<p>출처1 :&nbsp;<a href="https://catalog.us-east-1.prod.workshops.aws/v2/workshops/9c0aa9ab-90a9-44a6-abe1-8dff360ae428/ko-KR/60-ingress-controller/100-launch-alb" target="_blank">https://catalog.us-east-1.prod.workshops.aws/v2/workshops/9c0aa9ab-90a9-44a6-abe1-8dff360ae428/ko-KR/60-ingress-controller/100-launch-alb</a></p><p>출처2 :&nbsp;<a href="https://docs.aws.amazon.com/ko_kr/eks/latest/userguide/alb-ingress.html" target="_blank">https://docs.aws.amazon.com/ko_kr/eks/latest/userguide/alb-ingress.html</a></p><p>출처3 :&nbsp;<a href="https://umi0410.github.io/blog/aws/aws_eks_elb/" target="_blank">https://umi0410.github.io/blog/aws/aws_eks_elb/</a></p><p>출처4 :&nbsp;<a href="https://docs.aws.amazon.com/ko_kr/eks/latest/userguide/aws-load-balancer-controller.html" target="_blank">https://docs.aws.amazon.com/ko_kr/eks/latest/userguide/aws-load-balancer-controller.html</a></p><p>출처5 :&nbsp;<a href="https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.2/guide/tasks/ssl_redirect/" target="_blank">https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.2/guide/tasks/ssl_redirect/</a></p><p>출처6 :&nbsp;<a href="https://aws.amazon.com/ko/blogs/containers/secure-end-to-end-traffic-on-amazon-eks-using-tls-certificate-in-acm-alb-and-istio/" target="_blank">https://aws.amazon.com/ko/blogs/containers/secure-end-to-end-traffic-on-amazon-eks-using-tls-certificate-in-acm-alb-and-istio/</a></p><p>출처7 :&nbsp;<a href="https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/ingress/annotations.md#conditions" target="_blank">https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/guide/ingress/annotations.md#conditions</a></p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p>새로운 버전으로 교체했다.</p><div style="background-color:rgb(30, 30, 30);color:rgb(212, 212, 212);font-family:D2Coding, Consolas, &quot;Courier New&quot;, monospace, Consolas, &quot;Courier New&quot;, monospace;font-size:13px;line-height:18px;white-space:pre;"><div><span style="color:#ce9178;">cat &lt;&lt;EOF &gt; ingress.yaml</span></div><div>---</div><div><span style="color:#569cd6;">apiVersion</span>: <span style="color:#ce9178;">networking.k8s.io/v1</span></div><div><span style="color:#569cd6;">kind</span>: <span style="color:#ce9178;">Ingress</span></div><div><span style="color:#569cd6;">metadata</span>:</div><div>&nbsp; <span style="color:#569cd6;">name</span>: <span style="color:#ce9178;">my-ingress</span></div><div>&nbsp; <span style="color:#569cd6;">namespace</span>: <span style="color:#ce9178;">default</span></div><div>&nbsp; <span style="color:#569cd6;">annotations</span>:</div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">kubernetes.io/ingress.class</span>: <span style="color:#ce9178;">alb</span></div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">alb.ingress.kubernetes.io/scheme</span>: <span style="color:#ce9178;">internet-facing</span></div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">alb.ingress.kubernetes.io/target-type</span>: <span style="color:#ce9178;">ip</span></div><div>&nbsp; &nbsp;&nbsp;<span style="color:#6a9955;"># 아래는 ssl 설정</span></div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">alb.ingress.kubernetes.io/listen-ports</span>: <span style="color:#ce9178;">'[{"HTTP": 80}, {"HTTPS": 443}]'</span></div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">alb.ingress.kubernetes.io/certificate-arn</span>: <span style="color:#ce9178;">arn:aws:acm:ap-northeast-2:1234567890:certificate/80df6bfb-ef75-44a1-ba0e-c597a41c130b</span></div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">alb.ingress.kubernetes.io/actions.ssl-redirect</span>: <span style="color:#c586c0;">|</span></div><div><span style="color:#ce9178;">&nbsp; &nbsp; &nbsp; {</span></div><div><span style="color:#ce9178;">&nbsp; &nbsp; &nbsp; &nbsp; "Type": "redirect",</span></div><div><span style="color:#ce9178;">&nbsp; &nbsp; &nbsp; &nbsp; "RedirectConfig": {</span></div><div><span style="color:#ce9178;">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Protocol": "HTTPS",</span></div><div><span style="color:#ce9178;">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Port": "443",</span></div><div><span style="color:#ce9178;">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "StatusCode": "HTTP_301"</span></div><div><span style="color:#ce9178;">&nbsp; &nbsp; &nbsp; &nbsp; }</span></div><div><span