You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
1. Create HTTPRoutes and Services. The controller should create `DNSEndpoint` resource owned by the HTTPRoute you created.
49
49
1. ExternalDNS will watch the changes and create DNS record on the configured DNS provider.
50
50
51
51
## Notes
52
52
53
-
* You MUST have a registered domain name (e.g. `my-test.com`) in route53 and complete the `Prerequisites` mentioned in [Configure a custom domain name for your service](https://docs.aws.amazon.com/vpc-lattice/latest/ug/service-custom-domain-name.html#dns-associate-custom).
53
+
* You MUST have a registered hosted zone (e.g. `my-test.com`) in route53 and complete the `Prerequisites` mentioned in [Configure a custom domain name for your service](https://docs.aws.amazon.com/vpc-lattice/latest/ug/service-custom-domain-name.html#dns-associate-custom).
54
54
* If you are not using ExternalDNS, you should manually associate your custom domain name with your service following [Configure a custom domain name for your service](https://docs.aws.amazon.com/vpc-lattice/latest/ug/service-custom-domain-name.html#dns-associate-custom).
Copy file name to clipboardExpand all lines: docs/concepts/https.md
+14-13Lines changed: 14 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -53,28 +53,29 @@ If you want to use a custom domain name along with its own certificate, you can:
53
53
* Follow instructions on [Requesting a public certificate](https://docs.aws.amazon.com/acm/latest/userguide/gs-acm-request-public.html) and get an ACM certificate ARN.
54
54
* Add the ARN to the listener configuration as shown below.
55
55
56
-
The following shows modifications to `examples/my-hotel.yaml` to add a custom certificate:
56
+
The following shows modifications to `examples/my-hotel-gateway.yaml` to add a custom certificate:
- name: my-hotel # Use the listener defined above as parentRef
96
+
sectionName: https
96
97
...
97
-
```
98
+
```
98
99
99
100
### Enabling TLS connection on the backend
100
101
101
-
Currently TLS Passthrough mode is not supported in the controller, but it allows TLS re-encryption to support backends that only allow TLS connections.
102
+
Currently, TLS Passthrough mode is not supported in the controller, but it allows TLS re-encryption to support backends that only allow TLS connections.
102
103
To handle this use case, you need to configure your service to receive HTTPS traffic instead:
Copy file name to clipboardExpand all lines: docs/concepts/overview.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -59,7 +59,7 @@ With VPC Lattice you can also avoid some of these common problems:
59
59
As a Kubernetes user, you can have a very Kubernetes-native experience using the VPC Lattice APIs.
60
60
The following figure illustrates how VPC Lattice objects connect to [Kubernetes Gateway API](https://gateway-api.sigs.k8s.io/) objects:
61
61
62
-
62
+
63
63
64
64
As shown in the figure, there are different personas associated with different levels of control in VPC Lattice.
65
65
Notice that the Kubernetes Gateway API syntax is used to create the gateway, HTTPRoute and services, but Kubernetes gets the details of those items from VPC Lattice:
Q: How can I get involved with AWS Gateway API Controller?
4
-
A: We welcome general feedback, questions, feature requests, or bug reports by creating a [Github issue](https://github.com/aws/aws-application-networking-k8s/issues/new).
3
+
***Q: How can I get involved with AWS Gateway API Controller?**
5
4
6
-
Q: Where can I find AWS Gateway API Controller releases?
7
-
A: AWS Gateway API Controller releases are tags of the Github repository. The [Github releases page](https://github.com/aws/aws-application-networking-k8s/releases) shows all the releases.
5
+
A: We welcome general feedback, questions, feature requests, or bug reports by creating a [Github issue](https://github.com/aws/aws-application-networking-k8s/issues/new).
8
6
9
-
Q: Which EKS CNI versions are supported?
10
-
A: Your AWS VPC CNI must be v1.8.0 or later to work with VPC Lattice.
7
+
8
+
***Q: Where can I find AWS Gateway API Controller releases?**
9
+
10
+
A: AWS Gateway API Controller releases are tags of the Github repository. The [Github releases page](https://github.com/aws/aws-application-networking-k8s/releases) shows all the releases.
11
+
12
+
13
+
***Q: Which EKS CNI versions are supported?**
14
+
15
+
A: Your AWS VPC CNI must be v1.8.0 or later to work with VPC Lattice.
