WIP: Add ALB Ingress Support

charts/internal/seed-controlplane/charts/stackit-application-load-balancer-controller/Chart.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+description: Helm chart for STACKIT stackit-application-load-balancer-controller
+name: stackit-application-load-balancer-controller
+version: 0.1.0

charts/internal/seed-controlplane/charts/stackit-application-load-balancer-controller/templates/configmap.yaml

@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: stackit-application-load-balancer-controller
+  namespace: {{ .Release.Namespace }}
+data:
+  cloud.yaml: |-
+    global:
+      region: {{ .Values.config.global.region }}
+      projectId: {{ .Values.config.global.projectId }}
+      {{- with .Values.config.global.apiEndpoints }}
+      apiEndpoints:
+        {{- if .applicationLoadBalancerApi }}
+        applicationLoadBalancerApi: {{ .applicationLoadBalancerApi }}
+        {{- end }}
+        {{- if .applicationLoadBalancerCertificateApi }}
+        applicationLoadBalancerCertificateApi: {{ .applicationLoadBalancerCertificateApi }}
+        {{- end }}
+      {{- end }}
+    applicationLoadBalancer:
+      networkId: {{ .Values.config.applicationLoadBalancer.networkId }}

charts/internal/seed-controlplane/charts/stackit-application-load-balancer-controller/templates/poddisruptionbudget.yaml

@@ -0,0 +1,15 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: stackit-application-load-balancer-controller
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: kubernetes
+    role: stackit-application-load-balancer-controller
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app: kubernetes
+      role: stackit-application-load-balancer-controller
+  unhealthyPodEvictionPolicy: AlwaysAllow

charts/internal/seed-controlplane/charts/stackit-alb-controller-manager/templates/alb-controller-manager.yaml → charts/internal/seed-controlplane/charts/stackit-application-load-balancer-controller/templates/stackit-application-load-balancer-controller.yaml

@@ -1,19 +1,19 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: stackit-alb-controller-manager
+  name: stackit-application-load-balancer-controller
   namespace: {{ .Release.Namespace }}
   labels:
     app: kubernetes
-    role: stackit-alb-controller-manager
+    role: stackit-application-load-balancer-controller
     high-availability-config.resources.gardener.cloud/type: controller
 spec:
   replicas: {{ .Values.replicas }}
   revisionHistoryLimit: 1
   selector:
     matchLabels:
       app: kubernetes
-      role: stackit-alb-controller-manager
+      role: stackit-application-load-balancer-controller
   template:
     metadata:
 {{- if .Values.podAnnotations }}
@@ -23,7 +23,7 @@ spec:
       labels:
         gardener.cloud/role: controlplane
         app: kubernetes
-        role: stackit-alb-controller-manager
+        role: stackit-application-load-balancer-controller
         networking.gardener.cloud/to-dns: allowed
         networking.gardener.cloud/to-public-networks: allowed
         networking.gardener.cloud/to-private-networks: allowed
@@ -36,35 +36,26 @@ spec:
       automountServiceAccountToken: false
       priorityClassName: gardener-system-300
       containers:
-      - name: stackit-alb-controller-manager
-        image: {{ index .Values.images "stackit-alb-controller-manager" }}
+      - name: stackit-application-load-balancer-controller
+        image: {{ index .Values.images "stackit-application-load-balancer-controller" }}
         args:
         - --kubeconfig=/var/run/secrets/gardener.cloud/shoot/generic-kubeconfig/kubeconfig
         - --leader-elect=true
+        - --metrics-bind-address=":{{ .Values.config.metricsPort }}"
         - --leader-election-namespace=kube-system
-        - --leader-election-id=stackit-alb-controller-manager
+        - --leader-election-id=stackit-application-load-balancer-controller
+        - --cloud-config=/etc/config/cloud.yaml
         env:
         - name: STACKIT_SERVICE_ACCOUNT_KEY_PATH
           value: /etc/serviceaccount/serviceaccount.json
-        - name: STACKIT_REGION
-          value: {{ .Values.config.region }}
-        - name: PROJECT_ID
-          value: {{ .Values.config.stackitProjectID }}
-        - name: NETWORK_ID
-          value: {{ .Values.config.stackitNetworkID }}
-
-{{- if .Values.config.tokenUrl }}
+{{- if .Values.tokenEndpoint }}
         - name: STACKIT_TOKEN_BASEURL
-          value: {{ .Values.config.tokenUrl }}
-{{- end }}
-{{- if .Values.config.applicationLBApiUrl }}
-        - name: STACKIT_LOAD_BALANCER_API_ALB_URL
-          value: {{ .Values.config.applicationLBApiUrl }}
-{{- end }}
-{{- if .Values.config.certificateApiUrl }}
-        - name: STACKIT_LOAD_BALANCER_API_CERT_URL
-          value: {{ .Values.config.certificateApiUrl }}
+          value: {{ .Values.tokenEndpoint }}
 {{- end }}
+        ports:
+        - containerPort: {{ .Values.metricsPort }}
+          name: metrics
+          protocol: TCP
 {{- if .Values.resources }}
         resources:
 {{ toYaml .Values.resources | indent 10 }}
@@ -73,13 +64,19 @@ spec:
         - mountPath: /var/run/secrets/gardener.cloud/shoot/generic-kubeconfig
           name: kubeconfig
           readOnly: true
+        - mountPath: /etc/config
+          name: config-volume
         - mountPath: /etc/serviceaccount
           name: sa-secret
         - mountPath: /etc/ssl/certs/keystone-ca.crt
           name: cloud-config-ca
           subPath: keystone-ca.crt
           readOnly: true
       volumes:
+      - name: config-volume
+        configMap:
+          defaultMode: 420
+          name: stackit-application-load-balancer-controller
       - name: sa-secret
         secret:
           defaultMode: 420