style="color:#ce9178;">&nbsp; &nbsp; &nbsp; } &nbsp; &nbsp;</span></div><div>&nbsp; &nbsp;&nbsp;<span style="color:#6a9955;"># source ip 설정 부분</span></div><div>&nbsp; &nbsp;&nbsp;<span style="color:#6a9955;"># conditions.my-server 부분에서 my-server는 service.name과 동일해야 한다</span></div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">alb.ingress.kubernetes.io/conditions.my-server</span>: <span style="color:#c586c0;">&gt;</span></div><div><span style="color:#ce9178;">&nbsp; &nbsp; &nbsp; [{"field":"source-ip","sourceIpConfig":{"values":["111.222.233.244/32"]}}]</span></div><div><span style="color:#569cd6;">spec</span>:</div><div>&nbsp; <span style="color:#569cd6;">rules</span>:</div><div>&nbsp; <span style="color:#6a9955;"># 도메인 관계없이 redirect 시키는 부분</span></div><div>&nbsp; - <span style="color:#569cd6;">http</span>:</div><div>&nbsp; &nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">paths</span>:</div><div>&nbsp; &nbsp; &nbsp; - <span style="color:#569cd6;">path</span>: <span style="color:#ce9178;">/</span> &nbsp; &nbsp;</div><div>&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">pathType</span>: <span style="color:#ce9178;">Prefix</span></div><div>&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">backend</span>:</div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">service</span>:</div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">name</span>: <span style="color:#ce9178;">ssl-redirect</span></div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">port</span>:</div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">name</span>: <span style="color:#ce9178;">use-annotation</span></div><p><br>&nbsp;</p><div>&nbsp; - <span style="color:#569cd6;">host</span>: <span style="color:#ce9178;">domain.com</span></div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">http</span>:</div><div>&nbsp; &nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">paths</span>:</div><div>&nbsp; &nbsp; &nbsp; - <span style="color:#569cd6;">path</span>: <span style="color:#ce9178;">/</span></div><div>&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">pathType</span>: <span style="color:#ce9178;">Prefix</span></div><div>&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">backend</span>:</div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">service</span>:</div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">name</span>: <span style="color:#ce9178;">my-server</span></div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">port</span>:</div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">number</span>: <span style="color:#b5cea8;">8080</span></div><p><br>&nbsp;</p><div><span style="color:#ce9178;">EOF</span></div><p><br>&nbsp;</p></div><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><hr><p>&nbsp;</p><p>아래와 같이 설정하면 SSL 인증서를 사용할 수 있다.&nbsp;</p><p>다만 apiVersion에 `extentions/v1beta` 라고 적었는데 `networking.k8s.io/v1`이 더 최신이고, v1beta는 deprecated 되었다.</p><p>&nbsp;</p><p>하지만 왜 extentions/v1beta를 썼냐하면 redirect 설정이 잘동작하지 않아서 이다.</p><p>v1.22 버전부터는 아예 사용할 수 없다고 한다.&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><div style="background-color:rgb(30, 30, 30);color:rgb(212, 212, 212);font-family:D2Coding, Consolas, &quot;Courier New&quot;, monospace, Consolas, &quot;Courier New&quot;, monospace;font-size:13px;line-height:18px;white-space:pre;"><div><span style="color:#ce9178;">cat &lt;&lt;EOF &gt; ingress.yaml</span></div><div>---</div><div><span style="color:#569cd6;">apiVersion</span>: <span style="color:#ce9178;">extensions/v1beta1</span></div><div><span style="color:#569cd6;">kind</span>: <span style="color:#ce9178;">Ingress</span></div><div><span style="color:#569cd6;">metadata</span>:</div><div>&nbsp; <span style="color:#569cd6;">name</span>: <span style="color:#ce9178;">my-ingress</span></div><div>&nbsp; <span style="color:#569cd6;">namespace</span>: <span style="color:#ce9178;">default</span></div><div>&nbsp; <span style="color:#569cd6;">annotations</span>:</div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">kubernetes.io/ingress.class</span>: <span style="color:#ce9178;">alb</span></div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">alb.ingress.kubernetes.io/scheme</span>: <span style="color:#ce9178;">internet-facing</span></div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">alb.ingress.kubernetes.io/target-type</span>: <span style="color:#ce9178;">ip</span></div><div>&nbsp; &nbsp;&nbsp;<span style="color:#6a9955;"># 