The alb module: FAQ

Does the module support receiving TCP traffic?

Yes. The module accepts and routes TCP traffic through the Gateway API using the TCPRoute object.

To publish a TCP service, do the following:

1. Add an additional TCP port to the additionalPorts parameter of the ALBInstance or ClusterALBInstance inlet, specifying protocol: TCP.
2. The gateway controller updates the list of listeners on the managed Gateway object.
3. Create a TCPRoute object that references the backend Service and points directly to the new TCP listener on that Gateway.

For configuration examples, see “Opening an additional TCP/UDP port” in the Administrator guide and “GRPCRoute, TLSRoute, TCPRoute, and UDPRoute objects” in the User guide.

Does the module support receiving UDP traffic?

Yes. The module accepts and routes UDP traffic through the Gateway API using the UDPRoute object.

To publish a UDP service, do the following:

1. Add an additional UDP port to the additionalPorts parameter of the ALBInstance or ClusterALBInstance inlet, specifying protocol: UDP.
2. The gateway controller updates the list of listeners on the managed Gateway object.
3. Create a UDPRoute object that references the backend Service and points directly to the new UDP listener on that Gateway.

A UDPRoute rule may reference only one backend Service.

For configuration examples, see “Opening an additional TCP/UDP port” in the Administrator guide and “GRPCRoute, TLSRoute, TCPRoute, and UDPRoute objects” in the User guide.

How do I configure an external load balancer to check the availability of a ClusterALBInstance or ALBInstance?

If a ClusterALBInstance or ALBInstance is deployed behind a load balancer, configure the load balancer to periodically check the availability of the instance endpoints by sending HTTP requests or TCP packets. Although you can test the endpoints by checking whether the relevant TCP port is open, we recommend using HTTP health checks with the following parameters:

• protocol: HTTP (if Proxy Protocol is enabled, configure the load balancer to use Proxy Protocol for health-check connections as well);
• path: /healthz;
• port: 80 (or the relevant httpPort value when using the HostPort inlet).

How do I add a custom HTTP-01 ClusterIssuer or Issuer for ALB?

If the default ClusterIssuer configured in global settings is letsencrypt or letsencrypt-staging, Deckhouse Kubernetes Platform (DKP) precreates a Gateway-specific ACME ClusterIssuer for the default DKP Gateway.

The ClusterIssuer name is letsencrypt-gateway-<GATEWAY_NAME> for letsencrypt and letsencrypt-staging-gateway-<GATEWAY_NAME> for letsencrypt-staging, where <GATEWAY_NAME> is the gatewayName of the managed Gateway.

This ClusterIssuer uses cert-manager’s Gateway API HTTP-01 solver, which points to the d8-http-default HTTP listener section of the managed Gateway.

If you need a different ACME account, a different ACME endpoint, or a separate issuer for applications, create a solver object using http01.gatewayHTTPRoute.

Example: custom ClusterIssuer for ALB

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: <ISSUER_NAME>
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: <EMAIL>
    privateKeySecretRef:
      name: <ACCOUNT_KEY_SECRET>
    solvers:
      - http01:
          gatewayHTTPRoute:
            parentRefs:
              - group: gateway.networking.k8s.io
                kind: Gateway
                name: <GATEWAY_NAME>
                namespace: <GATEWAY_NAMESPACE>
                sectionName: d8-http-default

where:

• <ISSUER_NAME> — name of the ClusterIssuer;
• <EMAIL> — email address for the ACME account;
• <ACCOUNT_KEY_SECRET> — name of the Secret that stores the ACME account private key;
• <GATEWAY_NAME> — name of the managed Gateway;
• <GATEWAY_NAMESPACE> — namespace of the managed Gateway.

Use it from a dedicated Gateway API certificate:

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: <CERTIFICATE_NAME>
  namespace: <CERTIFICATE_NAMESPACE>
spec:
  secretName: <TLS_SECRET>
  issuerRef:
    kind: ClusterIssuer
    name: <ISSUER_NAME>
  dnsNames:
    - <DNS_NAME>

where:

• <CERTIFICATE_NAME> — name of the Certificate;
• <CERTIFICATE_NAMESPACE> — namespace of the Certificate;
• <TLS_SECRET> — name of the Secret where the issued certificate is stored;
• <ISSUER_NAME> — name of the ClusterIssuer from the previous example;
• <DNS_NAME> — DNS name covered by the certificate.

Example: namespaced Issuer for ALB

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: <ISSUER_NAME>
  namespace: <ISSUER_NAMESPACE>
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: <EMAIL>
    privateKeySecretRef:
      name: <ACCOUNT_KEY_SECRET>
    solvers:
      - http01:
          gatewayHTTPRoute:
            parentRefs:
              - group: gateway.networking.k8s.io
                kind: Gateway
                name: <GATEWAY_NAME>
                namespace: <GATEWAY_NAMESPACE>
                sectionName: d8-http-default

where:

• <ISSUER_NAME> — name of the Issuer;
• <ISSUER_NAMESPACE> — namespace of the Issuer;
• <EMAIL> — email address for the ACME account;
• <ACCOUNT_KEY_SECRET> — name of the Secret that stores the ACME account private key;
• <GATEWAY_NAME> — name of the managed Gateway;
• <GATEWAY_NAMESPACE> — namespace of the managed Gateway.

Use it from a certificate in the same namespace:

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: <CERTIFICATE_NAME>
  namespace: <ISSUER_NAMESPACE>
spec:
  secretName: <TLS_SECRET>
  issuerRef:
    kind: Issuer
    name: <ISSUER_NAME>
  dnsNames:
    - <DNS_NAME>

where:

• <CERTIFICATE_NAME> — name of the Certificate;
• <ISSUER_NAMESPACE> — namespace shared by the Issuer and the Certificate;
• <TLS_SECRET> — name of the Secret where the issued certificate is stored;
• <ISSUER_NAME> — name of the Issuer from the previous example;
• <DNS_NAME> — DNS name covered by the certificate.

In both examples:

• <GATEWAY_NAME> and <GATEWAY_NAMESPACE> in parentRefs must match the managed Gateway object used by ClusterALBInstance or ALBInstance;
• sectionName: d8-http-default places temporary HTTP-01 challenge routes onto the gateway’s built-in HTTP listener;
• Using separate certificate objects for the Gateway API helps avoid conflicts with ingress-nginx HTTP-01 solver resources.