Skip to content

Commit 22fcc22

Browse files
shraddhabangwweiwei-li
shraddhabang
and
wweiwei-li
authored
Release v2.9.2 (#3901)
* Fix controller crash due enabling shield protection after AWS SDK Go v2 upgrades * Skip listener attributes reconcile for Isolated regions (#3884) * cut v2.9.2 release --------- Co-authored-by: wweiwei-li <[email protected]>
1 parent e0f59c6 commit 22fcc22

File tree

12 files changed

+56
-36
lines changed

12 files changed

+56
-36
lines changed

‎Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
MAKEFILE_PATH = $(dir $(realpath -s $(firstword $(MAKEFILE_LIST))))
33

44
# Image URL to use all building/pushing image targets
5-
IMG ?= public.ecr.aws/eks/aws-load-balancer-controller:v2.9.1
5+
IMG ?= public.ecr.aws/eks/aws-load-balancer-controller:v2.9.2
66
# Image URL to use for builder stage in Docker build
77
GOLANG_VERSION ?= $(shell cat .go-version)
88
BUILD_IMAGE ?= public.ecr.aws/docker/library/golang:$(GOLANG_VERSION)

‎config/controller/kustomization.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,4 +9,4 @@ kind: Kustomization
99
images:
1010
- name: controller
1111
newName: public.ecr.aws/eks/aws-load-balancer-controller
12-
newTag: v2.9.1
12+
newTag: v2.9.2

‎docs/deploy/installation.md

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -90,15 +90,15 @@ Example condition for cluster name resource tag:
9090
2. Download an IAM policy for the LBC using one of the following commands:<p>
9191
If your cluster is in a US Gov Cloud region:
9292
```
93-
curl -o iam-policy.json https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.9.1/docs/install/iam_policy_us-gov.json
93+
curl -o iam-policy.json https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.9.2/docs/install/iam_policy_us-gov.json
9494
```
9595
If your cluster is in a China region:
9696
```
97-
curl -o iam-policy.json https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.9.1/docs/install/iam_policy_cn.json
97+
curl -o iam-policy.json https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.9.2/docs/install/iam_policy_cn.json
9898
```
9999
If your cluster is in any other region:
100100
```
101-
curl -o iam-policy.json https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.9.1/docs/install/iam_policy.json
101+
curl -o iam-policy.json https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.9.2/docs/install/iam_policy.json
102102
```
103103
104104
3. Create an IAM policy named `AWSLoadBalancerControllerIAMPolicy`. If you downloaded a different policy, replace `iam-policy` with the name of the policy that you downloaded.
@@ -124,7 +124,7 @@ Example condition for cluster name resource tag:
124124
### Option B: Attach IAM policies to nodes
125125
If you're not setting up IAM roles for service accounts, apply the IAM policies from the following URL at a minimum. Please be aware of the possibility that the controller permissions may be assumed by other users in a pod after retrieving the node role credentials, so the best practice would be using IRSA instead of attaching IAM policy directly.
126126
```
127-
curl -o iam-policy.json https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.9.1/docs/install/iam_policy.json
127+
curl -o iam-policy.json https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.9.2/docs/install/iam_policy.json
128128
```
129129
130130
The following IAM permissions subset is for those using `TargetGroupBinding` only and don't plan to use the LBC to manage security group rules:
@@ -209,7 +209,7 @@ We recommend using the Helm chart to install the controller. The chart supports
209209
### Apply YAML
210210
1. Download the spec for the LBC.
211211
```
212-
wget https://github.com/kubernetes-sigs/aws-load-balancer-controller/releases/download/v2.9.1/v2_9_1_full.yaml
212+
wget https://github.com/kubernetes-sigs/aws-load-balancer-controller/releases/download/v2.9.2/v2_9_2_full.yaml
213213
```
214214
2. Edit the saved yaml file, go to the Deployment spec, and set the controller `--cluster-name` arg value to your EKS cluster name
215215
```
@@ -233,15 +233,15 @@ We recommend using the Helm chart to install the controller. The chart supports
233233
```
234234
4. Apply the yaml file
235235
```
236-
kubectl apply -f v2_9_1_full.yaml
236+
kubectl apply -f v2_9_2_full.yaml
237237
```
238238
5. Optionally download the default ingressclass and ingressclass params
239239
```
240-
wget https://github.com/kubernetes-sigs/aws-load-balancer-controller/releases/download/v2.9.1/v2_9_1_ingclass.yaml
240+
wget https://github.com/kubernetes-sigs/aws-load-balancer-controller/releases/download/v2.9.2/v2_9_2_ingclass.yaml
241241
```
242242
6. Apply the ingressclass and params
243243
```
244-
kubectl apply -f v2_9_1_ingclass.yaml
244+
kubectl apply -f v2_9_2_ingclass.yaml
245245
```
246246
247247
## Create Update Strategy

