Lack of ExternalName Service support

[adw1n]

Adding ExternalName Service causes this error:

E0415 10:39:34.719028       1 controller.go:217] kubebuilder/controller "msg"="Reconciler error" "error"="failed to reconcile targetGroups due to failed to reconcile targetGroup targets due to Unable to find service endpoints for 2048-game/apple-service: no object matching key \"2048-game/apple-service\" in local store"  "controller"="alb-ingress-controller" "request"={"Namespace":"2048-game","Name":"2048-ingress"}

Reproducible test case:

1. Follow https://docs.aws.amazon.com/eks/latest/userguide/alb-ingress.html walkthrough but use ip traffic mode
2. kubectl apply -f https://raw.githubusercontent.com/cornellanthony/nlb-nginxIngress-eks/master/apple.yaml
3. kubectl apply -f apple-proxy.yaml

# apple-proxy.yaml
kind: Service
apiVersion: v1
metadata:
  name: apple-service
  namespace: 2048-game
  labels:
    app: myexternal
spec:
  type: ExternalName
  externalName: apple-service.default.svc.cluster.local
  ports:
    - port: 5678

4. kubectl edit ingress/2048-ingress -n 2048-game and add new path:

          - path: /apple
            backend:
              serviceName: "apple-service"
              servicePort: 5678

[xidongc-wish]

Any workaround for this issue? Thanks

[adw1n]

@xiangpengzhao not to my knowledge. I had to use a proxy nginx service in place of ExternalName service

[AmundsenJunior]

@adw1n do you have an example you can provide of the "proxy nginx service" solution that worked for you?

[adw1n]

@AmundsenJunior I used a service pointing to a deployment with an nginx container. This is the bare minimum /etc/nginx/nginx.conf config that should work:

events {}
http {
    server {
        listen 80;
        location / {
            resolver kube-dns.kube-system.svc.cluster.local valid=20s;
            set $my_serivce name_of_my_service.name_of_my_namespace.svc.cluster.local;
            proxy_pass http://$my_serivce:9000;
        }
    }
}

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[adw1n]

/remove-lifecycle stale

[kishorj]

/kind feature

[M00nF1sh]

@adw1n
Hi, i believe the original purpose this feature request is to support address services in another namespace, this have been supported via the new IngressGroup feature introduced in v2.0.0+.

If we want to support address arbitrary externalName outside of Kubernetes, it's not currently supported by ALB itself. Please open a new feature request if that's the case 😄

Closing this.

[weskerfoot]

@M00nF1sh Can you please explain how that addresses the problem? Is there some documentation with an example on how to expose a service with a load balancer running in another namespace using IngressGroup?

[johnjeffers]

Another request for clarification of how this solves the problem, please.

I created two ingresses in two different namespaces, and gave them the same group name. This created two different ALBs instead of honoring the group name request.

---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: ingress-one
  namespace: namespace-one
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/group.name: service-router
    alb.ingress.kubernetes.io/group.order: "1"
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/certificate-arns: arn:aws...etc
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP":80},{"HTTPS":443}]'
    alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type":"redirect","RedirectConfig":{"Protocol":"HTTPS","Port":"443","StatusCode":"HTTP_301"}}'
    alb.ingress.kubernetes.io/healthcheck-path: /healthz
    alb.ingress.kubernetes.io/tags: Environment=dev
spec:
  rules:
    - host: service-one.dev.mycompany.io
      http:
        paths:
        - backend:
            serviceName: ssl-redirect
            servicePort: use-annotation
          path: /*
        - backend:
            serviceName: service-one
            servicePort: 80
          path: /*

---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: ingress-two
  namespace: namespace-two
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/group.name: service-router
    alb.ingress.kubernetes.io/group.order: "2"
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/certificate-arns: arn:aws...etc
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP":80},{"HTTPS":443}]'
    alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type":"redirect","RedirectConfig":{"Protocol":"HTTPS","Port":"443","StatusCode":"HTTP_301"}}'
    alb.ingress.kubernetes.io/tags: Environment=dev
spec:
  rules:
    - host: service-two.dev.mycompany.io
      http:
        paths:
        - backend:
            serviceName: ssl-redirect
            servicePort: use-annotation
          path: /*
        - backend:
            serviceName: service-two
            servicePort: 80
          path: /*