search

kubernetes-sigs / aws-load-balancer-controller

A Kubernetes controller for Elastic Load Balancers
https://kubernetes-sigs.github.io/aws-load-balancer-controller/
Apache License 2.0
3.94k stars 1.46k forks source link

[v2] Support for --alb-name-perfix #1788

Closed kpulgam closed 2 years ago

kpulgam commented 3 years ago

We use --alb-name-perfix in our current v1 alb ingress controller implementation , which helps us craft our IAM policy for controller to make it resource bound based on the prefix. I see there was similar discussion in https://github.com/kubernetes-sigs/aws-load-balancer-controller/issues/1302 to see if --alb-name-perfix is also supported in v2 ( this will help us along with tag based conditions in locking IAM even further ) I did not notice this flag mentioned anywhere in the documentation - https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/deploy/configurations.md

Can anyone please advise if it still is supported. Thanks!

M00nF1sh commented 3 years ago

@ketan-sdeuser The v2 Controller doesn't support the --alb-name-perfix flag. we now used a fixed name pattern for ALB/NLBs: k8s-<namespacedName>-<hash>. The fixed name pattern allows us to have fine-grain control to stay within ELB's naming limits.

What's your use case to use this --alb-name-perfix flag? (e.g. the purpose, prefix length, etc.) will a new feature to allow you specify the whole ALB name(instead of a prefix) for Ingress be sufficient?

alexmnyc commented 3 years ago

When trying to fit into existing infrastructure moulds at Enterprises, IAM policies are already crafted around specific resource naming conventions. We need the ability to customize it. For example, a team name "aum" must have all ALB resources named starting with aum prefix. It is important to have this level of customization for Enterprise integrations with the existing IAM paradigms

LiorLieberman commented 3 years ago

Any updates regarding this feature?, we just move to work with the new version and we need the as well need the prefix option that was in the old controller

k8s-triage-robot commented 3 years ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot commented 2 years ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot commented 2 years ago

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

k8s-triage-robot commented 2 years ago

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

k8s-ci-robot commented 2 years ago

@k8s-triage-robot: Closing this issue.

In response to [this](https://github.com/kubernetes-sigs/aws-load-balancer-controller/issues/1788#issuecomment-1042555675): >The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs. > >This bot triages issues and PRs according to the following rules: >- After 90d of inactivity, `lifecycle/stale` is applied >- After 30d of inactivity since `lifecycle/stale` was applied, `lifecycle/rotten` is applied >- After 30d of inactivity since `lifecycle/rotten` was applied, the issue is closed > >You can: >- Reopen this issue or PR with `/reopen` >- Mark this issue or PR as fresh with `/remove-lifecycle rotten` >- Offer to help out with [Issue Triage][1] > >Please send feedback to sig-contributor-experience at [kubernetes/community](https://github.com/kubernetes/community). > >/close > >[1]: https://www.kubernetes.dev/docs/guide/issue-triage/ Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
rdubya16 commented 2 years ago

@M00nF1sh Is this not mentioned anywhere in the migration guide? We use this feature to lockdown IAM permissions when using multiple kubernetes clusters. We expected this feature to still work from it not being mentioned anywhere. What is now the best way to grant limited access to alb resources when running multiple kubernetes clusters in the same account?

We explored using something like conditionals on tags but because each ingress controller needs to be able to AddTags that would result in any compromise of one controller effectively meaning they all would be compromised.

kishorj commented 2 years ago

/remove-lifecycle rotten /reopen

k8s-ci-robot commented 2 years ago

@kishorj: Reopened this issue.

In response to [this](https://github.com/kubernetes-sigs/aws-load-balancer-controller/issues/1788#issuecomment-1108920340): >/remove-lifecycle rotten >/reopen Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
kishorj commented 2 years ago

@rdubya16, the v2 controller adds a resource tag with the key elbv2.k8s.aws/cluster with the current clusterName as the value. You could also configure controller instance to add additional tags. Would it not be possible to lockdown the IAM permission per controller based on the specific tag values?

k8s-triage-robot commented 2 years ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot commented 2 years ago

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

k8s-triage-robot commented 2 years ago

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

k8s-ci-robot commented 2 years ago

@k8s-triage-robot: Closing this issue, marking it as "Not Planned".

In response to [this](https://github.com/kubernetes-sigs/aws-load-balancer-controller/issues/1788#issuecomment-1264791418): >The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs. > >This bot triages issues according to the following rules: >- After 90d of inactivity, `lifecycle/stale` is applied >- After 30d of inactivity since `lifecycle/stale` was applied, `lifecycle/rotten` is applied >- After 30d of inactivity since `lifecycle/rotten` was applied, the issue is closed > >You can: >- Reopen this issue with `/reopen` >- Mark this issue as fresh with `/remove-lifecycle rotten` >- Offer to help out with [Issue Triage][1] > >Please send feedback to sig-contributor-experience at [kubernetes/community](https://github.com/kubernetes/community). > >/close not-planned > >[1]: https://www.kubernetes.dev/docs/guide/issue-triage/ Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.