Skip to content

Commit e5a2ed6

Browse files
clarklee92clarklee92
committed
fix: AmazonWebServices-NLB controller parameter modification and doc update
Signed-off-by: clarklee92 <[email protected]>
1 parent f946700 commit e5a2ed6

File tree

3 files changed

+60
-74
lines changed

3 files changed

+60
-74
lines changed

‎cloudprovider/amazonswebservices/README.md

+28-33
Original file line numberDiff line numberDiff line change
@@ -42,39 +42,34 @@ The key to deploying this project lies in authorizing the k8s ServiceAccount to
4242
4. On the cluster details page, ensure that the OIDC provider is enabled. Obtain the OIDC provider URL for the EKS cluster. In the "Configuration" section of the cluster details page, find the "OpenID Connect provider URL".
4343
4444
##### Step 2：Configure the IAM role trust policy
45-
46-
Create an IAM role:
47-
48-
- In the IAM console, create a new IAM role and select "Custom trust policy".
49-
50-
- Use the following trust policy to allow EKS to use this role:
51-
52-
```json
53-
{
54-
"Version": "2012-10-17",
55-
"Statement": [
56-
{
57-
"Effect": "Allow",
58-
"Principal": {
59-
"Federated": "arn:aws:iam::<AWS_ACCOUNT_ID>:oidc-provider/oidc.eks.<REGION>.amazonaws.com/id/<OIDC_ID>"
60-
},
61-
"Action": "sts:AssumeRoleWithWebIdentity",
62-
"Condition": {
63-
"StringEquals": {
64-
"oidc.eks.<REGION>.amazonaws.com/id/<OIDC_ID>:sub": "system:serviceaccount:<NAMESPACE>:<SERVICE_ACCOUNT_NAME>",
65-
"oidc.eks.<REGION>.amazonaws.com/id/<OIDC_ID>:aud": "sts.amazonaws.com"
66-
}
67-
}
68-
}
69-
]
70-
}
71-
```
72-
73-
- Replace `<AWS_ACCOUNT_ID>`、`<REGION>`、`<OIDC_ID>`、`<NAMESPACE>` and `<SERVICE_ACCOUNT_NAME>` with your actual values.
74-
75-
76-
77-
- Add the permission `ElasticLoadBalancingFullAccess`
45+
1. In the IAM console, create a new identity provider and select "OpenID Connect".
46+
- For the Provider URL, enter the OIDC provider URL of your EKS cluster.
47+
- For Audience, enter: `sts.amazonaws.com`
48+
49+
2. In the IAM console, create a new IAM role and select "Custom trust policy".
50+
- Use the following trust policy to allow EKS to use this role:
51+
```json
52+
{
53+
"Version": "2012-10-17",
54+
"Statement": [
55+
{
56+
"Effect": "Allow",
57+
"Principal": {
58+
"Federated": "arn:aws:iam::<AWS_ACCOUNT_ID>:oidc-provider/oidc.eks.<REGION>.amazonaws.com/id/<OIDC_ID>"
59+
},
60+
"Action": "sts:AssumeRoleWithWebIdentity",
61+
"Condition": {
62+
"StringEquals": {
63+
"oidc.eks.<REGION>.amazonaws.com/id/<OIDC_ID>:sub": "system:serviceaccount:<NAMESPACE>:ack-elbv2-controller",
64+
"oidc.eks.<REGION>.amazonaws.com/id/<OIDC_ID>:aud": "sts.amazonaws.com"
65+
}
66+
}
67+
}
68+
]
69+
}
70+
```
71+
- Replace `<AWS_ACCOUNT_ID>`、`<REGION>`、`<OIDC_ID>`、`<NAMESPACE>` and `<SERVICE_ACCOUNT_NAME>` with your actual values.
72+
- Add the permission `ElasticLoadBalancingFullAccess`
7873

7974

8075

‎cloudprovider/amazonswebservices/README.zh_CN.md

+27-30
Original file line numberDiff line numberDiff line change
@@ -42,36 +42,33 @@ aws:
4242
4343
##### 步骤 2：配置 IAM 角色信任策略
4444
45-
创建 IAM 角色：
46-
47-
- 在 IAM 控制台中，创建一个新的 IAM 角色，并选择 “Custom trust policy”。
48-
49-
- 使用以下信任策略，允许 EKS 使用这个角色：
50-
51-
```json
52-
{
53-
"Version": "2012-10-17",
54-
"Statement": [
55-
{
56-
"Effect": "Allow",
57-
"Principal": {
58-
"Federated": "arn:aws:iam::<AWS_ACCOUNT_ID>:oidc-provider/oidc.eks.<REGION>.amazonaws.com/id/<OIDC_ID>"
59-
},
60-
"Action": "sts:AssumeRoleWithWebIdentity",
61-
"Condition": {
62-
"StringEquals": {
63-
"oidc.eks.<REGION>.amazonaws.com/id/<OIDC_ID>:sub": "system:serviceaccount:<NAMESPACE>:<SERVICE_ACCOUNT_NAME>",
64-
"oidc.eks.<REGION>.amazonaws.com/id/<OIDC_ID>:aud": "sts.amazonaws.com"
65-
}
66-
}
67-
}
68-
]
69-
}
70-
```
71-
72-
- 将 `<AWS_ACCOUNT_ID>`、`<REGION>`、`<OIDC_ID>`、`<NAMESPACE>` 和 `<SERVICE_ACCOUNT_NAME>` 替换为您的实际值。
73-
74-
- 添加权限 `ElasticLoadBalancingFullAccess`
45+
1. 在 IAM 控制台中，创建一个新的身份提供商，并选择 “OpenID Connect”
46+
- 提供商URL填写EKS 集群的 OIDC 提供者 URL
47+
- 受众填写：`sts.amazonaws.com`
48+
2. 在 IAM 控制台中，创建一个新的 IAM 角色，并选择 “Custom trust policy”。
49+
- 使用以下信任策略，允许 EKS 使用这个角色：
50+
```json
51+
{
52+
"Version": "2012-10-17",
53+
"Statement": [
54+
{
55+
"Effect": "Allow",
56+
"Principal": {
57+
"Federated": "arn:aws:iam::<AWS_ACCOUNT_ID>:oidc-provider/oidc.eks.<REGION>.amazonaws.com/id/<OIDC_ID>"
58+
},
59+
"Action": "sts:AssumeRoleWithWebIdentity",
60+
"Condition": {
61+
"StringEquals": {
62+
"oidc.eks.<REGION>.amazonaws.com/id/<OIDC_ID>:sub": "system:serviceaccount:<NAMESPACE>:ack-elbv2-controller",
63+
"oidc.eks.<REGION>.amazonaws.com/id/<OIDC_ID>:aud": "sts.amazonaws.com"
64+
}
65+
}
66+
}
67+
]
68+
}
69+
```
70+
- 将 `<AWS_ACCOUNT_ID>`、`<REGION>`、`<OIDC_ID>`、`<NAMESPACE>` 和 `<SERVICE_ACCOUNT_NAME>` 替换为您的实际值。
71+
- 添加权限 `ElasticLoadBalancingFullAccess`
7572

