Skip to content

Commit c74be9a

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #4448 from zac-nixon/znixon/quci3
Add support QUIC Passthrough for NLB
2 parents 8cd1f0b + 713990a commit c74be9a

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

50 files changed

+1824
-181
lines changed

‎apis/elbv2/v1beta1/targetgroupbinding_types.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -142,7 +142,7 @@ type TargetGroupBindingSpec struct {
142142

143143
// targetGroupProtocol is the Protocol of the TargetGroup. If unspecified, it will be automatically inferred.
144144
// +optional
145-
// +kubebuilder:validation:Enum=HTTP;HTTPS;TCP;TLS;UDP;TCP_UDP
145+
// +kubebuilder:validation:Enum=HTTP;HTTPS;TCP;TLS;UDP;TCP_UDP;QUIC;TCP_QUIC
146146
TargetGroupProtocol *elbv2.Protocol `json:"targetGroupProtocol,omitempty"`
147147

148148
// serviceRef is a reference to a Kubernetes Service and ServicePort.

‎apis/gateway/v1beta1/targetgroupconfig_types.go‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -121,12 +121,14 @@ const (
121121
type Protocol string
122122

123123
const (
124-
ProtocolHTTP Protocol = "HTTP"
125-
ProtocolHTTPS Protocol = "HTTPS"
126-
ProtocolTCP Protocol = "TCP"
127-
ProtocolTLS Protocol = "TLS"
128-
ProtocolUDP Protocol = "UDP"
129-
ProtocolTCP_UDP Protocol = "TCP_UDP"
124+
ProtocolHTTP Protocol = "HTTP"
125+
ProtocolHTTPS Protocol = "HTTPS"
126+
ProtocolTCP Protocol = "TCP"
127+
ProtocolTLS Protocol = "TLS"
128+
ProtocolUDP Protocol = "UDP"
129+
ProtocolTCP_UDP Protocol = "TCP_UDP"
130+
ProtocolQUIC Protocol = "QUIC"
131+
ProtocolTCP_QUIC Protocol = "TCP_QUIC"
130132
)
131133

132134
// +kubebuilder:validation:Enum=HTTP1;HTTP2;GRPC

‎config/crd/bases/elbv2.k8s.aws_targetgroupbindings.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -431,6 +431,8 @@ spec:
431431
- TLS
432432
- UDP
433433
- TCP_UDP
434+
- QUIC
435+
- TCP_QUIC
434436
type: string
435437
targetType:
436438
description: targetType is the TargetType of TargetGroup. If unspecified,

‎config/webhook/manifests.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,25 @@ webhooks:
4242
resources:
4343
- services
4444
sideEffects: None
45+
- admissionReviewVersions:
46+
- v1beta1
47+
clientConfig:
48+
service:
49+
name: webhook-service
50+
namespace: system
51+
path: /mutate-v1-pod-server-id
52+
failurePolicy: Fail
53+
name: quicid.elbv2.k8s.aws
54+
rules:
55+
- apiGroups:
56+
- ""
57+
apiVersions:
58+
- v1
59+
operations:
60+
- CREATE
61+
resources:
62+
- pods
63+
sideEffects: None
4564
- admissionReviewVersions:
4665
- v1beta1
4766
clientConfig:

‎config/webhook/pod_mutator_patch.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,3 +16,16 @@ webhooks:
1616
operator: NotIn
1717
values:
1818
- aws-load-balancer-controller
19+
- name: quicid.elbv2.k8s.aws
20+
namespaceSelector:
21+
matchExpressions:
22+
- key: elbv2.k8s.aws/quic-server-id-inject
23+
operator: In
24+
values:
25+
- enabled
26+
objectSelector:
27+
matchExpressions:
28+
- key: app.kubernetes.io/name
29+
operator: NotIn
30+
values:
31+
- aws-load-balancer-controller

‎docs/deploy/configurations.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
This document primarily covers the runtime configuration options for the AWS Load Balancer Controller. For installation-specific configuration options, see the [Helm chart values documentation](https://github.com/aws/eks-charts/tree/master/stable/aws-load-balancer-controller#configuration).
33

