🔴 - To support my channel, I’d like to offer Mentorship/On-the-Job Support/Consulting - me@antonputra.com 👉 [UPDATED] AWS EKS Kubernetes Tutorial [NEW]: czcams.com/play/PLiMWaCMwGJXnKY6XmeifEpjIfkWRo9v2l.html&si=wc6LIC5V2tD-Tzwl
High level steps to create eks cluster with terraform : 1. create vpc,subnets , route table and association , igw , nat etc 2.create proper iam roles and policies required for eks master and node groups 3. create eks cluster and node groups now how to access this cluster to run yaml files to create deployments and services etc ..... plz can u reply
Wow.. thank you soo much for the quality content. You have no idea how much I appreciate this video. If you are ever in Los Angeles let me know and I'll buy you a beer 🙌
Great video, thanks for share, I've using Istio for K8s mesh, in my opinion it's more easier and simple to manage, but learn other methods it's very important.
I guess you could use multiple alternative names when issuing the certificate. However, it can be a nightmare to maintain in the long term, especially if you need to add new DNS entries or remove deprecated ones.
Hey, I love your work and videos! Keep it going. Question, is it still not possible to make aws-loadbalancer-controller work to issue letsencrypt or zerossl certificates? Do we still have to use ingress-nginx controller in 2022 because aws-loadbalancer-controller is ment to issue only AWS certificates? 😛 I can issue certificates from zerossl with cert-manager annotation, but the aws-loadbalancer-controller cannot discover those certificates unfortunately.
Awesome content!!. Got everything I was looking for in a single video. Will the cost be more for ALB in comparison to Classic load balancer and how can I calculate the cost? And how we can have ingress create Classic Load Balancer instead of ALB? Thanks again for the video!
Thanks! You shouldn't use Classic load balancer at all, better to migrate to NLB. In term of pricing ALB a little bit more expensive than NLB - aws.amazon.com/elasticloadbalancing/pricing/ You can use AWS Load balancer controller to provision services of type "LoadBalancer" with NLB
Excellent video! I have a question. Is it recommended to use alb ingress controller in production environments? Since it requires a Nodeport service and that is a security hole because we are opening a port of our instance.
Thanks! Even if you expose your app with load balancer, it will open node ports. You still have security groups in place that block unauthorized access. But I would recommend to use ip mode anyway.
Great walkthrough ! For a of service type ClusterIP, is it mandatory to have external-dns ? If not, what the configuration would be in the ingress manifest ?
Can we configure aws load balancer with kubedam setup cluster so that when I connect my network load balancer with kubeadm worker nodes then on loadbalancer service type, then in external IP it will show my NLB DNA record
Thanks Alex, I don't but i think it's should be straigh forward to include this helm chart to tf - github.com/kubernetes-sigs/external-dns/tree/master/charts/external-dns#externaldns terraform/helm example - github.com/antonputra/tutorials/blob/main/lessons/155/istio-terraform/1-istio-base.tf
@antonPutra if we are changing image for service b then its not working for service b using only path based routing , which looks like service not available , can you help
Hi! How do you know which version to use in resource "helm_release" "aws-load-balancer-controller", version = "1.4.1" #? and in tag: set { name = "image.tag" value = "v2.4.2" #? where did you get it? Thanks!
Generally you don't need to create extra health checks besides the ones created by the aws load balancer controller. If you're looking to manage your own load balancer, check this - kubernetes-sigs.github.io/aws-load-balancer-controller/v2.5/guide/use_cases/self_managed_lb/
I love all kubernetes related things, sadly it's an overkill for my company and we stick to simple self managed docker swarm, soon to be ECS autoscalable
how do i get url = aws_eks_cluster.cluster.identity[0].oidc[0].issuer if i'm declaring the eks not as a "aws_eks_ckuster" resource but as a module? (module "eks") can't figure that out
something like this - github.com/antonputra/tutorials/blob/e1c48ccb8888ac6f079cfb520b4f010388dd81ec/lessons/006/main.tf#L14 Keep in mind, you module needs to have output variable
Very helpful tutorial, anyway I have a question about best practice for deploying more than 1 EKS Cluster, Should I create 2 load balancer controller ?? adding user on role or do you have any idea ?? Thank you very much @Anton Putra
@@AntonPutra I see but it seems when I try to deploy ingress, on load balancer controller logs it says No OpenIDConnect provider... I have created new oidc for new cluster and assigned new role and following along with your tutorial (the first cluster has no issue)
Can somebody use an alb present not spun up by the load balancer controller as the single alb used by ingress classes? Or using 1 alb from eks as well as for ec2s outside the eks not possible at the same time?
