Configuring a Yandex Application Load Balancer using an ingress controller

1. Create a backend group with a bucket:

   1. Create a public bucket in Object Storage.
   2. Configure the website home page and error page.

2. Create a configuration file named demo-app-1.yaml for your application:

   demo-app-1.yaml

   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: alb-demo-1
   data:
     nginx.conf: |
       worker_processes auto;
       events {
       }
       http {
         server {
           listen 80 ;
           location = /_healthz {
             add_header Content-Type text/plain;
             return 200 'ok';
           }
           location / {
             add_header Content-Type text/plain;
             return 200 'Index';
           }
           location = /app1 {
             add_header Content-Type text/plain;
             return 200 'This is APP#1';
           }
         }
       }
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: alb-demo-1
     labels:
       app: alb-demo-1
       version: v1
   spec:
     replicas: 2
     selector:
       matchLabels:
         app: alb-demo-1
     strategy:
       type: RollingUpdate
       rollingUpdate:
         maxSurge: 1
         maxUnavailable: 0
     template:
       metadata:
         labels:
           app: alb-demo-1
           version: v1
       spec:
         terminationGracePeriodSeconds: 5
         volumes:
           - name: alb-demo-1
             configMap:
               name: alb-demo-1
         containers:
           - name: alb-demo-1
             image: nginx:latest
             ports:
               - name: http
                 containerPort: 80
             livenessProbe:
               httpGet:
                 path: /_healthz
                 port: 80
               initialDelaySeconds: 3
               timeoutSeconds: 2
               failureThreshold: 2
             volumeMounts:
               - name: alb-demo-1
                 mountPath: /etc/nginx
                 readOnly: true
             resources:
               limits:
                 cpu: 250m
                 memory: 128Mi
               requests:
                 cpu: 100m
                 memory: 64Mi
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: alb-demo-1
   spec:
     selector:
       app: alb-demo-1
     type: NodePort
     ports:
       - name: http
         port: 80
         targetPort: 80
         protocol: TCP
         nodePort: 30081
   

3. In a separate directory, create a file named http-group.yaml with the HttpBackendGroup resource settings:

   apiVersion: alb.yc.io/v1alpha1
   kind: HttpBackendGroup
   metadata:
     name: example-backend-group
   spec:
     backends: # List of backends.
       - name: alb-demo-1
         weight: 70 # Backend relative weight in traffic distribution. Traffic will be distributed in proportion to the weights of other backends in the group. Specify the weight even if the group contains only one backend.
         service:
            name: alb-demo-1
            port:
              number: 80
       - name: bucket-backend
         weight: 30
         storageBucket:
           name: <bucket_name>
   

   Optionally, specify the additional settings for the backend group:

   • spec.backends.useHttp2: HTTP/2 mode.
   • spec.backends.tls: CA certificate trusted by the load balancer when establishing a secure connection to backend endpoints. Specify the certificate contents in the trustedCa field in plain text.

   Learn more in Backend groups.

4. In the same directory, create a file named ingress-http.yaml and specify in it the delegated domain name, ID of the certificate, and settings for the Application Load Balancer L7 load balancer:

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: alb-demo-tls
     annotations:
       ingress.alb.yc.io/subnets: <list_of_subnet_IDs>
       ingress.alb.yc.io/security-groups: <list_of_security_group_IDs>
       ingress.alb.yc.io/external-ipv4-address: <IP_address_assignment_method>
       ingress.alb.yc.io/group-name: my-ingress-group
   spec:
     tls:
       - hosts:
         - <domain_name>
         secretName: yc-certmgr-cert-id-<TLS_certificate_ID>
     rules:
       - host: <domain_name>
         http:
           paths:
             - path: /app1
               pathType: Exact
               backend:
                 resource:
                   apiGroup: alb.yc.io
                   kind: HttpBackendGroup
                   name: example-backend-group
   

   Where:

   • ingress.alb.yc.io/subnets: One or more subnets to host the Application Load Balancer.

   • ingress.alb.yc.io/security-groups: One or more security groups for the load balancer. If you skip this parameter, the default security group will be used. At least one of the security groups must allow an outgoing TCP connection to port 10501 in the Managed Service for Kubernetes node group subnet or to its security group.

