Deploy NGINX Ingress Controller¶
In this section you will configure and deploy the NGINX Ingress Controller and expose it using a Classic Load Balancer.
We recommend that you use a new NGINX Ingress Controller dedicated for serving. In this case, proceed to follow this guide.
Otherwise, if you have exposed EKF with ELB and you wish to use the NGINX Ingress Controller you have already created, proceed to the What’s Next section.
What You’ll Need¶
- A configured management environment.
- Your clone of the Arrikto GitOps repository.
- An existing EKS cluster.
- A set of configured ELB subnets.
Go to your GitOps repository, inside your
rok-toolsmanagement environment:root@rok-tools:~# cd ~/ops/deployments
service-elbas base instead of
arrikto:bases: #- ../arrikto #- ../ingress-alb - ../service-elb #- ../service-azurelb
rok/nginx-ingress-controller-serving/overlays/deploy/kustomization.yamland enable only the
service-elbpatch:patches: #- path: patches/ingress-alb.yaml #- path: patches/service-alb.yaml - path: patches/service-elb.yaml #- path: patches/service-azurelb.yaml
rok/nginx-ingress-controller-serving/overlays/deploy/patches/service-elb.yamland set the
aws-load-balancer-internalannotation. Choose one of the following options, based on the ELB scheme:annotations: service.beta.kubernetes.io/aws-load-balancer-internal: "false" # <-- Update this line.annotations: service.beta.kubernetes.io/aws-load-balancer-internal: "true" # <-- Update this line.
Enable the firewall in your Classic Load Balancer and allow access only to specific CIDRs. Choose one of the following options, based on your ELB scheme:
loadBalancerSourceRangesto the desired trusted CIDRs. Leave the default value of
0.0.0.0/0if you want to allow access for everyone:spec: loadBalancerSourceRanges: - "0.0.0.0/0" # <-- Update this line.
Skip specifying any CIDRs since the ELB will be a private one and as such not reachable outside your VPC.
Commit your changes:root@rok-tools:~/ops/deployments# git commit -am "Expose NGINX Ingress Controller with a Classic Load Balancer"
Deploy NGINX Ingress Controller:root@rok-tools:~/ops/deployments# rok-deploy --apply rok/nginx-ingress-controller-serving/overlays/deploy
Verify that NGINX Ingress Controller is up-and-running. Check pod status and verify field STATUS is Running and field READY is 1/1:root@rok-tools:~/ops/deployments# kubectl -n ingress-nginx-serving get pods NAME READY STATUS RESTARTS AGE nginx-ingress-controller-7f74f657bd-ln59l 1/1 Running 0 1m
Verify that the Load Balancer Service has an external IP:root@rok-tools:~/ops/deployments# kubectl -n ingress-nginx-serving get service NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE ingress-nginx LoadBalancer 10.32.1.249 a4d794bfa6d7e440facc4398bf96edde-992601283.us-east-1.elb.amazonaws.com 80:30099/TCP,443:30719/TCP 1m
The Service object does not get an EXTERNAL-IP.
Describe the service:root@rok-tools:~/ops/deployments# kubectl describe service -n ingress-nginx-serving ingress-nginx
If you see an event like the following:Events: Type Reason Age From Message ---- ------ ---- ---- ------- Warning UnAvailableLoadBalancer 1m service-controller There are no available nodes for LoadBalancer
it means that your subnets are misconfigured.
Verify your subnets configuration.
You have successfully deployed the NGINX Ingress Controller, and exposed it using a Classic Load Balancer.
The next step is to expose Istio, our service mesh.