Yes, you can use TargetGroupBinding, "can expose your pods using an existing..". Take a look on doc - kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/guide/targetgroupbinding/targetgroupbinding/
Yes, but there are some limitations, and most likely you would keep using one ALB per one ingress in prod - kubernetes-sigs.github.io/aws-load-balancer-controller/v2.7/guide/ingress/annotations/#ingressgroup
@@davidvillasmil1468 i still prefer nginx ingress, you can scape ingress (prom metrics) to get all metrics (latency, availability etc all 4 golden signals out of box) with alb controller you forced to expose metrics on each app. By the way I'll release refreshed video soon with pod identities instead of irsa
Great walkthrough and Excellent work ! but how about to use aws load balancer juste to controle the life cycle of an ALB then create an ingress resource in aws load balancer to route all the traffic to an ingnix controller then create multiple ingresses in ngnix controller so u have all ur services in cluster ip and juste one with nodePort does thin work ?
@@AntonPutra cannot be possible to work with both ? the aws LB to create the application LB then create an ingress resoursse to route all the traffic to the ngnix controller who will be responsable to route the trafic to each microservice with the ingress rules
You can use the following command to install cert-manager - kubectl apply -f github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.yaml
Right, what you'll want to do is use the AWS Load Balancer Controller to create a Network Load Balancer for the Nginx Ingress Controller. I have a video - czcams.com/video/ePqUq06WoLk/video.html
Does anybody else has problems with destroying ingresses / loadbalancers created from terraform? It seems like there is a problem with security groups created for each loadbalancer
Before you run "terraform destroy" you need to delete kubernetes objects that manage application load balancers. Something like kubectl delete -f ingress.yaml or service.yaml.
@@AntonPutra I found that problem is more serious. Currently I have 1 ingress set with terraform for grafana service. It is being created correctly. But i cannot delete it. Neither by terraform destroy, not even kubectl delete. Finalizers in ingress objects AND in namespace which contains those ingresses prevents them from deletion. So i have to remove them with kubectl patch or curl. I already spent few days investigating this. Currently im messing arrount with policies and roles to find a clue.
Why do yo have it still going through http when you already have it going through https? Isn't that insecure the fact that it can still be accessed with http?
@@AntonPutra Thanks for your explanation. For me everything looks fine, however, when I do kubectl get ing -n I do not get and ADDRESS, and I also notice I do not have any load balancer present in ec2 control pane. Any recommendations? Error message: Failed build model due to couldn't auto-discover subnets: unable to discover at least one subnet
🔴 - To support my channel, I’d like to offer Mentorship/On-the-Job Support/Consulting - me@antonputra.com
👉 [UPDATED] AWS EKS Kubernetes Tutorial [NEW]: czcams.com/play/PLiMWaCMwGJXnKY6XmeifEpjIfkWRo9v2l.html&si=wc6LIC5V2tD-Tzwl
I have gone through so many articles on google and youtube videos. This is the best video so far.
Thanks one more is coming on the topic
Thanks mate, this is a good way to grasp the Terraform part of infrastructure.
thanks i have updated eks services if you're interested - czcams.com/play/PLiMWaCMwGJXnKY6XmeifEpjIfkWRo9v2l.html
High level steps to create eks cluster with terraform :
1. create vpc,subnets , route table and association , igw , nat etc
2.create proper iam roles and policies required for eks master and node groups
3. create eks cluster and node groups
now how to access this cluster to run yaml files to create deployments and services etc ..... plz can u reply
You need to update your k8s config with "aws eks update-kubeconfig --name dev-demo --region us-east-2" replace region and name of the cluster
This guy is way super smart 👏👏👏
thanks :) i have updated video - czcams.com/video/5XpPiORNy1o/video.html
Thank God for you sir
😊
The most complete! Amazing. A little bit fast but everything is there and plus: raw, helm terraform.. amazing!!
thank you!!