44
!!!warning "limitation"
5-
The v2.0.0+ version of AWSLoadBalancerController currently only support one controller deployment(with one or multiple replicas) per cluster.
5+
The v2.0.0+ version of AWSLoadBalancerController currently only support one controller deployment(with one or multiple replicas) per cluster.
66

77
The AWSLoadBalancerController assumes it's the solo owner of worker node security group rules with `elbv2.k8s.aws/targetGroupBinding=shared` description, running multiple controller deployment will cause these controllers compete with each other updating worker node security group rules.
88

@@ -62,7 +62,7 @@ Currently, you can set only 1 namespace to watch in this flag. See [this Kuberne
6262
## Controller command line flags
6363
6464
!!!warning ""
65-
The --cluster-name flag is mandatory and the value must match the name of the kubernetes cluster. If you specify an incorrect name, the subnet auto-discovery will not work.
65+
The --cluster-name flag is mandatory and the value must match the name of the kubernetes cluster. If you specify an incorrect name, the subnet auto-discovery will not work.
6666
6767
| Flag | Type | Default | Description |
6868
|---------------------------------------------------------------------------------|---------------------------------|--------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|

‎docs/guide/service/annotations.md‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,9 @@
6565
| [service.beta.kubernetes.io/aws-load-balancer-minimum-load-balancer-capacity](#load-balancer-capacity-reservation) | stringMap | |
6666
| [service.beta.kubernetes.io/aws-load-balancer-enable-icmp-for-path-mtu-discovery](#icmp-path-mtu-discovery) | string | | If specified, a security group rule is added to the managed security group to allow explicit ICMP traffic for [Path MTU discovery](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/network_mtu.html#path_mtu_discovery) for IPv4 and dual-stack VPCs. Creates a rule for each source range if `service.beta.kubernetes.io/load-balancer-source-ranges` is present. |
6767
| [service.beta.kubernetes.io/aws-load-balancer-enable-tcp-udp-listener](#tcp-udp-listener) | boolean | false | If specified, the controller will attempt to try TCP_UDP Listeners when the service defines a TCP and UDP port on the same port number. |
68-
| [service.beta.kubernetes.io/aws-load-balancer-disable-nlb-sg](#nlb-sg-disable) | boolean | false | If specified, the controller will not create or manage Security Groups for the service. |
68+
| [service.beta.kubernetes.io/aws-load-balancer-disable-nlb-sg](#nlb-sg-disable) | boolean | false | If specified, the controller will not create or manage Security Groups for the service. |
69+
| [service.beta.kubernetes.io/aws-load-balancer-quic-enabled-ports](#nlb-quic-enabled) | stringList | | If specified, the controller will upgrade each port specified from UDP to QUIC or TCP_UDP to TCP_QUIC. |
70+
6971

7072
## Traffic Routing
7173
Traffic Routing can be controlled with following annotations:
@@ -367,7 +369,19 @@ for proxy protocol v2 configuration.
367369
```
368370
service.beta.kubernetes.io/aws-load-balancer-disable-nlb-sg: "true"
369371
```
372+
373+
- <a name="nlb-quic-enabled">`service.beta.kubernetes.io/aws-load-balancer-quic-enabled-ports`</a> Upgrades the UDP protocol to QUIC.
370374
375+
!!!warning ""
376+
This annotation only applies to UDP ports. The annotation is ignored when the specified port is NOT UDP based.
377+
378+
!!!note ""
379+
Ensure that the pods belonging to the service have been QUIC enabled. See [QUIC use-case](../use_cases/quic/index.md) for more information.
380+
381+
!!!example
382+
```
383+
service.beta.kubernetes.io/aws-load-balancer-quic-enabled-ports: "443"
384+
```
371385
372386
- <a name="deprecated-attributes"></a>the following annotations are deprecated in v2.3.0 release in favor of [service.beta.kubernetes.io/aws-load-balancer-attributes](#load-balancer-attributes)
373387

0 commit comments

Comments
 (0)