16
+
17
+
18
+
***Q: Which versions of Gateway API are supported?**
19
+
20
+
A: AWS Gateway API Controller supports Gateway API CRD bundle versions between v0.6.1 and v1.0.0.
21
+
The controller does not reject other versions, but will provide "best effort support" to it.
22
+
Not all features of Gateway API are supported - for detailed features and limitation, please refer to individual API references.
23
+
24
+
By default, Gateway API v0.6.1 CRD bundle is included in the helm chart.
Copy file name to clipboardExpand all lines: docs/guides/deploy.md
+68-16Lines changed: 68 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,31 +3,36 @@
3
3
Follow these instructions to create a cluster and deploy the AWS Gateway API Controller.
4
4
Run through them again for a second cluster to use with the extended example shown later.
5
5
6
-
**NOTE**: You can get the yaml files used on this page by cloning the [AWS Gateway API Controller for VPC Lattice](https://github.com/aws/aws-application-networking-k8s) site. The files are in the `examples/` directory.
6
+
**NOTE**: You can get the yaml files used on this page by cloning the [AWS Gateway API Controller](https://github.com/aws/aws-application-networking-k8s) repository.
7
+
8
+
## Cluster Setup
9
+
10
+
### Using EKS Cluster
11
+
12
+
EKS is a simple, recommended way of preparing a cluster for running services with AWS Gateway API Controller.
7
13
8
14
1. Set your region and cluster name as environment variables. See the [Amazon VPC Lattice FAQs](https://aws.amazon.com/vpc/lattice/faqs/) for a list of supported regions. For this example, we use `us-west-2`:
9
15
```bash
10
16
export AWS_REGION=us-west-2
11
17
export CLUSTER_NAME=my-cluster
12
18
```
13
-
2. You can use an existing EKS cluster or create a new one as shown here:
19
+
1. You can use an existing EKS cluster or create a new one as shown here:
3. Configure security group to receive traffic from the VPC Lattice network. You must set up security groups so that they allow all Pods communicating with VPC Lattice to allow traffic from the VPC Lattice managed prefix lists. See [Control traffic to resources using security groups](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html) for details. Lattice has both an IPv4 and IPv6 prefix lists available.
18
-
23
+
1. Configure security group to receive traffic from the VPC Lattice network. You must set up security groups so that they allow all Pods communicating with VPC Lattice to allow traffic from the VPC Lattice managed prefix lists. See [Control traffic to resources using security groups](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html) for details. Lattice has both an IPv4 and IPv6 prefix lists available.
3. Create an IAM OIDC provider: See [Creating an IAM OIDC provider for your cluster](https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html) for details.
31
+
1. Create an IAM OIDC provider: See [Creating an IAM OIDC provider for your cluster](https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html) for details.
4. Create a policy (`recommended-inline-policy.json`) in IAM with the following content that can invoke the gateway API and copy the policy arn for later use:
35
+
1. Create a policy (`recommended-inline-policy.json`) in IAM with the following content that can invoke the gateway API and copy the policy arn for later use:
31
36
```bash
32
37
{
33
38
"Version": "2012-10-17",
@@ -57,15 +62,15 @@ Run through them again for a second cluster to use with the extended example sho
5. Create the `aws-application-networking-system` namespace:
65
+
1. Create the `aws-application-networking-system` namespace:
61
66
```bash
62
67
kubectl apply -f examples/deploy-namesystem.yaml
63
68
```
64
-
6. Retrieve the policy ARN:
69
+
1. Retrieve the policy ARN:
65
70
```bash
66
71
export VPCLatticeControllerIAMPolicyArn=$(aws iam list-policies --query 'Policies[?PolicyName==`VPCLatticeControllerIAMPolicy`].Arn' --output text)
67
72
```
68
-
7. Create an iamserviceaccount for pod level permission:
73
+
1. Create an iamserviceaccount for pod level permission:
69
74
```bash
70
75
eksctl create iamserviceaccount \
71
76
--cluster=$CLUSTER_NAME \
@@ -76,7 +81,53 @@ Run through them again for a second cluster to use with the extended example sho
76
81
--region $AWS_REGION \
77
82
--approve
78
83
```
79
-
8. Run either `kubectl` or `helm` to deploy the controller:
84
+
85
+
#### IPv6 support
86
+
87
+
IPv6 address type is automatically used for your services and pods if
88
+
[your cluster is configured to use IPv6 addresses](https://docs.aws.amazon.com/eks/latest/userguide/cni-ipv6.html).