I definitively appreciate this video. Clear and didactic. Thanks a lot
thank you!
High quality content only! It's the second time Your video helps me to figure out how to deal with k8s! Keep going!
Thank you, Ivan!
This video series is pure gold. Thank you very much.
Thank you!
Wow.. thank you soo much for the quality content. You have no idea how much I appreciate this video. If you are ever in Los Angeles let me know and I'll buy you a beer 🙌
Thanks, sure lol
Антон, большое спасибо за такие ценные видео!
Spasibo)
The best explanation that I coud find in web. Thank you very much. It has really helped.
Thank you, Eugen! I appreciate it!
you saved my life man, thanks for posting this!
no problem!
This is exactly what I was looking for! Thanks for a brilliant video!
its amazing Anton )) thanks a lot bro
welcome :)
Hi Anton, Great video. Loved the detailed explanation. If possible please make a video on TLS Termination at Pods for end to end encryption.
well i have one with istio and end to end tls via gateway
thank you so much, such a great tutorial!!
Welcome!!
Great video, thanks for share, I've using Istio for K8s mesh, in my opinion it's more easier and simple to manage, but learn other methods it's very important.
Thanks, what about app mesh?
@@AntonPutra Yes, about networking service mesh, discovery. Istio works like that, including gateway and ingress controllers.
very nice tutorial! i can't figure out how to create the ALB on an EXISTING eks...
Why? What's the problem? Do you use helm cli to deploy or terraform?
Hey man! Really GREAT content! Thank you!
Hey, thanks!
Get Full-Length High-Quality DevOps Tutorials for Free - Subscribe Now! - czcams.com/users/AntonPutra
Great job as usual! Thanks
It's a really peaty that the AWS Load Balancer Controller doesn't support the rewrite rules
Thanks, I know
is it possible to use singel ALB to terminate mutiple SSL hosts that are using the same ACM?
I guess you could use multiple alternative names when issuing the certificate. However, it can be a nightmare to maintain in the long term, especially if you need to add new DNS entries or remove deprecated ones.
Absoulely needed this!. I just subcsribed.
Thanks El!
Hey,
I love your work and videos! Keep it going.
Question, is it still not possible to make aws-loadbalancer-controller work to issue letsencrypt or zerossl certificates? Do we still have to use ingress-nginx controller in 2022 because aws-loadbalancer-controller is ment to issue only AWS certificates? 😛
I can issue certificates from zerossl with cert-manager annotation, but the aws-loadbalancer-controller cannot discover those certificates unfortunately.
Awesome content!!. Got everything I was looking for in a single video.
Will the cost be more for ALB in comparison to Classic load balancer and how can I calculate the cost? And how we can have ingress create Classic Load Balancer instead of ALB?
Thanks again for the video!
Thanks! You shouldn't use Classic load balancer at all, better to migrate to NLB. In term of pricing ALB a little bit more expensive than NLB - aws.amazon.com/elasticloadbalancing/pricing/
You can use AWS Load balancer controller to provision services of type "LoadBalancer" with NLB
Excellent video! I have a question. Is it recommended to use alb ingress controller in production environments? Since it requires a Nodeport service and that is a security hole because we are opening a port of our instance.
Thanks! Even if you expose your app with load balancer, it will open node ports. You still have security groups in place that block unauthorized access. But I would recommend to use ip mode anyway.
Great walkthrough ! For a of service type ClusterIP, is it mandatory to have external-dns ? If not, what the configuration would be in the ingress manifest ?
Thanks, do you mean external-dns plugin to automatically create DNS records, not at all
🔴UPDATED🔴 How to create EKS Cluster using Terraform MODULES (AWS Load Balancer Controller + Autoscaler + IRSA) - czcams.com/video/kRKmcYC71J4/video.html
Monitor EKS & EC2 instances with MANAGED Prometheus - czcams.com/video/-nUQNFAX5TI/video.html
🟢 [New] Terragrunt Tutorial: Create VPC, EKS from Scratch! (Step-by-Step) - czcams.com/video/yduHaOj3XMg/video.html
Hey anton, i like your videos the way you do them ! can you please do a video for eks with keda autoscaling ! thanks
Sure, just put it in my list!