charts/internal/seed-controlplane/charts/stackit-alb-controller-manager/templates/vpa.yaml → charts/internal/seed-controlplane/charts/stackit-application-load-balancer-controller/templates/vpa.yaml

@@ -1,18 +1,18 @@
 apiVersion: autoscaling.k8s.io/v1
 kind: VerticalPodAutoscaler
 metadata:
-  name: stackit-alb-controller-manager-vpa
+  name: stackit-application-load-balancer-controller
   namespace: {{ .Release.Namespace }}
 spec:
   targetRef:
     apiVersion: apps/v1
     kind: Deployment
-    name: stackit-alb-controller-manager
+    name: stackit-application-load-balancer-controller
   updatePolicy:
     updateMode: Auto
   resourcePolicy:
     containerPolicies:
-    - containerName: stackit-alb-controller-manager
+    - containerName: stackit-application-load-balancer-controller
       minAllowed:
         memory: 80M
       maxAllowed:

charts/internal/seed-controlplane/charts/stackit-application-load-balancer-controller/values.yaml

@@ -0,0 +1,21 @@
+replicas: 1
+config:
+  global:
+    region: ""
+    projectId: ""
+    # apiEndpoints:
+    #  applicationLoadBalancerApi: "foo"
+    #  applicationLoadBalancerCertificateApi: "foo"
+  applicationLoadBalancer:
+    networkId: ""
+#tokenEndpoint: "foo"
+metricsPort: 9090
+podAnnotations: {}
+podLabels: {}
+images:
+  stackit-alb-controller-manager: image:tag
+vpa:
+  resourcePolicy:
+    maxAllowed:
+      cpu: 1
+      memory: 512Mi

charts/internal/seed-controlplane/values.yaml

@@ -6,7 +6,7 @@ stackit-cloud-controller-manager:
   enabled: false
 csi-driver-controller:
   enabled: true
-stackit-alb-controller-manager:
+stackit-application-load-balancer-controller:
   enabled: false
 stackit-pod-identity-webhook:
-  enabled: false
+  enabled: false

cmd/gardener-extension-provider-stackit/app/app.go

@@ -190,11 +190,11 @@ func NewControllerManagerCommand(ctx context.Context) *cobra.Command {
 			configFileOpts.Completed().ApplyETCDStorage(&stackitseedprovider.DefaultAddOptions.ETCDStorage)
 			configFileOpts.Completed().ApplyHealthCheckConfig(&healthcheck.DefaultAddOptions.HealthCheckConfig)
 			configFileOpts.Completed().ApplyRegistryCaches(&stackitwebhookcontrolplane.DefaultAddOptions.RegistryCaches)
-			configFileOpts.Completed().ApplyDeployALBIngressController(&stackitcontrolplane.DeployALBIngressController)
+			configFileOpts.Completed().ApplyAllowApplicationLoadBalancerController(&stackitcontrolplane.DefaultAddOptions.AllowApplicationLoadBalancerController)
+			configFileOpts.Completed().ApplyAllowApplicationLoadBalancerController(&healthcheck.DefaultAddOptions.AllowApplicationLoadBalancerController)
 			configFileOpts.Completed().ApplyCustomLabelDomain(&stackitworker.DefaultAddOptions.CustomLabelDomain)
 			configFileOpts.Completed().ApplyCustomLabelDomain(&stackitcontrolplane.DefaultAddOptions.CustomLabelDomain)
 			configFileOpts.Completed().ApplyCustomLabelDomain(&infrastructure.DefaultAddOptions.CustomLabelDomain)
-			log.Info("DeployALBIngressController?", "deploy", configFileOpts.Completed().Config.DeployALBIngressController)
 
 			bastionCtrlOpts.Completed().Apply(&stackitbastion.DefaultAddOptions.Controller)
 			configFileOpts.Completed().ApplyCustomLabelDomain(&stackitbastion.DefaultAddOptions.CustomLabelDomain)

hack/api-reference/api.md

@@ -81,14 +81,14 @@ string
 </tr>
 <tr>
 <td>
-<code>loadbalancerCertificate</code></br>
+<code>applicationLoadBalancerCertificate</code></br>
 <em>
 string
 </em>
 </td>
 <td>
 <em>(Optional)</em>
-<p>LoadbalancerCertificate is the Endpoint of the LoadBalancerCertificate API.</p>
+<p>ApplicationLoadBalancerCertificate is the Endpoint of the ApplicationLoadBalancerCertificate API.</p>
 </td>
 </tr>
 <tr>
@@ -155,7 +155,57 @@ string array
 </p>
 
