Add application load balancer controller with ingress support

charts/gardener-extension-admission-stackit/charts/runtime/templates/deployment.yaml

@@ -63,6 +63,9 @@ spec:
         {{- if .Values.flatcarImageVersion }}
         - --flatcar-image-version={{ .Values.flatcarImageVersion }}
         {{- end }}
+        {{- if .Values.allowApplicationLoadBalancerController }}
+        - --allow-application-load-balancer-controller={{ .Values.allowApplicationLoadBalancerController }}
+        {{- end }}
         - --health-bind-address=:{{ .Values.healthPort }}
         - --leader-election-id=gardener-extension-admission-stackit
         securityContext:

charts/gardener-extension-admission-stackit/charts/runtime/values.yaml

@@ -22,6 +22,7 @@ kubeconfig:
 featureGates: {}
 #   SomeGate: true
 flatcarImageVersion: ""
+#allowApplicationLoadBalancerController: false
 
 #projectedKubeconfig:
 #  baseMountPath: /var/run/secrets/gardener.cloud

charts/gardener-extension-provider-stackit/templates/configmap.yaml

@@ -29,6 +29,3 @@ data:
     registryCaches:
       {{- toYaml . | nindent 6 }}
   {{- end }}
-{{- if .Values.config.deployALBIngressController }}
-    deployALBIngressController: {{ .Values.config.deployALBIngressController }}
-{{- end }}

charts/gardener-extension-provider-stackit/values.yaml

@@ -76,11 +76,10 @@ config:
       provisioner: block-storage.csi.stackit.cloud
       volumeBindingMode: WaitForFirstConsumer
   registryCaches:
-  # - server: reg.example.com
-  #   cache: reg-cache.example.com
-  #   caBundle: LS0tLS1C... #b64 encoded CA bundle, optional
-  #   capabilities: ["pull", "resolve"]
-  # deployALBIngressController: true
+    # - server: reg.example.com
+    #   cache: reg-cache.example.com
+    #   caBundle: LS0tLS1C... #b64 encoded CA bundle, optional
+    #   capabilities: ["pull", "resolve"]
 gardener:
   version: ""
   gardenlet:

charts/internal/seed-controlplane/charts/stackit-application-load-balancer-controller/Chart.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+description: Helm chart for STACKIT stackit-application-load-balancer-controller
+name: stackit-application-load-balancer-controller
+version: 0.1.0

charts/internal/seed-controlplane/charts/stackit-application-load-balancer-controller/templates/configmap.yaml

@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: stackit-application-load-balancer-controller
+  namespace: {{ .Release.Namespace }}
+data:
+  cloud.yaml: |-
+    global:
+      region: {{ .Values.config.global.region }}
+      projectId: {{ .Values.config.global.projectId }}
+      {{- with .Values.config.global.apiEndpoints }}
+      apiEndpoints:
+        {{- if .applicationLoadBalancerApi }}
+        applicationLoadBalancerApi: {{ .applicationLoadBalancerApi }}
+        {{- end }}
+        {{- if .applicationLoadBalancerCertificateApi }}
+        applicationLoadBalancerCertificateApi: {{ .applicationLoadBalancerCertificateApi }}
+        {{- end }}
+      {{- end }}
+    applicationLoadBalancer:
+      networkId: {{ .Values.config.applicationLoadBalancer.networkId }}

charts/internal/seed-controlplane/charts/stackit-application-load-balancer-controller/templates/poddisruptionbudget.yaml

@@ -0,0 +1,15 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: stackit-application-load-balancer-controller
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: kubernetes
+    role: stackit-application-load-balancer-controller
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app: kubernetes
+      role: stackit-application-load-balancer-controller
+  unhealthyPodEvictionPolicy: AlwaysAllow

charts/internal/seed-controlplane/charts/stackit-alb-controller-manager/templates/alb-controller-manager.yaml → charts/internal/seed-controlplane/charts/stackit-application-load-balancer-controller/templates/stackit-application-load-balancer-controller.yaml

