Skip to content

Commit 5375bad

Browse files
author
Ryan Lymburner
authored
Support Standalone Service Creation & Surface Service ARN (#818)
* Add annotation constants and helper functions * Implement standalone mode detection in service model builder * Modify service model building to support standalone mode * Update service manager to handle standalone services * Enhance route status updates with service ARN * Update route controller to use enhanced status function * Add validation and error handling for annotation transitions * Update setup.sh dependencies and address linting issues * Create integration tests for standalone service creation * Create integration tests for annotation precedence and inheritance * Create integration tests for transition scenarios * Update documentation for standalone VPC Lattice services * Upgrade golangci-lint version to v2.4.0 in GitHub workflow * Address PR comments * Address PR comments related to documentation * Simplify ParseBoolAnnotation() * Remove switch statement * Update action to setup-go@v4
1 parent caa123e commit 5375bad

23 files changed

+4841
-43
lines changed

‎.github/workflows/validate-pull-request-presubmit.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,10 @@ jobs:
1414
python-version: '3.11'
1515
cache: 'pip'
1616
- run: pip install -r requirements.txt
17-
- uses: actions/setup-go@v3
17+
- uses: actions/setup-go@v4
1818
with:
1919
go-version: ${{ env.GO_VERSION }}
20+
cache: false
2021
check-latest: true
2122
- uses: actions/cache@v4
2223
with:

‎docs/faq.md‎

Lines changed: 87 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,92 @@ AWS Gateway API Controller supports Gateway API CRD bundle versions `v1.1` or gr
2222

2323
In multi-cluster deployments, when you apply a TargetGroupPolicy to a ServiceExport, the health check configuration is automatically propagated to all target groups across all clusters that participate in the service mesh. This ensures consistent health monitoring behavior regardless of which cluster contains the route resource.
2424

25+
## Standalone VPC Lattice Services
26+
27+
**What are standalone VPC Lattice services?**
28+
29+
Standalone VPC Lattice services are services created without automatic service network association. They provide more flexibility for independent service management, selective service network membership, and integration with external systems. Use the `application-networking.k8s.aws/standalone: "true"` annotation on Gateway or Route resources to enable this mode.
30+
31+
**Why is my standalone service not accessible from other services?**
32+
33+
Standalone services are not automatically discoverable through service network DNS resolution. To enable communication:
34+
35+
1. **Use the VPC Lattice assigned DNS name** from the route annotation:
36+
```bash
37+
kubectl get httproute my-route -o jsonpath='{.metadata.annotations.application-networking\.k8s\.aws/lattice-assigned-domain-name}'
38+
```
39+
40+
2. **Manually associate the service with a service network** using AWS CLI:
41+
```bash
42+
SERVICE_ARN=$(kubectl get httproute my-route -o jsonpath='{.metadata.annotations.application-networking\.k8s\.aws/lattice-service-arn}')
43+
SERVICE_ID=$(echo "$SERVICE_ARN" | cut -d'/' -f2)
44+
aws vpc-lattice create-service-network-service-association \
45+
--service-network-identifier "sn-12345678901234567" \
46+
--service-identifier "$SERVICE_ID"
47+
```
48+
49+
**How do I transition between standalone and service network modes?**
50+
51+
To transition from service network to standalone mode:
52+
```bash
53+
kubectl annotate httproute my-route application-networking.k8s.aws/standalone=true
54+
```
55+
56+
To transition from standalone to service network mode:
57+
```bash
58+
kubectl annotate httproute my-route application-networking.k8s.aws/standalone-
59+
```
60+
61+
The controller handles transitions gracefully without service disruption.
62+
63+
**Why isn't my route-level annotation working?**
64+
65+
Check the annotation precedence:
66+
67+
1. **Route-level annotations** override Gateway-level annotations
68+
2. **Gateway-level annotations** apply to all routes referencing that gateway
69+
3. **Invalid annotation values** (anything other than "true" or "false") are treated as "false"
70+
71+
Verify your annotation syntax:
72+
```bash
73+
kubectl get httproute my-route -o yaml | grep -A5 -B5 standalone
74+
```
75+
76+
**How do I access the VPC Lattice service ARN for AWS RAM sharing?**
77+
78+
The service ARN is automatically populated in the route annotations:
79+
80+
```bash
81+
# Get service ARN
82+
SERVICE_ARN=$(kubectl get httproute my-route -o jsonpath='{.metadata.annotations.application-networking\.k8s\.aws/lattice-service-arn}')
83+
84+
# Use for RAM sharing
85+
aws ram create-resource-share \
86+
--name "shared-lattice-service" \
87+
--resource-arns "$SERVICE_ARN" \
88+
--principals "123456789012"
89+
```
90+
91+
**Can I use standalone services with existing policies?**
92+
93+
Yes, all existing policies (IAMAuthPolicy, TargetGroupPolicy, AccessLogPolicy, VpcAssociationPolicy) work normally with standalone services. The only difference is the lack of automatic service network association.
94+
95+
**What happens if I have conflicting annotations on Gateway and Route?**
96+
97+
Route-level annotations always take precedence over Gateway-level annotations. For example:
98+
99+
- Gateway has `standalone: "true"`
100+
- Route has `standalone: "false"`
101+
- Result: The route creates a service network associated service
102+
103+
**Why don't I see the service ARN annotation immediately?**
104+
105+
The service ARN annotation is populated after the VPC Lattice service is successfully created. This typically takes 30-60 seconds. Check the route status and controller logs if the annotation doesn't appear within a few minutes.
106+
107+
**Can standalone services communicate across VPCs?**
108+
109+
Standalone services require explicit configuration for cross-VPC communication through **AWS RAM sharing** to share the service with other accounts/VPCs. Service network associated services automatically handle cross-VPC communication within the same service network.
110+
25111
**How do I prevent 503 errors during deployments?**
26112