‎docs/examples/echo_server.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -87,9 +87,9 @@ In this walkthrough, you'll
8787
1. Deploy all the echoserver resources (namespace, service, deployment)
8888

8989
```bash
90-
kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.9.1/docs/examples/echoservice/echoserver-namespace.yaml &&\
91-
kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.9.1/docs/examples/echoservice/echoserver-service.yaml &&\
92-
kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.9.1/docs/examples/echoservice/echoserver-deployment.yaml
90+
kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.9.2/docs/examples/echoservice/echoserver-namespace.yaml &&\
91+
kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.9.2/docs/examples/echoservice/echoserver-service.yaml &&\
92+
kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.9.2/docs/examples/echoservice/echoserver-deployment.yaml
9393
```
9494

9595
1. List all the resources to ensure they were created.
@@ -113,7 +113,7 @@ In this walkthrough, you'll
113113
1. Download the echoserver ingress manifest locally.
114114

115115
```bash
116-
wget https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.9.1/docs/examples/echoservice/echoserver-ingress.yaml
116+
wget https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.9.2/docs/examples/echoservice/echoserver-ingress.yaml
117117
```
118118

119119
1. Configure the subnets, either by add annotation to the ingress or add tags to subnets. This step is optional in lieu of auto-discovery.
@@ -300,7 +300,7 @@ You should get back a valid response.
300300
follow below steps if you want to use kube2iam to provide the AWS credentials
301301

302302
1. configure the proper policy
303-
The policy to be used can be fetched from https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.9.1/docs/install/iam_policy.json
303+
The policy to be used can be fetched from https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.9.2/docs/install/iam_policy.json
304304

305305
1. configure the proper role and create the trust relationship
306306
You have to find which role is associated with your K8S nodes. Once you found take note of the full arn:

‎helm/aws-load-balancer-controller/Chart.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
apiVersion: v2
22
name: aws-load-balancer-controller
33
description: AWS Load Balancer Controller Helm chart for Kubernetes
4-
version: 1.9.1
5-
appVersion: v2.9.1
4+
version: 1.9.2
5+
appVersion: v2.9.2
66
home: https://github.com/aws/eks-charts
77
icon: https://raw.githubusercontent.com/aws/eks-charts/master/docs/logo/aws.png
88
sources:

‎helm/aws-load-balancer-controller/test.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ replicaCount: 2
66

77
image:
88
repository: public.ecr.aws/eks/aws-load-balancer-controller
9-
tag: v2.9.1
9+
tag: v2.9.2
1010
pullPolicy: IfNotPresent
1111

1212
imagePullSecrets: []

‎helm/aws-load-balancer-controller/values.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ revisionHistoryLimit: 10
88

99
image:
1010
repository: public.ecr.aws/eks/aws-load-balancer-controller
11-
tag: v2.9.1
11+
tag: v2.9.2
1212
pullPolicy: IfNotPresent
1313

1414
runtimeClassName: ""

‎pkg/deploy/elbv2/listener_manager.go

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package elbv2
33
import (
44
"context"
55
"reflect"
6+
"strings"
67
"time"
78

