Configuring logging for an Yandex Application Load Balancer L7 load balancer using an Ingress controller

You can configure the logging settings for L7 balancers created with Application Load Balancer Ingress controllers within a Managed Service for Kubernetes cluster.

This article explains how to create three L7 balancers with different logging settings:

• Save logs to the default group.
• Save logs to a custom group.
• No logging.

To configure L7 balancers:

1. Create a test application.
2. Create Ingress resources.
3. Specify the settings for the Ingress resource groups.
4. Check the result.

If you no longer need the resources you created, delete them.

Required paid resourcesRequired paid resources

The support cost includes:

• Fee for a DNS zone and DNS requests (see Cloud DNS pricing).
• Fee for the Managed Service for Kubernetes cluster: using the master and outgoing traffic (see Managed Service for Kubernetes pricing).
• Cluster nodes (VM) fee: using computing resources, operating system, and storage (see Compute Cloud pricing).
• Fee for using the computing resources of each L7 load balancer (see Application Load Balancer pricing).
• Fee for public IP addresses for cluster nodes and L7 load balancer (see Virtual Private Cloud pricing).
• Fee for Cloud Logging: Writing and storing data (see Cloud Logging pricing).

Getting startedGetting started

Set up your infrastructureSet up your infrastructure

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder specified when creating the CLI profile is used by default. To change the default folder, use the yc config set folder-id <folder_ID> command. You can specify a different folder using the --folder-name or --folder-id parameter.

Get ready to use the Managed Service for Kubernetes clusterGet ready to use the Managed Service for Kubernetes cluster

1. Install kubect and configure it to work with the new cluster.

   If a cluster has no public IP address assigned and kubectl is configured via the cluster's private IP address, run kubectl commands on a Yandex Cloud VM that is in the same network as the cluster.

2. Install the Kubernetes Helm package manager.

Register a domain zoneRegister a domain zone

Register a public domain zone and delegate your domain.

Install the Application Load Balancer Ingress controllerInstall the Application Load Balancer Ingress controller

Install the ALB Ingress Controller application by following this guide. During the installation, use the key.json key data from Prepare the infrastructure.

Create a test applicationCreate a test application

Create ConfigMap, Deployment with NGINX, and Service objects for the application.

1. Create the app.yaml app file:

   app.yaml

   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: alb-demo-1
   data:
     nginx.conf: |
       worker_processes auto;
       events {
       }
       http {
         server {
           listen 80 ;
           location = /_healthz {
             add_header Content-Type text/plain;
             return 200 'ok';
           }
           location / {
             add_header Content-Type text/plain;
             return 200 'Index';
           }
           location = /app1 {
             add_header Content-Type text/plain;
             return 200 'This is APP#1';
           }
         }
       }
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: alb-demo-1
     labels:
       app: alb-demo-1
       version: v1
   spec:
     replicas: 2
     selector:
       matchLabels:
         app: alb-demo-1
     strategy:
       type: RollingUpdate
       rollingUpdate:
         maxSurge: 1
         maxUnavailable: 0
     template:
       metadata:
         labels:
           app: alb-demo-1
           version: v1
       spec:
         terminationGracePeriodSeconds: 5
         volumes:
           - name: alb-demo-1
             configMap:
               name: alb-demo-1
         containers:
           - name: alb-demo-1
             image: nginx:latest
             ports:
               - name: http
                 containerPort: 80
             livenessProbe:
               httpGet:
                 path: /_healthz
                 port: 80
               initialDelaySeconds: 3
               timeoutSeconds: 2
               failureThreshold: 2
             volumeMounts:
               - name: alb-demo-1
                 mountPath: /etc/nginx
                 readOnly: true
             resources:
               limits:
                 cpu: 250m
                 memory: 128Mi
               requests:
                 cpu: 100m
                 memory: 64Mi
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: alb-demo-1
   spec:
     selector:
       app: alb-demo-1
     type: NodePort
     ports:
       - name: http
         port: 80
         targetPort: 80
         protocol: TCP
         nodePort: 30081
   

2. Create an app:

   kubectl apply -f app.yaml
   

   Result:

   configmap/alb-demo-1 created
   deployment.apps/alb-demo-1 created
   service/alb-demo-1 created
   

Create Ingress resourcesCreate Ingress resources

Create three Ingress resources from which the Application Load Balancer Ingress controller will create three balancers with the required listeners and HTTP routers.

1. Create a file named ingress.yaml with the load balancer settings and domain name:

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: logs-demo-nondefault
     annotations:
       ingress.alb.yc.io/group-name: non-default
       ingress.alb.yc.io/subnets: <list_of_subnet_IDs>
       ingress.alb.yc.io/security-groups: <list_of_security_group_IDs>
       ingress.alb.yc.io/group-settings-name: non-default-settings
       ingress.alb.yc.io/external-ipv4-address: auto
   spec:
     rules:
       - host: <domain_name>
         http:
           paths:
             - pathType: Prefix
               path: "/"
               backend:
                 service:
                   name: alb-demo-1
                   port: 
                     name: http
   ---
   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: logs-demo-disabled
     annotations:
       ingress.alb.yc.io/group-name: logs-disabled
       ingress.alb.yc.io/subnets: <list_of_subnet_IDs>
       ingress.alb.yc.io/security-groups: <list_of_security_group_IDs>
       ingress.alb.yc.io/group-settings-name: logs-disabled-settings
       ingress.alb.yc.io/external-ipv4-address: auto
   spec:
     rules:
       - host: <domain_name>
         http:
           paths:
             - pathType: Prefix
               path: "/"
               backend:
                 service:
                   name: alb-demo-1
                   port:
                     name: http
   ---
   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: logs-demo-default
     annotations:
       ingress.alb.yc.io/group-name: default
       ingress.alb.yc.io/subnets: <list_of_subnet_IDs>
       ingress.alb.yc.io/security-groups: <list_of_security_group_IDs>
       ingress.alb.yc.io/external-ipv4-address: auto
   spec:
     rules:
       - host: <domain_name>
         http:
           paths:
             - pathType: Prefix
               path: "/"
               backend:
                 service:
                   name: alb-demo-1
                   port:
                     name: http
   

   Where:

   • ingress.alb.yc.io/group-name: Group name. Ingress resources are grouped together, each group served by a separate Application Load Balancer L7 load balancer.

