← Back to blog
ALB Controller Use Case

ALB Controller Use Case

#aws #cloud-native

You can’t attach a security group to an existing Network Load Balancer. In this case, what you need is an Application Load Balancer Controller. To set it up, there are several steps that you need to go through.

Step 1 - Create Custom IAM Role for ALB Controller

  1. After authenticating to your AWS account with all needed permissions, run the command below to download the permission policy document: curl -o iam-policy.json https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v3.4.0/docs/install/iam_policy.json Mind the version detail there. v3.4.0 is the latest version of the policy as of today, but this might change.

The reference command is surely mentioned in the official doc: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/deploy/installation/

  1. Create an IAM policy that includes all the permissions you downloaded earlier - run the command below: aws iam create-policy --policy-name AWSLoadBalancerControllerIAMPolicy --policy-document file://iam-policy.json this command assumes that in step 1 you saved the document as iam-policy.json - change the document name in case you saved it differently.

  2. Create the IAM role and attach the policy created previously. You can do this either via IaC of your choice, or by AWS console, or by running the command below:

eksctl create iamserviceaccount \
--cluster=<cluster-name> \
--namespace=kube-system \
--name=aws-load-balancer-controller \
--attach-policy-arn=arn:aws:iam::<AWS_ACCOUNT_ID>:policy/AWSLoadBalancerControllerIAMPolicy \
--override-existing-serviceaccounts \
--region <region-code> \
--approve

fill the missing parts in the command accordingly: cluster-name, account ID, region. Also bear in mind that the command assumes that you named your policy AWSLoadBalancerControllerIAMPolicy in previous step.

Step 2 - Tag Subnets for Discovery

Assuming that you want to deploy your load balancers facing internet, you need to add a specific tags on your public subnets, in your corresponding VPC: Key should be kubernetes.io/role/elb and Value should be 1.

That’s it. Whichever public subnet you want your load balancers to be deployed, make sure they are tagged properly. There is a way to specify where you want your subnet to be deployed. *In case you want to deploy your load balancers to a private subnet, tag the subnets with kubernetes.io/role/internal-elb key and 1 value.

Step 3 - Activate ALB Controller

  1. In case not installed already, install cert manager by running the command below: kubectl apply --validate=false -f https://github.com/cert-manager/cert-manager/releases/download/v1.12.3/cert-manager.yaml

  2. Download the YAML file to apply for activating ALB Controller via cert manager: wget https://github.com/kubernetes-sigs/aws-load-balancer-controller/releases/download/v3.4.0/v3_4_0_full.yaml

  • The version is likely to change - check reference doc to make sure latest version is downloaded.*

  1. Edit the file downloaded. Find cluster-name field and write your specific cluster name.

  2. Apply the YAML file by running: kubectl apply -f v3_4_0_full.yaml

Next step is to deploy a network load balancer or an elastic load balancer in a custom namespace, which I look forward explaining on another post!