aws-load-balancer-controller icon indicating copy to clipboard operation
aws-load-balancer-controller copied to clipboard

Published 20 hours ago • verified publisher icon kubernetes-sigs

Replace ALB annotations with IngressClassParams

Open stevehipwell opened this issue 4 years ago • 30 comments

Is your feature request related to a problem? I'd like to be able to replace more of the alb.ingress.kubernetes.io annotations with the IngressClassParams to abstract away the ALB specification from the Ingress resources using it. I mistakenly thought that #2190 was doing this, but after re-reading I think that's just replacing the alb.ingress.kubernetes.io/load-balancer-attributes annotation.

Describe the solution you'd like I'd like to be able to specify the following annotations in the IngressClassParams directly.

  • alb.ingress.kubernetes.io/target-type
  • alb.ingress.kubernetes.io/subnets
  • alb.ingress.kubernetes.io/listen-ports
  • alb.ingress.kubernetes.io/ssl-redirect
  • alb.ingress.kubernetes.io/inbound-cidrs
  • alb.ingress.kubernetes.io/certificate-arn

Describe alternatives you've considered n/a

stevehipwell avatar Oct 21 '21 09:10 stevehipwell

/kind feature

M00nF1sh avatar Oct 21 '21 23:10 M00nF1sh

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue or PR as fresh with /remove-lifecycle stale
  • Mark this issue or PR as rotten with /lifecycle rotten
  • Close this issue or PR with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot avatar Jan 20 '22 00:01 k8s-triage-robot

/remove-lifecycle stale

msvticket avatar Jan 20 '22 00:01 msvticket

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue or PR as fresh with /remove-lifecycle stale
  • Mark this issue or PR as rotten with /lifecycle rotten
  • Close this issue or PR with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot avatar Apr 20 '22 01:04 k8s-triage-robot

/remove-lifecycle stale

stevehipwell avatar Apr 20 '22 13:04 stevehipwell

It would be nice to have spec.params.targetGroupAttributes

nikskiz avatar May 25 '22 03:05 nikskiz

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue or PR as fresh with /remove-lifecycle stale
  • Mark this issue or PR as rotten with /lifecycle rotten
  • Close this issue or PR with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot avatar Aug 23 '22 04:08 k8s-triage-robot

/remove-lifecycle stale

stevehipwell avatar Aug 23 '22 05:08 stevehipwell

Really, I think any of the 14 annotations that are "Exclusive" (must only be set once per Group) should be configurable via IngressClass (possibly via IngressClassParams). Then we can move that configuration out of the individual services so we do not have to worry about them fighting over control of them.

As of version 2.4, the following annotations are marked "Exclusive", but only a few of them can be specified in IngressClass and most (all?) of the rest cannot be specified anywhere but via annotations. This is a poor separation of concerns.

  1. alb.ingress.kubernetes.io/load-balancer-name
  2. alb.ingress.kubernetes.io/ip-address-type
  3. alb.ingress.kubernetes.io/scheme
  4. alb.ingress.kubernetes.io/subnets
  5. alb.ingress.kubernetes.io/security-groups
  6. alb.ingress.kubernetes.io/manage-backend-security-group-rules
  7. alb.ingress.kubernetes.io/customer-owned-ipv4-pool
  8. alb.ingress.kubernetes.io/load-balancer-attributes
  9. alb.ingress.kubernetes.io/wafv2-acl-arn
  10. alb.ingress.kubernetes.io/waf-acl-id
  11. alb.ingress.kubernetes.io/shield-advanced-protection
  12. alb.ingress.kubernetes.io/ssl-redirect
  13. alb.ingress.kubernetes.io/inbound-cidrs
  14. alb.ingress.kubernetes.io/ssl-policy

Related to, but different than #2600

Nuru avatar Oct 13 '22 10:10 Nuru

I would be particularly interested in alb.ingress.kubernetes.io/auth-* annotations being defined with class params.

That would make it easy to set up an ingress class with sensible authentication defaults for external ingresses.

kwohlfahrt avatar Dec 22 '22 14:12 kwohlfahrt

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue as fresh with /remove-lifecycle stale
  • Close this issue with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot avatar Mar 22 '23 14:03 k8s-triage-robot

/remove-lifecycle stale

sjmisterm avatar Mar 22 '23 14:03 sjmisterm

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue as fresh with /remove-lifecycle stale
  • Close this issue with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot avatar Jun 20 '23 14:06 k8s-triage-robot

/remove-lifecycle stale

sjmisterm avatar Jun 20 '23 15:06 sjmisterm

#2920 is chipping away the ones that have Exclusive MergeBehavior. For the ones that have Merge, listen-ports has per-Ingress semantics that complicate things. certificate-arn has good reasons for specifying per-Ingress.

johngmyers avatar Oct 11 '23 00:10 johngmyers

certificate-arn has good reasons for specifying per-Ingress.

Agreed, but having a default cert in IngressClassParams would still make sense.

visit1985 avatar Oct 11 '23 06:10 visit1985

is there an update on this issue?

omri-shilton avatar Jan 17 '24 14:01 omri-shilton

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue as fresh with /remove-lifecycle stale
  • Close this issue with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot avatar Apr 16 '24 14:04 k8s-triage-robot

/remove-lifecycle stale

sjmisterm avatar Apr 16 '24 14:04 sjmisterm

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue as fresh with /remove-lifecycle stale
  • Close this issue with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot avatar Jul 15 '24 15:07 k8s-triage-robot

/remove-lifecycle stale

sjmisterm avatar Jul 15 '24 15:07 sjmisterm