27-
When using AWS Gateway API Controller with EKS, customers may experience 503 errors during deployments due to a timing gap between pod termination and VPC Lattice configuration propagation, which affects the time controller takes to deregister a terminating pod. We recommend setting `terminationGracePeriod` to at least 150 seconds and implementing a preStop hook that has a sleep of 60 seconds (but no more than the `terminationGracePeriod`). For optimal performance, also consider setting `ROUTE_MAX_CONCURRENT_RECONCILES` to 10 which further accelerates the pod deregistration process, regardless of the number of targets.
113+
When using AWS Gateway API Controller with EKS, customers may experience 503 errors during deployments due to a timing gap between pod termination and VPC Lattice configuration propagation, which affects the time controller takes to deregister a terminating pod. We recommend setting `terminationGracePeriod` to at least 150 seconds and implementing a preStop hook that has a sleep of 60 seconds (but no more than the `terminationGracePeriod`). For optimal performance, also consider setting `ROUTE_MAX_CONCURRENT_RECONCILES` to 10 which further accelerates the pod deregistration process, regardless of the number of targets.

‎docs/guides/advanced-configurations.md‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,40 @@ spec:
7575
statusMatch: "200-299"
7676
```
7777

78+
### Standalone VPC Lattice Services
79+
80+
You can create VPC Lattice services without automatic service network association using the `application-networking.k8s.aws/standalone` annotation. This provides more flexibility for independent service management scenarios.
81+
82+
For detailed information about standalone services, see the [Standalone VPC Lattice Services](standalone-services.md) guide.
83+
84+
#### Quick Example
85+
86+
```yaml
87+
apiVersion: gateway.networking.k8s.io/v1
88+
kind: HTTPRoute
89+
metadata:
90+
name: standalone-api
91+
annotations:
92+
application-networking.k8s.aws/standalone: "true"
93+
spec:
94+
parentRefs:
95+
- name: my-gateway
96+
rules:
97+
- matches:
98+
- path:
99+
type: PathPrefix
100+
value: /api
101+
backendRefs:
102+
- name: api-service
103+
port: 8080
104+
```
105+
106+
The service ARN will be available in the route annotations for integration with external systems:
107+
108+
```bash
109+
kubectl get httproute standalone-api -o jsonpath='{.metadata.annotations.application-networking\.k8s\.aws/lattice-service-arn}'
110+
```
111+
78112
### IPv6 support
79113

80114
IPv6 address type is automatically used for your services and pods if

0 commit comments

Comments
 (0)