89
awssdk "github.com/aws/aws-sdk-go-v2/aws"
@@ -101,7 +102,8 @@ func (m *defaultListenerManager) Create(ctx context.Context, resLS *elbv2model.L
101102
}); err != nil {
102103
return elbv2model.ListenerStatus{}, errors.Wrap(err, "failed to update extra certificates on listener")
103104
}
104-
if areListenerAttributesSupported(resLS.Spec.Protocol) {
105+
listenerARN := awssdk.ToString(sdkLS.Listener.ListenerArn)
106+
if !isIsolatedRegion(getRegionFromARN(listenerARN)) && areListenerAttributesSupported(resLS.Spec.Protocol) {
105107
if err := m.attributesReconciler.Reconcile(ctx, resLS, sdkLS); err != nil {
106108
return elbv2model.ListenerStatus{}, err
107109
}
@@ -121,7 +123,8 @@ func (m *defaultListenerManager) Update(ctx context.Context, resLS *elbv2model.L
121123
if err := m.updateSDKListenerWithExtraCertificates(ctx, resLS, sdkLS, false); err != nil {
122124
return elbv2model.ListenerStatus{}, err
123125
}
124-
if areListenerAttributesSupported(resLS.Spec.Protocol) {
126+
listenerARN := awssdk.ToString(sdkLS.Listener.ListenerArn)
127+
if !isIsolatedRegion(getRegionFromARN(listenerARN)) && areListenerAttributesSupported(resLS.Spec.Protocol) {
125128
if err := m.attributesReconciler.Reconcile(ctx, resLS, sdkLS); err != nil {
126129
return elbv2model.ListenerStatus{}, err
127130
}
@@ -379,3 +382,17 @@ func areListenerAttributesSupported(protocol elbv2model.Protocol) bool {
379382
supported, exists := PROTOCOLS_SUPPORTING_LISTENER_ATTRIBUTES[protocol]
380383
return exists && supported
381384
}
385+
386+
func getRegionFromARN(arn string) string {
387+
if strings.HasPrefix(arn, "arn:") {
388+
arnElements := strings.Split(arn, ":")
389+
if len(arnElements) > 3 {
390+
return arnElements[3]
391+
}
392+
}
393+
return ""
394+
}
395+
396+
func isIsolatedRegion(region string) bool {
397+
return strings.Contains(strings.ToLower(region), "-iso-")
398+
}

‎pkg/deploy/shield/protection_manager.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,7 @@ func (m *defaultProtectionManager) GetProtection(ctx context.Context, resourceAR
125125
return nil, err
126126
}
127127
}
128-
if resp.Protection != nil {
128+
if resp != nil && resp.Protection != nil {
129129
protectionInfo = &ProtectionInfo{
130130
Name: awssdk.ToString(resp.Protection.Name),
131131
ID: awssdk.ToString(resp.Protection.Id),

‎test/e2e/service/nlb_instance_target_test.go

Lines changed: 15 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -160,20 +160,23 @@ var _ = Describe("test k8s service reconciled by the aws load balancer controlle
160160
})
161161
Expect(err).NotTo(HaveOccurred())
162162
})
163-
By("modifying listener attributes", func() {
164-
err := stack.UpdateServiceAnnotations(ctx, tf, map[string]string{
165-
"service.beta.kubernetes.io/aws-load-balancer-listener-attributes.TCP-80": "tcp.idle_timeout.seconds=400",
166-
})
167-
Expect(err).NotTo(HaveOccurred())
163+
// remove this once listener attributes are available in isolated region
164+
if !strings.Contains(tf.Options.AWSRegion, "-iso-") {
165+
By("modifying listener attributes", func() {
166+
err := stack.UpdateServiceAnnotations(ctx, tf, map[string]string{
167+
"service.beta.kubernetes.io/aws-load-balancer-listener-attributes.TCP-80": "tcp.idle_timeout.seconds=400",
168+
})
169+
Expect(err).NotTo(HaveOccurred())
168170

169-
lsARN := getLoadBalancerListenerARN(ctx, tf, lbARN, "80")
171+
lsARN := getLoadBalancerListenerARN(ctx, tf, lbARN, "80")
170172

171-
Eventually(func() bool {
172-
return verifyListenerAttributes(ctx, tf, lsARN, map[string]string{
173-
"tcp.idle_timeout.seconds": "400",
174-
}) == nil
175-
}, utils.PollTimeoutShort, utils.PollIntervalMedium).Should(BeTrue())
176-
})
173+
Eventually(func() bool {
174+
return verifyListenerAttributes(ctx, tf, lsARN, map[string]string{
175+
"tcp.idle_timeout.seconds": "400",
176+
}) == nil
177+
}, utils.PollTimeoutShort, utils.PollIntervalMedium).Should(BeTrue())
178+
})
179+
}
177180
})
178181
It("should provision internal load-balancer resources", func() {
179182
By("deploying stack", func() {

0 commit comments

Comments
 (0)