Home / Platform management / Clusters / Clusters / Public Cloud Cluster Initialization / Network Initialization / AWS EKS Cluster Network Initialization Configuration

AWS EKS Cluster Network Initialization Configuration

Support Overview

	Support	Conditions
Service for LoadBalancer Type (Service)	Support	As needed, deploy AWS Load Balancer Controller ; if this controller is not deployed, the supported LoadBalancer capabilities are relatively limited.
Ingress	Support	As needed, deploy AWS Load Balancer Controller . Enable the Ingress Class feature as needed (after enabling this feature, you can manually select the Ingress class by creating an Ingress through the form page).

Prerequisites

Prepare two subnets, and both subnets have the Tag kubernetes.io/role/elb. If reusing subnets, you must add the Tag kubernetes.io/cluster/: shared. For details, refer to Add Tags to Subnets .
If you have created an EKS cluster, please connect to Amazon EKS cluster ; if you haven’t created an EKS cluster, please create an AWS EKS cluster .
Before deploying AWS Load Balancer Controller, make sure Kubectl, Helm, AWS CLI, and eksctl tools are available.

Note: After installing the tools, you need to use the user who created the cluster to configure login information through AWS CLI, and test whether AWS CLI and eksctl tools are installed correctly .
Obtain the ACCOUNT_ID , REGION, and CLUSTER_NAME in advance, and use the actual variables obtained to replace <ACCOUNT_ID>, <REGION>, and <CLUSTER_NAME> in the document.

Note: ACCOUNT_ID is the Account ID of the user who created the cluster, REGION is the region where the cluster is located, and CLUSTER_NAME is the name of the cluster you want to use.
Update and verify the Kubeconfig configuration file .

Procedure

Deploy AWS Load Balancer Controller

Note: For detailed information about deploying AWS Load Balancer Controller, please refer to the official website documentation .

Configure OIDC Provider

The Kubernetes cluster uses OpenID Connect (OIDC) for identity management and is associated with an OIDC issuer URL. To enable AWS Identity in the cluster and allow IAM roles for Service Accounts, you need to create an IAM OIDC Provider associated with the OIDC issuer URL of the cluster.

Run the following command in eksctl tool to configure the OIDC Provider.

eksctl utils associate-iam-oidc-provider --region=<REGION> --cluster=<CLUSTER_NAME> --approve

Configure Service Account

Run the following command to create an IAM policy, and create a Service Account named aws-load-balancer-controller and associate it with an IAM role.

curl -o aws-load-balancer-controller-iam-policy.json https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.4.7/docs/install/iam_policy.json
aws iam create-policy \
    --policy-name <CLUSTER_NAME>-AWSLoadBalancerControllerIAMPolicy \
    --policy-document file://aws-load-balancer-controller-iam-policy.json

eksctl create iamserviceaccount \
  --cluster=<CLUSTER_NAME> \
  --namespace=kube-system \
  --name=aws-load-balancer-controller \
  --role-name AmazonEKSLoadBalancerControllerRole \
  --attach-policy-arn=arn:aws:iam::<ACCOUNT_ID>:policy/<CLUSTER_NAME>-AWSLoadBalancerControllerIAMPolicy \
  --approve

Deploy AWS Load Balancer Controller to the Cluster

Run the following command in eksctl tool to deploy AWS Load Balancer Controller.

Add the eks-charts repository.

helm repo add eks https://aws.github.io/eks-charts

Update the local repository.

helm repo update eks

Deploy the Helm Chart of AWS Load Balancer Controller to the cluster.

Note: aws-load-balancer-controller is the Service Account created in Configure Service Account .

helm install aws-load-balancer-controller eks/aws-load-balancer-controller \
  -n kube-system \
  --set ingressClassConfig.default=true \
  --set clusterName=<CLUSTER_NAME> \
  --set serviceAccount.create=false \
  --set serviceAccount.name=aws-load-balancer-controller

Create Ingress, LoadBalancer Type Service

Ingress and LoadBalancer type Service can be created simultaneously or selected one by one based on the actual situation.

Create Ingress

Go to Container Platform, in the left navigation pane, click Networking > Ingresses.
Click Create Ingress, and select EKS Ingress Class for Ingress Class.
Choose the Protocol, and by default, use the HTTP protocol. If you need to use the HTTPS protocol, please first create a certificate and select to use this certificate.
Switch to YAML, and add the

following annotations in the YAML file. For details, refer to Annotation Description .

```yaml
alb.ingress.kubernetes.io/scheme: internet-facing ##Specify access as public network access
alb.ingress.kubernetes.io/target-type: ip  ##Specify that traffic is directly routed to the container group
```

Click Create.

Create LoadBalancer Type Service

Go to Container Platform, in the left navigation pane, click Networking > Services.
Click Create Service, and select LoadBalancer for Type.
Expand annotations, and fill in as needed annotations for LoadBalancer type Service .
Click Create.

Related Operations

Test the Correct Installation of AWS CLI and eksctl Tools

Execute the following command. If it returns a list of clusters, AWS CLI is correctly installed.
```
aws eks list-clusters
```
Execute the following command. If it returns a list of clusters, eksctl is correctly installed.
```
eksctl get clusters
```

Get ACCOUNT_ID

Execute the aws sts get-caller-identity command to get the ACCOUNT_ID. The 651168850570 in the displayed information is the ACCOUNT_ID. The displayed information is as follows.

{
"ARN": "arn:aws:iam::651168850570:user/jwshi"
}

Kubeconfig Configuration File

Execute the following command to update the Kubeconfig configuration file for the specified region.
```
aws eks --region <REGION> update-kubeconfig --name <CLUSTER_NAME>
```
Execute the following command to verify whether the Kubeconfig configuration file is correctly configured. If the information is echoed correctly, it means it is configured correctly.
```
kubectl get svc -n cpaas-system
```

Add Tags to Subnets

Execute the following command to get the subnets of the cluster.
```
eksctl get cluster --name <CLUSTER_NAME>
```
Execute the following command to get detailed information about the subnets.
```
aws ec2 describe-subnets
```
Execute the following command to add tags to the subnets. Replace <SubnetID> in the command with the actual subnet ID. Refer to Subnet auto-discovery for details.
- Add the kubernetes.io/role/elb tag to the subnet.
```
aws ec2 create-tags --resources <SubnetID> --tags Key=kubernetes.io/role/elb,Value="1"
```
- Add the kubernetes.io/cluster/<CLUSTER_NAME>: shared tag to the reused subnet.
```
aws ec2 create-tags --resources <SubnetID> --tags Key=<CLUSTER_NAME>,Value="shared"
```

Create Certificate

When using the HTTPS protocol, you need to save HTTPS certificate credentials in the form of a secret dictionary (TLS type) in advance.

Go to Container Platform, click Configuration > Secrets in the left navigation pane.
Click Create Secret.
Choose the TLS type, and import or fill in the Certificates and Private Key as needed.
Click Create.