89
+
90
+
```bash
91
+
# To create an IPv6 cluster
92
+
kubectl apply -f examples/ipv6-cluster.yaml
93
+
```
94
+
95
+
If your cluster is configured to be dual-stack, you can set the IP address type
96
+
of your service using the `ipFamilies` field. For example:
97
+
98
+
```yaml
99
+
apiVersion: v1
100
+
kind: Service
101
+
metadata:
102
+
name: ipv4-target-in-dual-stack-cluster
103
+
spec:
104
+
ipFamilies:
105
+
- "IPv4"
106
+
selector:
107
+
app: parking
108
+
ports:
109
+
- protocol: TCP
110
+
port: 80
111
+
targetPort: 8090
112
+
```
113
+
114
+
115
+
### Using a self-managed Kubernetes cluster
116
+
117
+
You can install AWS Gateway API Controller to a self-managed Kubernetes cluster in AWS.
118
+
119
+
The controller utilizes [IMDS](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html) to get necessary information from instance metadata, such as AWS account ID and VPC ID.
120
+
If your cluster is using IMDSv2, ensure the hop limit is 2 or higher to allow the access from the controller:
Alternatively, you can manually provide configuration variables when installing the controller, as described in the next section.
127
+
128
+
## Controller Installation
129
+
130
+
1. Run either `kubectl` or `helm` to deploy the controller. Check [Environment Variables](../concepts/environment.md) for detailed explanation of each configuration option.
80
131
```bash
81
132
kubectl apply -f examples/deploy-v0.0.18.yaml
82
133
```
@@ -89,16 +140,17 @@ Run through them again for a second cluster to use with the extended example sho
# awsRegion, clusterVpcId, clusterName, awsAccountId are required for case where IMDS is NOT AVAILABLE, e.g Fargate, self-managed clusters with IMDS access blocked
143
+
# awsRegion, clusterVpcId, awsAccountId are required for case IMDS is not available.
93
144
--set=awsRegion= \
94
145
--set=clusterVpcId= \
95
-
--set=clusterName= \
96
146
--set=awsAccountId= \
97
-
# latticeEndpoint is required for the case where the VPC Lattice endpoint is being overridden
98
-
--set=latticeEndpoint= \
99
-
147
+
# clusterName is required except for EKS cluster.
148
+
--set=clusterName= \
149
+
# When specified, the controller will automatically create a service network with the name.
150
+
--set=defaultServiceNetwork=my-hotel
100
151
```
101
-
9. Create the `amazon-vpc-lattice` GatewayClass:
152
+
1. Create the `amazon-vpc-lattice` GatewayClass:
102
153
```bash
103
154
kubectl apply -f examples/gatewayclass.yaml
104
155
```
156
+
1. You are all set! Check our [Getting Started Guide](getstarted.md) to try setting up service-to-service communication.
Copy file name to clipboardExpand all lines: docs/guides/getstarted.md
+28-59Lines changed: 28 additions & 59 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,49 +6,46 @@ The first part of this section provides an example of setting up of service-to-s
6
6
The second section extends that example by creating another inventory service on a second cluster on a different VPC, and spreading traffic to that service across the two clusters and VPCs.
7
7
Both clusters are created using `eksctl`, with both clusters created from the same account by the same cluster admin.
8
8
9
-
Using these examples as a foundation, see the [Configuration](configure/index.md) section for ways to further configure service-to-service communications.
9
+
Using these examples as a foundation, see the [Configuration](../concepts/index.md) section for ways to further configure service-to-service communications.
10
10
11
11
12
-
**NOTE**: You can get the yaml files used on this page by cloning the [AWS Gateway API Controller for VPC Lattice](https://github.com/aws/aws-application-networking-k8s)site. The files are in the `examples/` directory.
12
+
**NOTE**: You can get the yaml files used on this page by cloning the [AWS Gateway API Controller](https://github.com/aws/aws-application-networking-k8s)repository.
13
13
14
14
## Set up single-cluster/VPC service-to-service communications
15
15
16
16
This example creates a single cluster in a single VPC, then configures two routes (rates and inventory) and three services (parking, review, and inventory-1). The following figure illustrates this setup:
0 commit comments