   • ingress.alb.yc.io/subnets: One or more subnets to host the load balancer.

   • ingress.alb.yc.io/security-groups: One or more security groups for the load balancer. If you skip this parameter, the default security group will be used.

   • ingress.alb.yc.io/external-ipv4-address: Public access to the load balancer from the internet. Enter the IP address you got earlier or set auto to get a new IP address automatically.

     If you set auto, deleting the load balancer from the cloud will also delete the IP address. To avoid this, use an existing reserved IP address.

   • ingress.alb.yc.io/group-settings-name: Name for the Ingress resource group settings to be described in the optional IngressGroupSettings resource.

   Optionally, enter advanced controller settings.

   Note

   The settings listed below will only apply to the virtual hosts of the Ingress resource in which the corresponding annotations are configured.

   They will not apply to the virtual hosts of the group's other Ingress resources.

   • ingress.alb.yc.io/internal-ipv4-address: Provide internal access to the load balancer. Enter the internal IP address or use auto to obtain the IP address automatically.

     Note

     You can only use one type of access to the load balancer at a time: ingress.alb.yc.io/external-ipv4-address or ingress.alb.yc.io/internal-ipv4-address.

   • ingress.alb.yc.io/internal-alb-subnet: Subnet to host the load balancer. This parameter is required if the ingress.alb.yc.io/internal-ipv4-address parameter is selected.

   • ingress.alb.yc.io/protocol: Connection protocol used between the load balancer and backends:

     • http: HTTP/1.1, default
     • http2: HTTP/2
     • grpc: gRPC

   • ingress.alb.yc.io/transport-security: Encryption protocol for connections between the load balancer and backends.

     Warning

     In ALB Ingress Controller version 0.2.0 and later, you can only use an annotation in the Service object.

     If you annotate Ingress resources that use a single service with the same settings for backend groups, such annotation will apply correctly. However, this mechanism is obsolete and will not be supported going forward.

     The valid value is tls: TLS with no certificate challenge.

     If no annotation is specified, the load balancer connects to the backends with no encryption.

   • ingress.alb.yc.io/prefix-rewrite: Replace the path for the specified value.

   • ingress.alb.yc.io/upgrade-types: Valid values of the Upgrade HTTP header, e.g., websocket.

   • ingress.alb.yc.io/request-timeout: Maximum period for which a connection can be established.

   • ingress.alb.yc.io/idle-timeout: Maximum connection keep-alive time without data transmission.

     The request-timeout and idle-timeout values must be specified with units of measurement, e.g., 300ms or 1.5h. Valid units of measurement:

     • ns: Nanoseconds
     • us: Microseconds
     • ms: Milliseconds
     • s: Seconds
     • m: Minutes
     • h: Hours

   For more information about the Ingress resource settings, see Ingress resource fields and annotations.

2. Create Ingress resources:

   kubectl apply -f ingress.yaml
   

   Result:

   ingress.networking.k8s.io/logs-demo-nondefault created
   ingress.networking.k8s.io/logs-demo-disabled created
   ingress.networking.k8s.io/logs-demo-default created
   

   Three L7 load balancers will be automatically deployed based on the Ingress resource configurations.

Specify the settings for the Ingress resource groupsSpecify the settings for the Ingress resource groups

Create a resource named IngressGroupSettings with logging settings for the Ingress resource groups:

• non-default-settings: Logging to the previously created custom log group with defined rules.
• logs-disabled-settings: No logging.

No settings need to be specified to save logs to the default log group.

1. Create a file named settings.yaml with the log group ID:

   apiVersion: alb.yc.io/v1alpha1
   kind: IngressGroupSettings
   metadata:
     name: non-default-settings
   logOptions:
     logGroupID: <user_log_group_ID>
     discardRules:
       - discardPercent: 50
         grpcCodes:
           - OK
           - CANCELLED
           - UNKNOWN
       - discardPercent: 67
         httpCodeIntervals:
           - HTTP_1XX
       - discardPercent: 20
         httpCodes:
           - 200
           - 404
   ---
   apiVersion: alb.yc.io/v1alpha1
   kind: IngressGroupSettings
   metadata:
     name: logs-disabled-settings
   logOptions:
     disable: true
   

2. Create the resources:

   kubectl apply -f settings.yaml
   

   Result:

   ingressgroupsettings.alb.yc.io/non-default-settings created
   ingressgroupsettings.alb.yc.io/logs-disabled-settings created
   

The settings from those resources will apply to the Ingress resource groups in line with the ingress.alb.yc.io/group-settings-name annotations specified for the Ingress resources.

Check the resultCheck the result

Get log group IDs for the new L7 load balancers and make sure they match the settings in the settings.yaml file:

• One of the balancers should use your custom log group with defined rules.
• Another should use the default log group.
• For the third balancer, logging should be disabled.

Delete the resources you createdDelete the resources you created

Some resources are not free of charge. To avoid paying for them, delete the resources you no longer need: