Install the Amazon Load Balancer Controller add-on using Kubernetes Manifests

Create IAM Role using eksctl

• Replace my-cluster with the name of your cluster, 111122223333 with your account ID, and then run the command.

  $ eksctl create iamserviceaccount \
    --cluster=my-cluster \
    --namespace=kube-system \
    --name=aws-load-balancer-controller \
    --role-name AmazonEKSLoadBalancerControllerRole \
    --attach-policy-arn=arn:aws-cn:iam::111122223333:policy/AWSLoadBalancerControllerIAMPolicy \
    --approve

Create IAM Role using the Amazon CLI and kubectl

1. Retrieve your cluster's OIDC provider ID and store it in a variable.

   oidc_id=$(aws eks describe-cluster --name my-cluster --query "cluster.identity.oidc.issuer" --output text | cut -d '/' -f 5)
   

2. Determine whether an IAM OIDC provider with your cluster's ID is already in your account. You need OIDC configured for both the cluster and IAM.

   aws iam list-open-id-connect-providers | grep $oidc_id | cut -d "/" -f4
   

   If output is returned, then you already have an IAM OIDC provider for your cluster. If no output is returned, then you must create an IAM OIDC provider for your cluster. For more information, see Create an IAM OIDC provider for your cluster.

3. Copy the following contents to your device. Replace 111122223333 with your account ID. Replace region-code with the Amazon Web Services Region that your cluster is in. Replace EXAMPLED539D4633E53DE1B71EXAMPLE with the output returned in the previous step. After replacing the text, run the modified command to create the load-balancer-role-trust-policy.json file.

   cat >load-balancer-role-trust-policy.json <<EOF
   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Principal": {
                   "Federated": "arn:aws-cn:iam::111122223333:oidc-provider/oidc.eks.region-code.amazonaws.com.cn/id/EXAMPLED539D4633E53DE1B71EXAMPLE"
               },
               "Action": "sts:AssumeRoleWithWebIdentity",
               "Condition": {
                   "StringEquals": {
                       "oidc.eks.region-code.amazonaws.com.cn/id/EXAMPLED539D4633E53DE1B71EXAMPLE:aud": "sts.amazonaws.com",
                       "oidc.eks.region-code.amazonaws.com.cn/id/EXAMPLED539D4633E53DE1B71EXAMPLE:sub": "system:serviceaccount:kube-system:aws-load-balancer-controller"
                   }
               }
           }
       ]
   }
   EOF
   

4. Create the IAM role.

   aws iam create-role \
     --role-name AmazonEKSLoadBalancerControllerRole \
     --assume-role-policy-document file://"load-balancer-role-trust-policy.json"
   

5. Attach the required Amazon EKS managed IAM policy to the IAM role. Replace 111122223333 with your account ID.

   aws iam attach-role-policy \
     --policy-arn arn:aws-cn:iam::111122223333:policy/AWSLoadBalancerControllerIAMPolicy \
     --role-name AmazonEKSLoadBalancerControllerRole
   

6. Copy the following contents to your device. Replace 111122223333 with your account ID. After replacing the text, run the modified command to create the aws-load-balancer-controller-service-account.yaml file.

   cat >aws-load-balancer-controller-service-account.yaml <<EOF
   apiVersion: v1
   kind: ServiceAccount
   metadata:
     labels:
       app.kubernetes.io/component: controller
       app.kubernetes.io/name: aws-load-balancer-controller
     name: aws-load-balancer-controller
     namespace: kube-system
     annotations:
       eks.amazonaws.com/role-arn: arn:aws-cn:iam::111122223333:role/AmazonEKSLoadBalancerControllerRole
   EOF
   

7. Create the Kubernetes service account on your cluster. The Kubernetes service account named aws-load-balancer-controller is annotated with the IAM role that you created named AmazonEKSLoadBalancerControllerRole.

   $ kubectl apply -f aws-load-balancer-controller-service-account.yaml
   

Install cert-manager using Quay.io

• If your nodes have access to the quay.io container registry, install cert-manager to inject certificate configuration into the webhooks.

  $ kubectl apply \
      --validate=false \
      -f https://github.com/jetstack/cert-manager/releases/download/v1.13.5/cert-manager.yaml
  

Install cert-manager using Amazon ECR

1. Install cert-manager using one of the following methods to inject certificate configuration into the webhooks. For more information, see Getting Started on the cert-manager Documentation.

2. Download the manifest.

   curl -Lo cert-manager.yaml https://github.com/jetstack/cert-manager/releases/download/v1.13.5/cert-manager.yaml
   

3. Pull the following images and push them to a repository that your nodes have access to. For more information on how to pull, tag, and push the images to your own repository, see Copy a container image from one repository to another repository.

   quay.io/jetstack/cert-manager-cainjector:v1.13.5
   quay.io/jetstack/cert-manager-controller:v1.13.5
   quay.io/jetstack/cert-manager-webhook:v1.13.5

4. Replace quay.io in the manifest for the three images with your own registry name. The following command assumes that your private repository's name is the same as the source repository. Replace 111122223333.dkr.ecr.region-code.amazonaws.com.cn with your private registry.

   $ sed -i.bak -e 's|quay.io|111122223333.dkr.ecr.region-code.amazonaws.com.cn|' ./cert-manager.yaml

5. Apply the manifest.

   $ kubectl apply \
       --validate=false \
       -f ./cert-manager.yaml