@@ -1,19 +1,19 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: stackit-alb-controller-manager
+  name: stackit-application-load-balancer-controller
   namespace: {{ .Release.Namespace }}
   labels:
     app: kubernetes
-    role: stackit-alb-controller-manager
+    role: stackit-application-load-balancer-controller
     high-availability-config.resources.gardener.cloud/type: controller
 spec:
   replicas: {{ .Values.replicas }}
   revisionHistoryLimit: 1
   selector:
     matchLabels:
       app: kubernetes
-      role: stackit-alb-controller-manager
+      role: stackit-application-load-balancer-controller
   template:
     metadata:
 {{- if .Values.podAnnotations }}
@@ -23,7 +23,7 @@ spec:
       labels:
         gardener.cloud/role: controlplane
         app: kubernetes
-        role: stackit-alb-controller-manager
+        role: stackit-application-load-balancer-controller
         networking.gardener.cloud/to-dns: allowed
         networking.gardener.cloud/to-public-networks: allowed
         networking.gardener.cloud/to-private-networks: allowed
@@ -36,35 +36,26 @@ spec:
       automountServiceAccountToken: false
       priorityClassName: gardener-system-300
       containers:
-      - name: stackit-alb-controller-manager
-        image: {{ index .Values.images "stackit-alb-controller-manager" }}
+      - name: stackit-application-load-balancer-controller
+        image: {{ index .Values.images "stackit-application-load-balancer-controller" }}
         args:
         - --kubeconfig=/var/run/secrets/gardener.cloud/shoot/generic-kubeconfig/kubeconfig
         - --leader-elect=true
+        - --metrics-bind-address=:{{ .Values.metricsPort }}
         - --leader-election-namespace=kube-system
-        - --leader-election-id=stackit-alb-controller-manager
+        - --leader-election-id=stackit-application-load-balancer-controller
+        - --cloud-config=/etc/config/cloud.yaml
         env:
         - name: STACKIT_SERVICE_ACCOUNT_KEY_PATH
           value: /etc/serviceaccount/serviceaccount.json
-        - name: STACKIT_REGION
-          value: {{ .Values.config.region }}
-        - name: PROJECT_ID
-          value: {{ .Values.config.stackitProjectID }}
-        - name: NETWORK_ID
-          value: {{ .Values.config.stackitNetworkID }}
-
-{{- if .Values.config.tokenUrl }}
+{{- if .Values.tokenEndpoint }}
         - name: STACKIT_TOKEN_BASEURL
-          value: {{ .Values.config.tokenUrl }}
-{{- end }}
-{{- if .Values.config.applicationLBApiUrl }}
-        - name: STACKIT_LOAD_BALANCER_API_ALB_URL
-          value: {{ .Values.config.applicationLBApiUrl }}
-{{- end }}
-{{- if .Values.config.certificateApiUrl }}
-        - name: STACKIT_LOAD_BALANCER_API_CERT_URL
-          value: {{ .Values.config.certificateApiUrl }}
+          value: {{ .Values.tokenEndpoint }}
 {{- end }}
+        ports:
+        - containerPort: {{ .Values.metricsPort }}
+          name: metrics
+          protocol: TCP
 {{- if .Values.resources }}
         resources:
 {{ toYaml .Values.resources | indent 10 }}
@@ -73,13 +64,19 @@ spec:
         - mountPath: /var/run/secrets/gardener.cloud/shoot/generic-kubeconfig
           name: kubeconfig
           readOnly: true
+        - mountPath: /etc/config
+          name: config-volume
         - mountPath: /etc/serviceaccount
           name: sa-secret
         - mountPath: /etc/ssl/certs/keystone-ca.crt
           name: cloud-config-ca
           subPath: keystone-ca.crt
           readOnly: true
       volumes:
+      - name: config-volume
+        configMap:
+          defaultMode: 420
+          name: stackit-application-load-balancer-controller
       - name: sa-secret
         secret:
           defaultMode: 420

charts/internal/seed-controlplane/charts/stackit-alb-controller-manager/templates/vpa.yaml → charts/internal/seed-controlplane/charts/stackit-application-load-balancer-controller/templates/vpa.yaml

@@ -1,18 +1,18 @@
 apiVersion: autoscaling.k8s.io/v1
 kind: VerticalPodAutoscaler
 metadata:
-  name: stackit-alb-controller-manager-vpa
+  name: stackit-application-load-balancer-controller
   namespace: {{ .Release.Namespace }}
 spec:
   targetRef:
     apiVersion: apps/v1
     kind: Deployment
-    name: stackit-alb-controller-manager
+    name: stackit-application-load-balancer-controller
   updatePolicy:
     updateMode: Auto
   resourcePolicy:
     containerPolicies:
-    - containerName: stackit-alb-controller-manager
+    - containerName: stackit-application-load-balancer-controller
       minAllowed:
         memory: 80M
       maxAllowed:

charts/internal/seed-controlplane/charts/stackit-application-load-balancer-controller/values.yaml

@@ -0,0 +1,21 @@
+replicas: 1
+config:
+  global:
+    region: ""
+    projectId: ""
+    # apiEndpoints:
+    #  applicationLoadBalancerApi: "foo"
+    #  applicationLoadBalancerCertificateApi: "foo"
+  applicationLoadBalancer:
+    networkId: ""
+#tokenEndpoint: "foo"
+metricsPort: 9090
+podAnnotations: {}
+podLabels: {}
+images:
+  stackit-alb-controller-manager: image:tag
+vpa:
+  resourcePolicy:
+    maxAllowed:
+      cpu: 1
+      memory: 512Mi

charts/internal/seed-controlplane/requirements.yaml

@@ -15,10 +15,10 @@ dependencies:
   version: 0.1.0
   repository: http://localhost:10191
   condition: stackit-blockstorage-csi-driver.enabled
-- name: stackit-alb-controller-manager
+- name: stackit-application-load-balancer-controller
   repository: http://localhost:10191
   version: 0.1.0
-  condition: stackit-alb-controller-manager.enabled
+  condition: stackit-application-load-balancer-controller.enabled
 - name: stackit-pod-identity-webhook
   repository: http://localhost:10191
   version: 0.1.0

charts/internal/seed-controlplane/values.yaml

@@ -6,7 +6,7 @@ stackit-cloud-controller-manager:
   enabled: false
 csi-driver-controller:
   enabled: true
-stackit-alb-controller-manager:
+stackit-application-load-balancer-controller:
   enabled: false
 stackit-pod-identity-webhook:
-  enabled: false
+  enabled: false

cmd/gardener-extension-admission-stackit/app/app.go

@@ -27,6 +27,7 @@ import (
 
 	admissioncmd "github.com/stackitcloud/gardener-extension-provider-stackit/v2/pkg/admission/cmd"
 	"github.com/stackitcloud/gardener-extension-provider-stackit/v2/pkg/admission/mutator"
+	"github.com/stackitcloud/gardener-extension-provider-stackit/v2/pkg/admission/validator"
 	stackitinstall "github.com/stackitcloud/gardener-extension-provider-stackit/v2/pkg/apis/stackit/install"
 	"github.com/stackitcloud/gardener-extension-provider-stackit/v2/pkg/feature"
 	providerstackit "github.com/stackitcloud/gardener-extension-provider-stackit/v2/pkg/stackit"
@@ -64,9 +65,12 @@ func NewAdmissionCommand(ctx context.Context) *cobra.Command {
 			webhookSwitches,
 		)
 
+		admissionOpts = &admissioncmd.ConfigOptions{}
+
 		aggOption = controllercmd.NewOptionAggregator(
 			restOpts,
 			mgrOpts,
+			admissionOpts,
 			webhookOptions,
 		)
 	)
@@ -93,6 +97,9 @@ func NewAdmissionCommand(ctx context.Context) *cobra.Command {
 
 			managerOptions := mgrOpts.Completed().Options()
 
+			admissionConfig := admissionOpts.Completed()
+			admissionConfig.ApplyAllowApplicationLoadBalancerController(&validator.DefaultAddOptions.AllowApplicationLoadBalancerController)
+
 			// Operators can enable the source cluster option via SOURCE_CLUSTER environment variable.
 			// In-cluster config will be used if no SOURCE_KUBECONFIG is specified.
 			//

cmd/gardener-extension-provider-stackit/app/app.go

@@ -190,11 +190,9 @@ func NewControllerManagerCommand(ctx context.Context) *cobra.Command {
 			configFileOpts.Completed().ApplyETCDStorage(&stackitseedprovider.DefaultAddOptions.ETCDStorage)
 			configFileOpts.Completed().ApplyHealthCheckConfig(&healthcheck.DefaultAddOptions.HealthCheckConfig)
 			configFileOpts.Completed().ApplyRegistryCaches(&stackitwebhookcontrolplane.DefaultAddOptions.RegistryCaches)
-			configFileOpts.Completed().ApplyDeployALBIngressController(&stackitcontrolplane.DeployALBIngressController)
 			configFileOpts.Completed().ApplyCustomLabelDomain(&stackitworker.DefaultAddOptions.CustomLabelDomain)
 			configFileOpts.Completed().ApplyCustomLabelDomain(&stackitcontrolplane.DefaultAddOptions.CustomLabelDomain)
 			configFileOpts.Completed().ApplyCustomLabelDomain(&infrastructure.DefaultAddOptions.CustomLabelDomain)
-			log.Info("DeployALBIngressController?", "deploy", configFileOpts.Completed().Config.DeployALBIngressController)
 
 			bastionCtrlOpts.Completed().Apply(&stackitbastion.DefaultAddOptions.Controller)
 			configFileOpts.Completed().ApplyCustomLabelDomain(&stackitbastion.DefaultAddOptions.CustomLabelDomain)