아래는 ssl 설정</span></div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">alb.ingress.kubernetes.io/listen-ports</span>: <span style="color:#ce9178;">'[{"HTTP": 80}, {"HTTPS": 443}]'</span></div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">alb.ingress.kubernetes.io/certificate-arn</span>: <span style="color:#ce9178;">arn:aws:acm:ap-northeast-2:1234567890:certificate/80df6bfb-ef75-44a1-ba0e-c597a41c130b</span> <span style="color:#6a9955;"># acm의 arn</span></div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">alb.ingress.kubernetes.io/actions.ssl-redirect</span>: <span style="color:#ce9178;">'{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'</span></div><p><br>&nbsp;</p><div><span style="color:#569cd6;">spec</span>:</div><div>&nbsp; <span style="color:#6a9955;"># redirect 설정</span></div><div>&nbsp; <span style="color:#569cd6;">backend</span>:</div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">serviceName</span>: <span style="color:#ce9178;">ssl-redirect</span></div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">servicePort</span>: <span style="color:#ce9178;">use-annotation</span></div><div>&nbsp; <span style="color:#569cd6;">rules</span>:</div><div>&nbsp; - <span style="color:#569cd6;">host</span>: <span style="color:#ce9178;">domain.com</span></div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">http</span>:</div><div>&nbsp; &nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">paths</span>:</div><div>&nbsp; &nbsp; &nbsp; &nbsp; - <span style="color:#569cd6;">path</span>: <span style="color:#ce9178;">/</span></div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">pathType</span>: <span style="color:#ce9178;">Prefix</span></div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">backend</span>:</div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">serviceName</span>: <span style="color:#ce9178;">my-server</span></div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">servicePort</span>: <span style="color:#b5cea8;">8080</span></div><p><br>&nbsp;</p><div><span style="color:#ce9178;">EOF</span></div><p><br><br><br>&nbsp;</p></div><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><hr><p>&nbsp;</p><h4>아래처럼 alias를 사용해서 구성도 가능한 것 같다.</h4><p>&nbsp;</p><div style="background-color:rgb(30, 30, 30);color:rgb(212, 212, 212);font-family:D2Coding, Consolas, &quot;Courier New&quot;, monospace, Consolas, &quot;Courier New&quot;, monospace;font-size:13px;line-height:18px;white-space:pre;"><div><span style="color:#569cd6;">apiVersion</span>: <span style="color:#ce9178;">extensions/v1beta1</span></div><div><span style="color:#569cd6;">kind</span>: <span style="color:#ce9178;">Ingress</span></div><div><span style="color:#569cd6;">metadata</span>:</div><div>&nbsp; <span style="color:#569cd6;">namespace</span>: <span style="color:#ce9178;">default</span></div><div>&nbsp; <span style="color:#569cd6;">name</span>: <span style="color:#ce9178;">alb-ingress</span></div><div>&nbsp; <span style="color:#569cd6;">annotations</span>:</div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">kubernetes.io/ingress.class</span>: <span style="color:#ce9178;">alb</span></div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">alb.ingress.kubernetes.io/certificate-arn</span>: <span style="color:#ce9178;">arn:aws:acm:us-east-1:123456789123:certificate/xxxxxxx-yyyy-zzzz-abce-ffffffffffff</span></div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">alb.ingress.kubernetes.io/scheme</span>: <span style="color:#ce9178;">internet-facing</span></div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">alb.ingress.kubernetes.io/security-groups</span>: <span style="color:#ce9178;">sg-xxxxxxxxxxxxxx</span></div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">alb.ingress.kubernetes.io/listen-ports</span>: <span style="color:#ce9178;">'[{"HTTP": 80}, {"HTTPS":443}]'</span></div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">alb.ingress.kubernetes.io/actions.ssl-redirect</span>: <span style="color:#ce9178;">'{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'</span></div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">alb.ingress.kubernetes.io/actions.response-404</span>: <span style="color:#c586c0;">&gt;</span></div><div><span style="color:#ce9178;">&nbsp; &nbsp; &nbsp; {"type":"fixed-response","fixedResponseConfig":{"contentType":"text/plain","statusCode":"404","messageBody":"Not