 <p>
+ApplicationLoadBalancerConfig defines the configuration for the
+Application Load Balancer (ALB) integration.
+</p>
 
+<table>
+<thead>
+<tr>
+<th>Field</th>
+<th>Description</th>
+</tr>
+</thead>
+<tbody>
+
+<tr>
+<td>
+<code>enabled</code></br>
+<em>
+boolean
+</em>
+</td>
+<td>
+<p>Enabled specifies whether the Application Load Balancer is activated.</p>
+</td>
+</tr>
+<tr>
+<td>
+<code>ingress</code></br>
+<em>
+<a href="#applicationloadbalancerconfigingress">ApplicationLoadBalancerConfigIngress</a>
+</em>
+</td>
+<td>
+<p>Ingress contains the configuration specific to the ALB's Ingress controller.</p>
+</td>
+</tr>
+
+</tbody>
+</table>
+
+
+<h3 id="applicationloadbalancerconfigingress">ApplicationLoadBalancerConfigIngress
+</h3>
+
+
+<p>
+(<em>Appears on:</em><a href="#applicationloadbalancerconfig">ApplicationLoadBalancerConfig</a>)
+</p>
+
+<p>
+ApplicationLoadBalancerConfigIngress defines the settings for the
+Application Load Balancer Ingress resources.
 </p>
 
 <table>
@@ -175,7 +225,7 @@ boolean
 </em>
 </td>
 <td>
-<p></p>
+<p>Enabled specifies whether the Ingress controller functionality<br />for the ALB is activated to manage external access to services.</p>
 </td>
 </tr>
 

hack/api-reference/config.md

@@ -76,13 +76,14 @@ ControllerConfiguration defines the configuration for the STACKIT provider.
 </tr>
 <tr>
 <td>
-<code>deployALBIngressController</code></br>
+<code>allowApplicationLoadBalancerController</code></br>
 <em>
 boolean
 </em>
 </td>
 <td>
-<p>DeployALBIngressController</p>
+<em>(Optional)</em>
+<p>AllowApplicationLoadBalancerController specifies whether the application load balancer controller can<br />be enabled in the ControlPlane configuration of the Shoot cluster.</p>
 </td>
 </tr>
 <tr>

imagevector/images.yaml

@@ -132,9 +132,11 @@ images:
   repository: registry.k8s.io/sig-storage/livenessprobe
   tag: "v2.18.0"
 
-- name: stackit-alb-controller-manager
-  repository: reg3.infra.ske.eu01.stackit.cloud/temp/alb-controller-manager
-  tag: "1245"
+- name: stackit-application-load-balancer-controller
+  sourceRepository: github.com/stackitcloud/application-load-balancer-controller
+  repository: ghcr.io/stackitcloud/application-load-balancer-controller-dev
+  tag: "albc"
+
 - name: stackit-pod-identity-webhook
   sourceRepository: github.com/stackitcloud/stackit-pod-identity-webhook
   repository: ghcr.io/stackitcloud/stackit-pod-identity-webhook

pkg/apis/config/types.go

@@ -31,8 +31,9 @@ type ControllerConfiguration struct {
 	// Deprecated: will be removed in a future version
 	RegistryCaches []RegistryCacheConfiguration
 
-	// DeployALBIngressController
-	DeployALBIngressController bool
+	// AllowApplicationLoadBalancerController specifies whether the application load balancer controller can
+	// be enabled in the ControlPlane configuration of the Shoot cluster.
+	AllowApplicationLoadBalancerController bool
 
 	// CustomLabelDomain is the domain prefix for custom labels applied to STACKIT infrastructure resources.
 	// For example, cluster labels will use "<domain>/cluster" (default: "kubernetes.io").

pkg/apis/config/v1alpha1/types.go

@@ -33,8 +33,10 @@ type ControllerConfiguration struct {
 	// +optional
 	RegistryCaches []RegistryCacheConfiguration `json:"registryCaches,omitempty"`
 
-	// DeployALBIngressController
-	DeployALBIngressController bool `json:"deployALBIngressController"`
+	// AllowApplicationLoadBalancerController specifies whether the application load balancer controller can
+	// be enabled in the ControlPlane configuration of the Shoot cluster.
+	// +optional
+	AllowApplicationLoadBalancerController bool `json:"allowApplicationLoadBalancerController,omitempty"`
 
 	// CustomLabelDomain is the domain prefix for custom labels applied to STACKIT infrastructure resources.
 	// For example, cluster labels will use "<domain>/cluster" (default: "kubernetes.io").