTP/2 protocol.
   • spec.backends.tls: A certificate from the certificate authority that the load balancer will trust when establishing a secure connection with backend endpoints. Specify the certificate contents in the trustedCa field as open text.

   For more information, see Backend groups.

4. Create a file named ingress-http.yaml and specify the previously delegated domain name, certificate ID, and settings for Application Load Balancer in it:

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: alb-demo-tls
     annotations:
       ingress.alb.yc.io/subnets: <list of subnet IDs> # One or more subnets that Application Load Balancer is going to work with.
       ingress.alb.yc.io/security-groups: <list of security group IDs> # One or more security groups for Application Load Balancer. If the parameter is omitted, the default security group is used.
       ingress.alb.yc.io/external-ipv4-address: <auto or static IP address> # Provide public online access to Application Load Balancer. Enter the previously obtained IP address or use `auto` to obtain a new IP address automatically.
       ingress.alb.yc.io/group-name: <Ingress group name> # Grouping of Kubernetes Ingress resources, with each group served by a separate Application Load Balancer instance.
   spec:
     tls:
       - hosts:
         - <domain name>
         secretName: yc-certmgr-cert-id-<TLS certificate ID>
     rules:
       - host: <domain name>
         http:
           paths:
             - path: /app1
               pathType: Exact
               backend:
                 resource:
                   apiGroup: alb.yc.io
                   kind: HttpBackendGroup
                   name: example-backend-group
   

   (Optional) Enter the advanced settings for the controller:

   • ingress.alb.yc.io/internal-ipv4-address: Provide internal access to Application Load Balancer. Enter the internal IP address or use auto to obtain the IP address automatically.

     Note

     You can only use one type of access to Application Load Balancer at a time: ingress.alb.yc.io/external-ipv4-address or ingress.alb.yc.io/internal-ipv4-address.

   • ingress.alb.yc.io/internal-alb-subnet: The subnet for hosting the Application Load Balancer internal IP address. This parameter is required if the ingress.alb.yc.io/internal-ipv4-address parameter is selected.

   • ingress.alb.yc.io/protocol: The connection protocol used by the load balancer and the backends:

     • http: HTTP/1.1. Default value.
     • http2: HTTP/2.
     • grpc: gRPC.

   • ingress.alb.yc.io/prefix-rewrite: Replace the path for the specified value.

   • ingress.alb.yc.io/upgrade-types: Valid values for the Upgrade HTTP header, for example, websocket.

   • ingress.alb.yc.io/request-timeout: The maximum period for which the connection can be established.

   • ingress.alb.yc.io/idle-timeout: The maximum connection keep-alive time with no data to transmit.

     Values for request-timeout and idle-timeout must be specified with units of measurement, for example: 300ms, 1.5h. Acceptable units of measurement:

     • ns: Nanoseconds.
     • us: Microseconds.
     • ms: Milliseconds.
     • s: Seconds.
     • m: Minutes.
     • h: Hours.

   Note

   The settings only apply to the hosts of the given controller rather than the entire Ingress group.

5. Create an Ingress controller, an HttpBackendGroup object, and a Kubernetes app:

   kubectl apply -f .
   

6. Wait until the Ingress controller is created and assigned a public IP address. This may take several minutes:

   kubectl get ingress alb-demo-tls
   

   The expected result is a non-empty value in the ADDRESS field for the created Ingress controller:

   NAME          CLASS   HOSTS          ADDRESS       PORTS    AGE
   alb-demo-tls  <none>  <domain name>  <IP address>  80, 443  15h
   

   Based on the Ingress controller configuration, an L7 load balancer will be automatically deployed.