Hey! Thanks for the video! How much different would it be to use AWS Load Balancer Controller on a self-hosted k8s?
Thanks, you just need to attach IAM policy to nodes instead of using IAM roles for service accounts.
Can we configure aws load balancer with kubedam setup cluster so that when I connect my network load balancer with kubeadm worker nodes then on loadbalancer service type, then in external IP it will show my NLB DNA record
Not sure, but kubeadm works with metallb if you need on-prem setup.
do you have terraform code to deploy external dns as well? The same way you did for aws ingress wiht helm. Thanks for your hard work as always!
Thanks Alex, I don't but i think it's should be straigh forward to include this helm chart to tf - github.com/kubernetes-sigs/external-dns/tree/master/charts/external-dns#externaldns
terraform/helm example - github.com/antonputra/tutorials/blob/main/lessons/155/istio-terraform/1-istio-base.tf
@antonPutra
if we are changing image for service b then its not working for service b using only path based routing , which looks like service not available , can you help
Well, alb controller has some limitations related to rewriting but it should work in the case you described
Hi!
How do you know which version to use in resource "helm_release" "aws-load-balancer-controller",
version = "1.4.1" #?
and in tag:
set {
name = "image.tag"
value = "v2.4.2" #?
where did you get it?
Thanks!
At this point you can use default one that comes with the helm chart
how to create the health checks for the target groups that are created by the controller ? is there a way to create it via terraform ?
Generally you don't need to create extra health checks besides the ones created by the aws load balancer controller. If you're looking to manage your own load balancer, check this - kubernetes-sigs.github.io/aws-load-balancer-controller/v2.5/guide/use_cases/self_managed_lb/
Awesome
Thanks vitaerial!
just subscribed! awesome tutorial. Do you have a video guide how to connect eks to database using terraform?
Thanks! which one? dynamodb?
I don't but I'm going to create soon how to invoke lambda from eks, same principle will apply
@@AntonPutra a simple container app using env amd secrets to connect to rds
I love all kubernetes related things, sadly it's an overkill for my company and we stick to simple self managed docker swarm, soon to be ECS autoscalable
Sometimes I think it's easier to deploy standalone VMs, a lot of overhead and hidden cost in Kubernetes
Thanks for the video❤
I should use only one right either terraform or helm while deploying load balancer controller right?
Welcome, you can use terraform helm provider to deploy load balancer controller.
👉 How to Manage Secrets in Terraform - czcams.com/video/3N0tGKwvBdA/video.html
👉 Terraform Tips & Tricks - czcams.com/video/7S94oUTy2z4/video.html
👉 ArgoCD Tutorial - czcams.com/video/zGndgdGa1Tc/video.html
how do i get url = aws_eks_cluster.cluster.identity[0].oidc[0].issuer if i'm declaring the eks not as a "aws_eks_ckuster" resource but as a module? (module "eks") can't figure that out
something like this - github.com/antonputra/tutorials/blob/e1c48ccb8888ac6f079cfb520b4f010388dd81ec/lessons/006/main.tf#L14
Keep in mind, you module needs to have output variable
This is great, thanks!!
Thanks
No problem
Hi AntonPutra, you are doing great. just wanted know how can we deploy the nginx ingress controller using terraform?
Thanks, here is an example - github.com/antonputra/tutorials/blob/main/lessons/167/terraform/10-helm-ingress.tf
do we always have to mention host in Ingress controller?
No but it’s highly recommended, if you don’t it’s going to be a wildcard
Very helpful tutorial, anyway I have a question about best practice for deploying more than 1 EKS Cluster, Should I create 2 load balancer controller ?? adding user on role or do you have any idea ?? Thank you very much @Anton Putra
you need to deployed alb controller to each cluster, but better look into nginx or istio/linkerd (you can get lots more for free)
@@AntonPutra I see but it seems when I try to deploy ingress, on load balancer controller logs it says No OpenIDConnect provider... I have created new oidc for new cluster and assigned new role and following along with your tutorial (the first cluster has no issue)
Can somebody use an alb present not spun up by the load balancer controller as the single alb used by ingress classes?
