Hello All,

In my previous blogs, we have discussed on creating k8s cluster and launched the demo application and exposed them with elb (classic). let’s discuss more the exposing the services.

If you have missed out my previous blogs have a look at here Part 1 : https://medium.com/@jothimanikrish/my-first-path-to-kubernetes-setup-in-production-fe54358d1de3 Part 2 :https://medium.com/@jothimanikrish/my-first-path-to-kubernetes-setup-in-production-part-2-of-2-1cd3c718b824

What are the different possibilities of exposing the services?

• Cluster IP: Exposes the Service on an internal IP in the cluster. This type makes the Service only reachable from within the cluster.

• NodePort: Exposes the Service on the same port of each selected Node in the cluster using NAT. Makes a Service accessible from outside the cluster using <NodeIP>:<NodePort>

• LoadBalancer: Creates an external load balancer in the current cloud (AWS in our case)

• ExternalName: Exposes the Service using an arbitrary name (specified by externalName in the spec) by returning a CNAME record with the name

For more notes refer k8s documents:

Let us discuss how to expose a service to access via AWS ingress controller (Application Load Balancer)

Before that, in our previous tutorial we have exposed the service using elastic load balancer, There are some tough breaks points in that; yes

• though we have load balancer in place proxying the node port for us; We are unable to do path based routing. More importantly http to https redirection is not possible. I have tried out a lot google here and planned to move for ALB. But how? ALB highlights,
• path based routing to the app,
• http to https redirection in the Load balancer level. :) and more..

Lets launch the application with a Application load balancer

• Create a delpoyment for the application

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  app: jenkins
spec:
  replicas: 2
  template:
    metadata:
      labels:
        app: jenkins
    spec:
      containers:
      - name: demo-jenkins
        image: jenkins:2.3-alpine
        ports:
          - containerPort: 8080

• Create a service for the application

kind: Service
apiVersion: v1
metadata:
  name: jenkins-deployment
spec:
  selector:
    app: jenkins
  ports:
  - protocol: TCP
    port: 80
    targetPort: 8080
  type: NodePort

Form the above service script, stead of Loadbalancer we have to expose it via NodePort, so that we can the ALB to listen from nodeport.

its time to configure and install AWS Ingress controller:

you can also follow the aws docs: https://aws.amazon.com/blogs/opensource/kubernetes-ingress-aws-alb-ingress-controller/

step 1:

Deploy RBAC Roles and RoleBindings needed by the AWS ALB Ingress controller:

kubectl apply -f [https://raw.githubusercontent.com/kubernetes-sigs/aws-alb-ingress-controller/v1.0.0/docs/examples/rbac-role.yaml](https://raw.githubusercontent.com/kubernetes-sigs/aws-alb-ingress-controller/v1.0.0/docs/examples/rbac-role.yaml```)

step 2:

Download the AWS ALB Ingress controller YAML into a local file:

Note: before applying this file update the CLUSTER NAME

curl -sS "https://raw.githubusercontent.com/kubernetes-sigs/aws-alb-ingress-controller/v1.0.0/docs/examples/alb-ingress-controller.yaml" > alb-ingress-controller.yaml

step 3: Apply the configuration

kubectl apply -f alb-ingress-controller.yaml

to confirm the installation; check with the below command:

kubectl logs -n kube-system $(kubectl get po -n kube-system | egrep -o alb-ingress[a-zA-Z0-9-]+)

the output should look similar to this

--------------------------------------------------------------------
AWS ALB Ingress controller
  Release: v1.0.0
  Build: git-6ee1276
  Repository: https://github.com/kubernetes-sigs/aws-alb-ingress-controller
--------------------------------------------------------------------

Now getting back to our application setup:

we are going to listen the app in 443 via alb; and redirect all the requests from 80 to 443 using ALB.

Note: make sure to have aws ssl certificates from ACM

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: jenkins
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/target-type: instance
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/subnets: 'SUBNETS, 'SUBNETS'
    alb.ingress.kubernetes.io/security-group: 'SECURITYGROUP'
    alb.ingress.kubernetes.io/healthcheck-path: "/"
    alb.ingress.kubernetes.io/success-codes: "200,404,400"
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
    alb.ingress.kubernetes.io/certificate-arn:** REPLACE-YOUR-ARN**
    alb.ingress.kubernetes.io/ssl-policy: ELBSecurityPolicy-TLS-1-1-2017-01
    alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": $
  labels:
    name: jenkins
spec:
  rules:
    - http:
        paths:
         - path: /*
           backend:
             serviceName: ssl-redirect
             servicePort: use-annotation
         - path: /*
           backend:
             serviceName: jenkins
             servicePort: 80

Make sure to replace, ssl certificate ARN received from ACM, subnets and security groups.

save the above file as jenkins-alb.yaml

kubectl apply -f jenkins-alb.yaml

once the deployment was success; describe the service to get ALB CName:

kubectl get ingress

copy and paste the alb arn in the browser to access the app…

Note: also create cname record for cname with route53 for the domain you have purchased the SSL from ACM

Bingo!