   • ingress.alb.yc.io/external-ipv4-address: Public access to the load balancer from the internet. Enter the IP address you got earlier or set auto to get a new IP address automatically.

     If you set auto, deleting the load balancer from the cloud removes its IP address. To avoid this, use a reserved IP address.

   • ingress.alb.yc.io/group-name: Group name. Ingress resources are grouped so that a separate load balancer serves each group.

     You can use any group name instead of my-ingress-group. Make sure it meets the naming requirements.

   Optionally, specify the additional settings for the load balancer.

   Note

   The settings listed below will only apply to the virtual hosts of the Ingress resource in which the corresponding annotations are configured.

   They will not apply to the virtual hosts of the group's other Ingress resources.

   Available settings:

   • ingress.alb.yc.io/group-settings-name: Name for the Ingress resource group settings to describe in the IngressGroupSettings optional resource. For more information, see Configure the Ingress resource group.

   • ingress.alb.yc.io/internal-ipv4-address: Provide internal access to the load balancer. Enter the internal IP address or use auto to get the IP address automatically.

     Note

     You can only use one type of access to the load balancer at a time: ingress.alb.yc.io/external-ipv4-address or ingress.alb.yc.io/internal-ipv4-address.

   • ingress.alb.yc.io/internal-alb-subnet: Subnet to host the load balancer. This parameter is required if you select ingress.alb.yc.io/internal-ipv4-address.

   • ingress.alb.yc.io/protocol: Protocol for connections between the load balancer and backends:

     • http: HTTP/1.1. This is a default value.
     • http2: HTTP/2.
     • grpc: gRPC.

   • ingress.alb.yc.io/prefix-rewrite: Replace the path with the specified value.

   • ingress.alb.yc.io/upgrade-types: Valid values of the Upgrade HTTP header, e.g., websocket.

   • ingress.alb.yc.io/request-timeout: Maximum connection request timeout.

   • ingress.alb.yc.io/idle-timeout: Maximum connection idle timeout.

     Make sure to provide the request-timeout and idle-timeout values with units of measurement, e.g., 300ms or 1.5h. Acceptable units of measurement include:

     • ns, nanoseconds
     • us, microseconds
     • ms, milliseconds
     • s, seconds
     • m, minutes
     • h, hours

   • ingress.alb.yc.io/security-profile-id: Support for Yandex Smart Web Security that ensures protection against DDoS attacks and bots, enables WAF and limits the load on the protected resource.

     To enable support for Yandex Smart Web Security, specify the previously created Smart Web Security profile in the Ingress annotation:

     ingress.alb.yc.io/security-profile-id: <security_profile_ID>
     

     Note

     To connect your security profile to an Application Load Balancer virtual host, the service account used to operate the Ingress controller must have the smart-web-security.editor role for the folder hosting Application Load Balancer and Smart Web Security resources. For more information, see Assigning a role to a service account.

   • ingress.alb.yc.io/use-regex: Support for RE2 regular expressions when matching the request path. If set to true, the support is enabled. This setting only applies when pathType is set to Exact.

   For more information about the Ingress resource settings, see Ingress resource fields and annotations.

5. Create a Kubernetes app, HttpBackendGroup resource, and Ingress resource:

   kubectl apply -f .
   

The ALB ingress controller will automatically deploy an L7 load balancer using the Ingress resource configuration.

1. Wait until the L7 load balancer is created and assigned a public IP address. This may take several minutes.

   To follow the process and make sure it is error-free, open the logs of the pod it is run in:

   1. In the management console, go to the folder dashboard and select Managed Service for Kubernetes.

   2. Click the cluster name and select Workload in the left-hand panel.

   3. Select one of the alb-demo-*** pods the load balancer's creation was run in.

   4. Go to the Logs tab on the pod page.

      The load balancer's creation logs are generated and displayed in real time. Any errors that occur will also be logged.

2. Make sure the load balancer was created. To do this, run the following command and verify that the ADDRESS field in the output contains a value:

   kubectl get ingress alb-demo-tls
   

   Result:

   NAME          CLASS   HOSTS           ADDRESS     PORTS    AGE
   alb-demo-tls  <none>  <domain_name>  <IP_address>  80,443  15h