Or using 1 alb from eks as well as for ec2s outside the eks not possible at the same time?
Yes, you can use TargetGroupBinding, "can expose your pods using an existing..".
Take a look on doc - kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/guide/targetgroupbinding/targetgroupbinding/
Thank you very very much for your turorials! Is this valid for 1.29?
Yes, but there are some limitations, and most likely you would keep using one ALB per one ingress in prod - kubernetes-sigs.github.io/aws-load-balancer-controller/v2.7/guide/ingress/annotations/#ingressgroup
Thanks, Anton! I will test it tonight!
@@davidvillasmil1468 i still prefer nginx ingress, you can scape ingress (prom metrics) to get all metrics (latency, availability etc all 4 golden signals out of box) with alb controller you forced to expose metrics on each app. By the way I'll release refreshed video soon with pod identities instead of irsa
Great walkthrough and Excellent work ! but how about to use aws load balancer juste to controle the life cycle of an ALB then create an ingress resource in aws load balancer to route all the traffic to an ingnix controller then create multiple ingresses in ngnix controller so u have all ur services in cluster ip and juste one with nodePort does thin work ?
Thanks, didn't get a question. You can use either aws load balancer controller or nginx controller to fulfill the ingress resource.
@@AntonPutra cannot be possible to work with both ? the aws LB to create the application LB then create an ingress resoursse to route all the traffic to the ngnix controller who will be responsable to route the trafic to each microservice with the ingress rules
@@AntonPutra i want to do that architecture can u help me with that ?
@@wassimbenregaya5445 you can use alb controller to create network load balancer for Nginx
that cert-manager yaml file link is not there
You can use the following command to install cert-manager - kubectl apply -f github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.yaml
can i use nginx load balancer in place of aws load balancer
Right, what you'll want to do is use the AWS Load Balancer Controller to create a Network Load Balancer for the Nginx Ingress Controller. I have a video - czcams.com/video/ePqUq06WoLk/video.html
@@AntonPutra thanks sir
how to make NLB to use 443?
I have a section for 443/TLS -> 18:02 Secure Ingress with SSL/TLS
@@AntonPutra do i need ingress.yaml for NLB also?
Does anybody else has problems with destroying ingresses / loadbalancers created from terraform? It seems like there is a problem with security groups created for each loadbalancer
Before you run "terraform destroy" you need to delete kubernetes objects that manage application load balancers. Something like kubectl delete -f ingress.yaml or service.yaml.
@@AntonPutra I found that problem is more serious. Currently I have 1 ingress set with terraform for grafana service. It is being created correctly. But i cannot delete it. Neither by terraform destroy, not even kubectl delete. Finalizers in ingress objects AND in namespace which contains those ingresses prevents them from deletion. So i have to remove them with kubectl patch or curl. I already spent few days investigating this. Currently im messing arrount with policies and roles to find a clue.
Why do yo have it still going through http when you already have it going through https? Isn't that insecure the fact that it can still be accessed with http?
You can use plain http with internal services that can be accessed only within your VPC
@@AntonPutra Thanks for your explanation. For me everything looks fine, however, when I do kubectl get ing -n I do not get and ADDRESS, and I also notice I do not have any load balancer present in ec2 control pane. Any recommendations? Error message: Failed build model due to couldn't auto-discover subnets: unable to discover at least one subnet
can you share me iam policy. i did find policy in your git file.
This one? github.com/antonputra/tutorials/blob/main/lessons/112/ExternalDNSAccess.json
Great content bro, thank you.
Your name likes indonesian name, are you from indonesia ?
Thanks aryadi!
No, but I was told the same many times when I was in Bali =)
Hi Anton, I got an error in the ingress.
default-http-backend:80 (
why this error occur ?
response of alb is 404 not found
Hi Anton, I have solved the problem. wrong host in the ingress
Can I use load balancer controller to expose this helm chart: bitnami/keycloak ?
I am trying to change it's values but I am unable, can you help me?
did you use match your ingress class name with this?
github.com/bitnami/charts/blob/master/bitnami/keycloak/values.yaml#L526