Lab 11.2. Is it possible to connect AWS Loadbalancer to ingress cotroller's service?

oleksazhel

Is it possible to connect AWS Loadbalancer to ingress cotroller's service having AWS EC2 instances as CP and worker nodes and Kates installed via kubeadm? (not EKS)

Because in this lab we have EXTERNAL IP in constantly pending state:

ubuntu@k8scp:~$ kubectl get svc myingress-ingress-nginx-controller
NAME                                 TYPE           CLUSTER-IP     EXTERNAL-IP   PORT(S)                      AGE
myingress-ingress-nginx-controller   LoadBalancer   10.103.55.79   <pending>     80:31269/TCP,443:31271/TCP   42m

It means that we can use only Ingress Controller's Node Port to connect to our applications from outside, what, in turn, means that we can use only 30000-32767 port range for connection and it is not something that we can call secure, because we get direct access to Kuber nodes.

NOTE: I understand that this is possible using AWS EKS, but question is about EC2 instances with Kates installed by kubeadm.

chrispokorni

Hi @oleksazhel,

For the LoadBalancer service type to work as expected, a Cloud Controller Manager would need to be deployed to the cluster. Documentation is not very clear about custom CCMs, typically it directs to Amazon EKS or GKE cloud services. I have attempted a simple LoadBalancer service on GCE, but did not work...
The ExternalIP may work as an alternative though.

Regards,
-Chris

oleksazhel

@chrispokorni Yes Chris, I found out the same and also tried ExternalIP pointing to IP address of manually created ALB (to internal or external IP doesn't matter), but got no success. So let's consider this is not possible without CCM.

chrispokorni

Hi @oleksazhel,

I just came across the following forum post, slightly off-topic but may still be relevant:

https://discuss.kubernetes.io/t/a-loadbalancer-service-and-registration-with-a-private-load-balancer/15919

Regards,
-Chris

oleksazhel

Thanks @chrispokorni Chris, yeah I considered usage of MetalLB, but it won't use AWS ALB/NLB. AFAIK it is for not cloud related, but for standalone Kates cluster.