Kubernetes and AWS Application Load Balancer
Update: Two months after I wrote this post, Ticketmaster and CoreOS released the first implementation of ALB support for Kubernetes in the form of an ingress controller. This implementation is now maintainted by the SIG-AWS and is available in https://github.com/kubernetes-sigs/aws-alb-ingress-controller
So right now, in August 2018, Kubernetes doesn't natively support AWS ALBs — the users have to install the ingress controller to have it running in their clusters, but it seems to be stable and ready to be used in production.
What follows is my original post about the reasoning on why ALBs are better than classic ELBs, specially when used with Kubernetes:
AWS has three types of load balancers:
- ELB: the classic Elastic Load Balancer
- ALB: Application Load Balancer
- NLB: Network Load Balancer (out of the scope of this post)
ELB works at layer 4 of the OSI model, while ALB, as it's name implies, works at layer 7. We can look at ELB as a dumb service to access our applications: basically you map one internet-facing protocol and port with one instance protocol and port.
If you run containers inside that instance, you'll have to run a proxy inside it to properly forward the requests to them.
ALB has the ability to keep a map of one internet-facing port to many listening ports on the instance. That way your containers, or Kubernetes pods, can directly receive traffic from the ALB without any proxy doing port forward between them.
Kubernetes still doesn't natively support ALB: https://github.com/kubernetes/kubernetes/issues/30518 — if you're able to help getting it done or vote up for it, go ahead, that's gonna be useful in many ways.
Besides eliminating a hop, ALB has many other advantages over the classic ELB, as well pointed by this article: https://www.sumologic.com/aws/elb/aws-elastic-load-balancers-classic-vs-application/
One of the really useful ones was released early december: WAF support. As we move more and more applications to Kubernetes that's gonna be very important, as for a few we use WAF and don't want to lose our set of rules and the feature itself.
