EKS Fargate - ingress controller for a private cluster with no outbound internet access? aws-alb-ingress not supported

0
votes

Can EKS Fargate be used in a private EKS cluster which has no outbound internet access?

According to the AWS documentation, the aws-alb-ingress controller is not supported for private EKS clusters with no outbound internet access:

https://docs.aws.amazon.com/eks/latest/userguide/private-clusters.html

AWS Fargate is supported with private clusters. You must include the STS VPC endpoint. For more information, see VPC endpoints for private clusters. You must use a third-party ingress controller with AWS Fargate because the ALB Ingress Controller on Amazon EKS does not work in private clusters and because Classic Load Balancers and Network Load Balancers are not supported on pods running on Fargate.

Unfortunately AWS provides no suggestions here on what the third-party options would be. I have not been able to find any information specific to EKS Fargate Private Clusters.

Questions:

1.) Is there an open source ingress controller that uses ALB that would work for Fargate?

2.) Is there a specific reason why the aws-alb-ingress controller will not work in a private cluster? I might be able to request outbound access for specific ports, if that is the issue, but AWS does not provide any detail on this.

2
amazon-web-serviceskuberneteskubernetes-ingressamazon-eks

2 Answers

1
votes

That paragraph in the docs has changed as-of mid/end October, and now says

AWS Fargate is supported with private clusters. You must include the STS VPC endpoint. For more information, see VPC endpoints for private clusters. You can use the AWS load balancer controller to deploy AWS Application Load Balancers and Network Load Balancers with. The controller supports network load balancers with IP targets, which are required for use with Fargate. For more information, see Application load balancing on Amazon EKS and Load balancer – IP targets.

I emphasised the changed part.

So you now can use ALB-based Ingress with private clusters, and the newly-introduced IP-target mode for LoadBalancer Service supports private clusters too.

Note that this requires AWS Load Balancer Controller, which is the new version of aws-alb-ingress-controller.