Found"}}</span></div><div><span style="color:#ce9178;">&nbsp; &nbsp;</span></div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">alb.ingress.kubernetes.io/actions.green-svc</span>: <span style="color:#c586c0;">&gt;</span></div><div><span style="color:#ce9178;">&nbsp; &nbsp; &nbsp; {"type":"forward","forwardConfig":{"targetGroups":[{"serviceName":"green-k8s-service","servicePort":80,"weight":100}]}}</span></div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">alb.ingress.kubernetes.io/conditions.green-svc</span>: <span style="color:#c586c0;">&gt;</span></div><div><span style="color:#ce9178;">&nbsp; &nbsp; &nbsp; [{"field":"host-header","hostHeaderConfig":{"values":["domain.com"]}},{"field":"path-pattern","pathPatternConfig":{"values":["/green"]}}]</span></div><div><span style="color:#ce9178;">&nbsp; &nbsp;</span></div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">alb.ingress.kubernetes.io/actions.red-svc</span>: <span style="color:#c586c0;">&gt;</span></div><div><span style="color:#ce9178;">&nbsp; &nbsp; &nbsp; {"type":"forward","forwardConfig":{"targetGroups":[{"serviceName":"red-k8s-service","servicePort":80,"weight":100}]}}</span></div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">alb.ingress.kubernetes.io/conditions.red-svc</span>: <span style="color:#c586c0;">&gt;</span></div><div><span style="color:#ce9178;">&nbsp; &nbsp; &nbsp; [{"field":"host-header","hostHeaderConfig":{"values":["domain.com"]}},{"field":"path-pattern","pathPatternConfig":{"values":["/red"]}}]</span></div><p><br>&nbsp;</p><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">alb.ingress.kubernetes.io/actions.mongo-svc</span>: <span style="color:#c586c0;">&gt;</span></div><div><span style="color:#ce9178;">&nbsp; &nbsp; &nbsp; {"type":"forward","forwardConfig":{"targetGroups":[{"serviceName":"mongo-k8s-service","servicePort":8081,"weight":100}]}}</span></div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">alb.ingress.kubernetes.io/conditions.mongo-svc</span>: <span style="color:#c586c0;">&gt;</span></div><div><span style="color:#ce9178;">&nbsp; &nbsp; &nbsp; [{"field":"host-header","hostHeaderConfig":{"values":["mongo.domain.com"]}}]</span></div><div><span style="color:#569cd6;">spec</span>:</div><div>&nbsp; <span style="color:#569cd6;">backend</span>:</div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">serviceName</span>: <span style="color:#ce9178;">response-404</span></div><div>&nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">servicePort</span>: <span style="color:#ce9178;">use-annotation</span></div><div>&nbsp; <span style="color:#569cd6;">rules</span>:</div><div>&nbsp; &nbsp; - <span style="color:#569cd6;">http</span>:</div><div>&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">paths</span>:</div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; - <span style="color:#569cd6;">backend</span>:</div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">serviceName</span>: <span style="color:#ce9178;">ssl-redirect</span></div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">servicePort</span>: <span style="color:#ce9178;">use-annotation</span></div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; - <span style="color:#569cd6;">backend</span>:</div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">serviceName</span>: <span style="color:#ce9178;">green-svc</span></div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">servicePort</span>: <span style="color:#ce9178;">use-annotation</span></div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; - <span style="color:#569cd6;">backend</span>:</div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">serviceName</span>: <span style="color:#ce9178;">red-svc</span></div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">servicePort</span>: <span style="color:#ce9178;">use-annotation</span></div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; - <span style="color:#569cd6;">backend</span>:</div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">serviceName</span>: <span style="color:#ce9178;">mongo-svc</span></div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<span style="color:#569cd6;">servicePort</span>: <span style="color:#ce9178;">use-annotation</span></div></div><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p>

[AWS] ingress 설정하기 aws-load-balancer-controller, SSL/TLS/HTTPS redirect