7673

7774

‎cloudprovider/amazonswebservices/nlb.go

+5-11
Original file line numberDiff line numberDiff line change
@@ -56,10 +56,6 @@ const (
5656
NlbAnnotations = "Annotations"
5757
NlbARNAnnoKey = "service.beta.kubernetes.io/aws-load-balancer-nlb-arn"
5858
NlbPortAnnoKey = "service.beta.kubernetes.io/aws-load-balancer-nlb-port"
59-
NlbTypeKey = "service.beta.kubernetes.io/aws-load-balancer-type"
60-
NlbTypeExternal = "external"
61-
NlbTargetTypeKey = "service.beta.kubernetes.io/aws-load-balancer-nlb-target-type"
62-
NlbTargetTypeIP = "ip"
6359
AWSTargetGroupSyncStatus = "aws-load-balancer-nlb-target-group-synced"
6460
SvcSelectorKey = "statefulset.kubernetes.io/pod-name"
6561
NlbConfigHashKey = "game.kruise.io/network-config-hash"
@@ -255,7 +251,7 @@ func (n *NlbPlugin) initLbCache(svcList []corev1.Service) {
255251
}
256252
}
257253

258-
func (n *NlbPlugin) OnPodAdded(client client.Client, pod *corev1.Pod, ctx context.Context) (*corev1.Pod, cperrors.PluginError) {
254+
func (n *NlbPlugin) OnPodAdded(c client.Client, pod *corev1.Pod, ctx context.Context) (*corev1.Pod, cperrors.PluginError) {
259255
return pod, nil
260256
}
261257

@@ -651,7 +647,7 @@ func (n *NlbPlugin) syncTargetGroupAndService(config *nlbConfig,
651647
targetGroupName := fmt.Sprintf("%s-%d", pod.GetName(), ports[i])
652648
protocol := string(config.backends[i].protocol)
653649
targetPort := int64(config.backends[i].targetPort)
654-
targetType := NlbTargetTypeIP
650+
var targetTypeIP = string(ackv1alpha1.TargetTypeEnum_ip)
655651
_, err := controllerutil.CreateOrUpdate(ctx, client, &ackv1alpha1.TargetGroup{
656652
ObjectMeta: metav1.ObjectMeta{
657653
Name: targetGroupName,
@@ -679,8 +675,8 @@ func (n *NlbPlugin) syncTargetGroupAndService(config *nlbConfig,
679675
Name: &targetGroupName,
680676
Protocol: &protocol,
681677
Port: &targetPort,
682-
TargetType: &targetType,
683678
VPCID: &config.vpcID,
679+
TargetType: &targetTypeIP,
684680
Tags: []*ackv1alpha1.Tag{{Key: ptr.To[string](ResourceTagKey),
685681
Value: ptr.To[string](ResourceTagValue)}},
686682
},
@@ -700,8 +696,6 @@ func (n *NlbPlugin) syncTargetGroupAndService(config *nlbConfig,
700696
})
701697
}
702698
annotations := map[string]string{
703-
NlbTypeKey: NlbTypeExternal,
704-
NlbTargetTypeKey: NlbTargetTypeIP,
705699
NlbARNAnnoKey: lbARN,
706700
NlbConfigHashKey: util.GetHash(config),
707701
}
@@ -771,7 +765,7 @@ func syncListenerAndTargetGroupBinding(ctx context.Context, client client.Client
771765
return err
772766
}
773767

774-
var targetType = elbv2api.TargetTypeIP
768+
var targetTypeIP = elbv2api.TargetTypeIP
775769
_, err = controllerutil.CreateOrUpdate(ctx, client, &elbv2api.TargetGroupBinding{
776770
ObjectMeta: metav1.ObjectMeta{
777771
Name: tg.GetName(),
@@ -784,7 +778,7 @@ func syncListenerAndTargetGroupBinding(ctx context.Context, client client.Client
784778
},
785779
Spec: elbv2api.TargetGroupBindingSpec{
786780
TargetGroupARN: *targetGroupARN,
787-
TargetType: &targetType,
781+
TargetType: &targetTypeIP,
788782
ServiceRef: elbv2api.ServiceReference{
789783
Name: podName,
790784
Port: intstr.FromInt(int(port)),

0 commit comments

Comments
 (0)