monder/service-target-group

!https://img.shields.io/docker/build/monder/service-target-group.svg https://goreportcard.com/badge/github.com/monder/service-target-group](https://goreportcard.com/report/github.com/monder/service-target-group) !https://img.shields.io/microbadger/image-size/monder/service-target-group/latest.svg !https://img.shields.io/github/license/monder/service-target-group.svg

Kubernetes控制器，用于将服务端点注册到AWS目标组

概述

本项目是内置Load***和aws-alb-ingress-controller的替代方案。与 ingress 控制器的主要区别在于它不创建任何新的AWS资源，在将基础设施迁移到Kubernetes时，可复用其他地方管理的现有负载均衡器，非常实用。

核心功能

• 自动将Kubernetes服务的就绪端点注册到指定的AWS目标组
• 当Pod被移除时，自动从目标组中注销对应的端点
• 支持复用已有的AWS负载均衡器，无需创建新资源

使用场景

• 迁移现有基础设施到Kubernetes时，希望保留已有的AWS负载均衡器
• 需要将Kubernetes服务的端点与AWS目标组关联，实现流量分发

配置说明

前提条件

1. 已配置好的AWS ALB及目标组
2. Pod需在VPC内具有可路由的IP地址（可通过vpc-cni插件实现）
3. AWS目标组类型必须为ip（参考：https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-***-target-groups.html#target-type%EF%BC%89

Service配置示例

通过注解指定目标组ARN：

yaml
kind: Service
apiVersion: v1
metadata:
  name: foo
  annotations:
    stg.monder.cc/target-group: arn:aws:elasticloadbalancing:eu-west-1:000000000000:targetgroup/foo/bar
spec:
  clusterIP: None
  selector:
    name: foo
  ports:
  - protocol: TCP
    port: 3000
    targetPort: 3000

控制器部署

IAM策略要求

控制器需要以下IAM权限：

json
{
    "Effect": "Allow",
    "Action": [
        "elasticloadbalancing:DescribeTargetHealth",
        "elasticloadbalancing:RegisterTargets",
        "elasticloadbalancing:DeregisterTargets"
    ],
    "Resource": "*"
}

部署YAML

yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: stg-controller
spec:
  selector:
    matchLabels:
      name: stg-controller
  replicas: 1
  template:
    metadata:
      annotations:
        iam.amazonaws.com/role: stg_controller
      labels:
        name: stg-controller
    spec:
      serviceAccountName: stg-controller
      containers:
      - name: stg-controller
        image: docker.xuanyuan.run/monder/service-target-group:latest
        args:
        - -namespaces=default,public
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: stg-controller
rules:
- apiGroups: [""]
  resources: ["services", "endpoints"]
  verbs: ["get", "watch", "list"]
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: stg-controller
  namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: stg-controller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: stg-controller
subjects:
- kind: ServiceAccount
  name: stg-controller
  namespace: default

待办事项

• 当Kubernetes服务销毁时，注销该服务对应的所有目标端点