kubernetes-sigs / kubernetes-sigs/aws-load-balancer-controller

[GatewayAPI] Allow other Gateways to deploy an ALB

Open
#4,599 15 comments 14 reactions 0 assignees View on GitHub
gateway-api
Dominant language
Go
Stars
4.3k
Forks
1.6k
Avg merge
1d 15h
Merged PRs (30d)
6

Description

**Describe the feature you are requesting**
The current v3 implementation allows us to configure a gateway with an ALB by using the alb gateway `controllerName` for the `GatewayClass` of a `Gateway.

It would be very helpful if there would be a way to allow existing gateways to deploy an `ALB`, currently the `istio-gateway` deploys an internal NLB by default. This is due to the service resource created of type LoadBalancer, with the AWS Load Balancer Controller annotations we can configure said NLB and make it public, but there's no way to make the NLB into an ALB as a service can only be an NLB.

In the old ingress world we had annotation for the `Ingress` resource, this does not exist for the new Gateway API and similar functionality potentially is needed.

With the current functionality the ALB needs to either point to the NLB, or the NLB can be ommitted if we create a `HTTPRoute` which points to the istio gateway pods, but it's still an extra hop and the istio Gateway resource does not get the correct load balancer hostname in it's status fields.

Have there been any discussions around this or does this come up for the first time? I searched issues, posted in k8s slack; so far no answers.

**Motivation**
Requirements:
* AWS WAF usage
* external-dns for automated DNS management
* istio for various needs

As istio has it's own gateway and HTTPRoutes, external-dns can't determine what the correct hostname for the ALIAS record is, it would always pick the NLB.

**Describe the proposed solution you'd like**
I'd expect the `LoadBalancerConfiguration` to be gateway agnostic, so we can attach to any gateway and in AWS we'd be able to configure the LoadBalancer attached to the gateway. Seems like the right way given the project moved away from annotations for GatewayAPI resources, otherwise I'd go for annotations.

**Describe alternatives you've considered**
Gateway chaining would be needed, external-dns needs extra CNAME records or potentially a new feature so it's able to follow the chain of gateways.

Or put Cloudfront in front of the NLB, terminate TLS and add WAF at that level. Becomes pretty expensive.

Or just use the AWS Loadbalancer Controller gateway, ditch istio gateway.

**Contribution Intention (Optional)**

- [x] Yes, I am willing to contribute a PR to implement this feature as soon as requirements and implementation details are finalised.
- [ ] No, I cannot work on a PR at this time

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the existing Gateway API handling for GatewayClass, Gateway, and LoadBalancerConfiguration, focusing on how the current AWS Load Balancer Controller integration selects and configures load balancers. The work is done when an existing non-AWS Gateway can attach an ALB configuration and the Gateway status reports the correct ALB hostname, with requirements and implementation details agreed.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, devops
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.