Fields and annotations of the Service resource for the Ingress controller

The Service resource represents a Kubernetes service. For the Ingress controller, Application Load Balancer services are backends across which incoming traffic is distributed within a Managed Service for Kubernetes cluster. Services operating as Application Load Balancer backends may be specified in the Ingress resource either directly or as part of HttpBackendGroup groups.

Service is a standard Kubernetes resource. Below, we describe its fields and annotations used by the Application Load Balancer tools for Managed Service for Kubernetes. For resource configuration details, see this Kubernetes guide.

ServiceService

apiVersion: v1
kind: Service
metadata: <ObjectMeta>
spec: <ServiceSpec>

apiVersion: v1
kind: Service
metadata:
  name: alb-demo-1
spec:
  selector:
    app: alb-demo-1
  type: NodePort
  ports:
    - name: http
      port: 80
      protocol: TCP
      nodePort: 30081

ObjectMetaObjectMeta

name: <string>
annotations:
  ingress.alb.yc.io/protocol: <string>
  ingress.alb.yc.io/transport-security: <string>
  ingress.alb.yc.io/health-checks: <string>

Metadata.annotationsMetadata.annotations

Annotations are collections of key:value pairs for assigning metadata to objects. Annotation values always have the string data type. For more on annotations, see this Kubernetes guide.

In Application Load Balancer, annotations are only used in Service resources to set up ingress controllers.

You can add the following annotations to ObjectMeta:

• ingress.alb.yc.io/protocol

  Protocol for connections between the load balancer and backends defined in Ingress:

  • http: HTTP/1.1. This is a default value.
  • http2: HTTP/2.
  • grpc: gRPC.

• ingress.alb.yc.io/transport-security

  Encryption protocol for connections between the load balancer and backends specified in Ingress directly, without using HttpBackendGroup.

  The acceptable value is tls: TLS without certificate validation.

  If this annotation is not specified, the load balancer will connect to the backends without encryption.

  This annotation is ignored for grouped backends. To configure the encryption of connections between the load balancer and group backends, use the spec.backend.tls field of the HttpBackendGroup resource.

• ingress.alb.yc.io/health-checks

  Parameters for configuring custom application health checks in a cluster. We recommend configuring health checks for all backends.

  • http-path: Path to the application endpoint in the request URI for health checks (only for http or http2 connections to backends). The default value is /healthz.

  • grpc-service-name: Application gRPC service name for health checks (only for grpc connections to backends). If not specified, the entire backend will be health-checked.

  • port: Port on the cluster nodes used to check the application's availability. The application will be available for health checks at http://<node_IP_address>:<port>/<path>.

  • healthy-threshold: Number of consecutive successful checks to consider the application endpoint healthy. The default value is 1.

  • unhealthy-threshold: Number of consecutive failed checks to consider the application endpoint unhealthy. The default value is 1.

  • timeout: Response timeout in seconds. The values range from 1s to 60s. The default value is 2s.

  • interval: Interval between health check requests in seconds. The values range from 1s to 60s. The default value is 5s. interval must exceed timeout by at least one second.

  port is a required parameter. If you omit the other parameters, they will be set to their default values.

  The parameters are given as a comma-separated list. Here is an example:

  ...
  annotations:
    ingress.alb.yc.io/health-checks: port=30103,http-path=/health-1,timeout=10s,interval=20s,healthy-threshold=3,unhealthy-threshold=2
  ...
  

ServiceSpecServiceSpec

type: NodePort
ports:
  - <ServicePort>
  -

ServicePortServicePort

port: <int32>
name: <string>
protocol: <protocol>
nodePort: <int32>