EKS

[EKS] 3. aws-load-balancer-controller 배포 - 미완

su''@ 2025. 2. 23. 23:25

​

참고 : https://docs.aws.amazon.com/ko_kr/eks/latest/userguide/aws-load-balancer-controller.html

 

AWS 로드 밸런서 컨트롤러를 통해 인터넷 트래픽 라우팅 - Amazon EKS

버전 2.5 이상에서는  AWS Load Balancer Controller이(가) type: LoadBalancer와(과) 함께 Kubernetes 서비스 리소스의 기본 컨트롤러가 되며 각 서비스에 대한 AWS Network Load Balancer(NLB)를 만듭니다. 이는 서비

docs.aws.amazon.com

  • AWS Ingress Controller
  • Kubernetes 클러스터에서 AWS Elastic LoadBalancer (ALB 및 NLB)를 자동으로 관리하고, 이를 통해 Cluster 내 application을 외부로 노출시킨다.

ALB (Application Load Balancer)

  • Application Load Balancer Controller는 Kubernetes의 Ingress 리소스를 감시해, 필요한 경우 ALB를 자동으로 생성하고 관리한다.
  • HTTP/HTTPS 트래픽을 여러 파드에 걸쳐 로드밸런싱 한다.

NLB (Network Load Balancer)

  • service 리소스의 LoadBalancer 타입을 감시해 필요시 NLB를 생성하여 TCP/UDP 트래픽을 관리한다.
  • 낮은 지연시간과 고성능이 요구되는 앱에 적합하다.

3-1. Helm 설치 및 IAM, serviceaccount 생성

https://docs.aws.amazon.com/ko_kr/eks/latest/userguide/lbc-helm.html

https://helm.sh/docs/intro/install/

  • helm 설치하기
$ curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3
$ chmod 700 get_helm.sh
$ ./get_helm.sh

$ helm --help

 

 

  • IAM 역할 생성
curl -O <https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.7.2/docs/install/iam_policy.json>

 

  • IAM 정책 생성
$ aws iam create-policy \\
    --policy-name AWSLoadBalancerControllerIAMPolicy \\
    --policy-document file://iam_policy.json
{
    "Policy": {
        "PolicyName": "AWSLoadBalancerControllerIAMPolicy",
        "PolicyId": "ANPAXNGUVKCWD4JVWVK3F",
        "Arn": "arn:aws:iam::509399617708:policy/AWSLoadBalancerControllerIAMPolicy",
        "Path": "/",
        "DefaultVersionId": "v1",
        "AttachmentCount": 0,
        "PermissionsBoundaryUsageCount": 0,
        "IsAttachable": true,
        "CreateDate": "2025-01-21T19:18:59+00:00",
        "UpdateDate": "2025-01-21T19:18:59+00:00"
    }
}

 

  • EKS 클러스터 정보 수집 후 변수에 저장
    • cluster_name = 클러스터명
    • oidc_id = OIDC 자격증명 Id
    $ export cluster_name=test-eks
$ oidc_id=$(aws eks describe-cluster --name $cluster_name --query "cluster.identity.oidc.issuer" --output text | cut -d '/' -f 5)
$ echo $oidc_id
  • eksctl 사용해 IAM 역할 생성
    • *my-cluster*를 사용자 클러스터 이름으로 바꾸고 *111122223333*을 계정 ID로 바꾼 다음 명령을 실행
$ eksctl create iamserviceaccount \\
  --cluster=*my-cluster* \\
  --namespace=kube-system \\
  --name=aws-load-balancer-controller \\
  --role-name AmazonEKSLoadBalancerControllerRole \\
  --attach-policy-arn=arn:aws:iam::*111122223333*:policy/AWSLoadBalancerControllerIAMPolicy \\
  --approve

 

  • serviceaccount 생성 확인
$ kubectl get -n kube-system sa | grep -i load
aws-load-balancer-controller                  0         70s

$ kubectl describe -n kube-system sa aws-load-balancer-controller

 

3-2. AWS LoadBalancer Controller 설치하기

https://github.com/kubernetes-sigs/aws-load-balancer-controller/tree/main/helm/aws-load-balancer-controller

  • eks helm repo 등록
$ helm repo add eks <https://aws.github.io/eks-charts>
$ helm repo update eks

 

  • AWS LoadBalancer Controller 설치
$ helm install aws-load-balancer-controller eks/aws-load-balancer-controller \\
  -n kube-system \\
  --set clusterName=my-cluster \\
  --set serviceAccount.create=false \\
  --set serviceAccount.name=aws-load-balancer-controller
  --set enableServiceMutatorWebhook=false
  
NAME: aws-load-balancer-controller
LAST DEPLOYED: Tue Jan 21 18:26:24 2025
NAMESPACE: kube-system
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
AWS Load Balancer controller installed!

 

  • v2.5.1 이후 AWS Load Balancer Controller는 기본값으로 service type = LoadBalancer를 만들면 NLB를 프로비저닝하는데 CLB를 만드려면 helm chart value에서 enableServiceMutatorWebhook 값을 false로 설정해야 한다.
  • AWS LoadBalancer Controller 배포 확인
$ kubectl get pod -n kube-system

NAME                                            READY   STATUS    RESTARTS   AGE
aws-load-balancer-controller-84f67c6594-8fcmz   1/1     Running   0          53s
aws-load-balancer-controller-84f67c6594-bctn4   1/1     Running   0          53s

3-3. NLB 서비스 예시 - test

https://docs.aws.amazon.com/ko_kr/eks/latest/userguide/network-load-balancing.html

  • NLB test app 배포
$ kubectl create namespace nlb-test-app
$ cat > test-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nlb-test-app
  namespace: nlb-test-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
        - name: nginx
          image: public.ecr.aws/nginx/nginx:1.23
          ports:
            - name: tcp
              containerPort: 80
              
$ kubectl apply -f test-deployment.yaml
deployment.apps/nlb-test-app created

$ kubectl get pod -n nlb-test-app
NAME                           READY   STATUS    RESTARTS   AGE
nlb-test-app-fccbb75cd-8sqp8   1/1     Running   0          13s
nlb-test-app-fccbb75cd-rbh5r   1/1     Running   0          13s
nlb-test-app-fccbb75cd-xc6v2   1/1     Running   0          13s
  • NLB test svc 배포
    • aws-load-balancer-nlb-target-type: ip
$ cat > test-svc.yaml
apiVersion: v1
kind: Service
metadata:
  name: nlb-test-service
  namespace: nlb-test-app
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-type: external
    service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
    service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
spec:
  ports:
    - port: 80
      targetPort: 80
      protocol: TCP
  type: LoadBalancer
  selector:
    app: nginx
    
$ kubectl apply -f test-svc.yaml
service/nlb-test-service created

$ kubectl get svc -n nlb-test-app
NAME               TYPE           CLUSTER-IP      EXTERNAL-IP   PORT(S)        AGE
nlb-test-service   LoadBalancer   10.100.44.224   <pending>     80:32385/TCP   35s

 

  • 권한 부족 에러 발생
$ kubectl describe -n nlb-test-app svc

Warning  FailedDeployModel  4m8s              service  Failed deploy model due to operation error Elastic Load Balancing v2: DescribeListenerAttributes, https response error StatusCode: 403, RequestID: f3d051c5-1777-4c6d-b39c-2e0f58e7b689, api error AccessDenied: User: arn:aws:sts::509399617708:assumed-role/AmazonEKSLoadBalancerControllerRole/1737486084691235541 is not authorized to perform: elasticloadbalancing:DescribeListenerAttributes because no identity-based policy allows the elasticloadbalancing:DescribeListenerAttributes action