How to configure the Ingressgateway of Service Mesh with internal LoadBalancer type in ROSA or OCP with AWS

Solution Unverified - Updated -

Environment

  • Red Hat OpenShift Container Platform
    • v4.9 and later
  • Red Hat OpenShift Service Mesh
    • v2.2.1

Issue

  • Need to configure the Ingressgateway or additional ones of Service Mesh with internal/private LoadBalancer type in ROSA (Red Hat OpenShift in AWS) or OpenShift with AWS.

Resolution

$ oc edit smcp basic -n istio-system
:
spec:
  gateways:
    additionalIngress:
      ingressgateway-second:
        enabled: true
        runtime:
          deployment:
            replicas: 1
        sds:
          enabled: true
        service:
          metadata:
            annotations:
              service.beta.kubernetes.io/aws-load-balancer-internal: "true"  <-- ADD


$ oc get svc -n istio-system
NAME                         TYPE           CLUSTER-IP       EXTERNAL-IP                                                                          
ingressgateway-second        LoadBalancer   172.30.235.177   internal-xxxxx-12345.ap-northeast-1.elb.amazonaws.com ...

$ aws elb describe-load-balancers --load-balancer-names xxxxx | grep Scheme
        "Scheme": "internal"
  • In order to change existing internet-facing ELB to internal, after removing the existing one, a new one should be created as the internal type.

Root Cause

  • The Service with type LoadBalancer in AWS supports Internal load balancer using the annotation service.beta.kubernetes.io/aws-load-balancer-internal.

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments