WIP: Application load balancer controller by fischerman · Pull Request #3 · stackitcloud/application-load-balancer-controller

fischerman · 2026-06-24T20:24:10Z

No description provided.

nschad · 2026-06-25T09:58:47Z

@fischerman either mark the PR as "Draft" or use "WIP" as the title. The PR will then automatically marked as WIP/Draft

ske-prow · 2026-06-25T14:33:32Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign dergeberl for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Co-authored-by: Kamil Przybyl <Kamil.Przybyl@digits.schwarz>

fischerman · 2026-06-26T09:19:42Z

I've copied the file over from the CCM.

alright @fischerman lgtm!

Adi146 · 2026-06-26T09:30:39Z

+		}
+
+		ingressList := &networkingv1.IngressList{}
+		if err := c.List(ctx, ingressList, client.InNamespace(secret.Namespace)); err != nil {


That could probably be optimized with MatchingFields

dergeberl

This is my first batch of review comments. Only had a look into the /cmd/*, /pkg/controller/* (except the tests) and the *.md files, yet. I will continue with my review for the rest.

Maybe some comments are already resolved as you also pushed during my review (I did not crosscheck again, before submitting the comments now).

dergeberl · 2026-06-25T14:43:18Z

+| `alb.stackit.cloud/traget-pool-tls-skip-certificate-validation`| Boolean | IngressClass, Ingress, Service | Optional | Enables TLS bridging but skips certificate validation. |
+| `alb.stackit.cloud/allowed-source-ranges`| String | IngressClass | Accepts a comma-separated list of IP ranges. E.g. 10.0.0.0/24,1.2.3.4/32. If unset, all IPs are allowed. |
+
+### Known Limitations


Maybe we add the NodePort requirement here? Also there are limits in the amount of resources (like listeners) which we should add here (or somewhere else).

dergeberl · 2026-06-26T12:04:57Z

+### Limits
+
+The following limitations are imposed directly by the STACKIT ALB API (not the controller itself):
+- Maximum targets per pool: An individual target pool can contain a maximum of 250 targets.


The limit should be 1000 or?

dergeberl · 2026-06-26T12:07:20Z

+
+#### When to watch out for the listener limit
+
+Because each IngressClass provisions a dedicated ALB instance, hitting the 20-listener threshold is rarely an issue for a basic setup but becomes a real risk when you start stacking custom ports across multiple applications sharing that same ALB. If your Ingress resources use the `alb.stackit.cloud/http-port` or `alb.stackit.cloud/https-port` annotations to expose different apps on unique custom port numbers, each distinctive port allocates its own listener on the shared ALB instance. This risk compounds quickly when those applications also require TLS encryption; since the controller must keep an extra HTTP listener active alongside the HTTPS listener to smoothly process automated ACME certificate challenges, a single secure app immediately consumes two slots instead of one, accelerating how fast you approach the API limit if multiple unique custom ports are configured.


This needs a rephrase. The ALB per ingress does not make it rarely to hit the limit (It is the default of 2 ports).

dergeberl · 2026-06-26T12:07:31Z

+
+A "target" in a pool corresponds directly to a worker node in your cluster. If you run a large cluster with a high number of worker nodes, or expect your cluster to dynamically scale to a large size, keep this limit in mind since a single backend Service port mapping cannot route traffic to more than 250 worker nodes simultaneously.
+
+#### When to watch out for the listener limit


Also something for the Known Limitations.

dergeberl · 2026-06-26T12:08:42Z

+
+Because each IngressClass provisions a dedicated ALB instance, hitting the 20-listener threshold is rarely an issue for a basic setup but becomes a real risk when you start stacking custom ports across multiple applications sharing that same ALB. If your Ingress resources use the `alb.stackit.cloud/http-port` or `alb.stackit.cloud/https-port` annotations to expose different apps on unique custom port numbers, each distinctive port allocates its own listener on the shared ALB instance. This risk compounds quickly when those applications also require TLS encryption; since the controller must keep an extra HTTP listener active alongside the HTTPS listener to smoothly process automated ACME certificate challenges, a single secure app immediately consumes two slots instead of one, accelerating how fast you approach the API limit if multiple unique custom ports are configured.
+
+### Configuration


Please check that this are all, WAF seems to be missing

dergeberl · 2026-06-26T12:12:16Z

@@ -0,0 +1,5 @@
+# Application load balancer (ALB) controller
+


Please add a short description what this controller does and a hint in the beginning that this is alpha and probably get bigger changes.

ske-prow · 2026-06-26T15:33:02Z

@fischerman: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-application-load-balancer-controller-verify	`836aba1`	link	true	`/test pull-application-load-balancer-controller-verify`

Full PR test history. Your PR dashboard. Command help for this repository.
Please help us cut down on flakes by linking this test failure to an open flake report or filing a new flake report if you can't find an existing one. Also see the gardener testing guideline for how to avoid and hunt flakes.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

ske-prow Bot added do-not-merge/needs-kind Indicates a PR lacks a `kind/foo` label and requires one. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Jun 24, 2026

nschad changed the title ~~Draft: Application load balancer controller~~ WIP: Application load balancer controller Jun 25, 2026

ske-prow Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 25, 2026

nschad force-pushed the main branch from e5c3fee to fba4e1b Compare June 25, 2026 14:11

dergeberl requested review from breuerfelix, dergeberl and hown3d June 25, 2026 14:29

ske-prow Bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 25, 2026

kamilprzybyl and others added 19 commits June 25, 2026 16:34

docs: add user documentation for ALB Ingress controller (#2)

2f824df

Co-authored-by: Kamil Przybyl <Kamil.Przybyl@digits.schwarz>

Move ALBC from CCM repository

56ba53d

Fix some linter issues

62d9cfe

Fixed controller tests

9cdcdb3

Add event handler for services

40658b0

Verbosity levels

7ea52ba

Delete certificates on ingress class deletion

dc97548

Move labels package into spec

ef8a935

Clear some TODOs

8ff5db0

Give certificates a proper name

a74c86d

Remove unused certificates even after creation

6438207

Ingress class annotation

1c9d8e1

Support source ranges

e0a040e

Do a couple of documentation TODOs

6f7137e

Implement target pool limit

0a0ae5c

Document target pool limits

5675ad5

Fix test

c23a556

Support internal ALBs

d539b21

Support static LBs

209f335

fischerman force-pushed the albc branch from d73714b to 209f335 Compare June 25, 2026 14:37

ske-prow Bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 25, 2026

fischerman added 10 commits June 25, 2026 16:41

Use index for paths

dab4dd0

Support TLS bridging

49aebaf

Refine health checks

0a2244a

Remove TODO

6d897bd

Adjust TODO comments

34bef9f

Support out-of-band log configuration

6cf1730

Define semantics for implementation-specific path

7e56834

Update test for rule ordering

9488817

Add test for update version

b75661e

Fix linter issues

d68811b

fischerman commented Jun 26, 2026

View reviewed changes

Improve controller tests

c06a1e5

Adi146 reviewed Jun 26, 2026

View reviewed changes

dergeberl reviewed Jun 26, 2026

View reviewed changes

fischerman added 11 commits June 26, 2026 16:21

Assign certificates per port

a73247f

Link annotations

2b534a6

Use node port in docs

0ab0e3a

Enable leader election by default

8bcd2b4

Index secret references on ingresses

72be85e

Fix typo

0ee779b

Fix typo

df49b6e

Fix typo

852678c

Fix typo

93cb3d7

Fix typo

9e8cb89

Fix path collision detection

836aba1


		#### When to watch out for the listener limit

		Because each IngressClass provisions a dedicated ALB instance, hitting the 20-listener threshold is rarely an issue for a basic setup but becomes a real risk when you start stacking custom ports across multiple applications sharing that same ALB. If your Ingress resources use the `alb.stackit.cloud/http-port` or `alb.stackit.cloud/https-port` annotations to expose different apps on unique custom port numbers, each distinctive port allocates its own listener on the shared ALB instance. This risk compounds quickly when those applications also require TLS encryption; since the controller must keep an extra HTTP listener active alongside the HTTPS listener to smoothly process automated ACME certificate challenges, a single secure app immediately consumes two slots instead of one, accelerating how fast you approach the API limit if multiple unique custom ports are configured.


		A "target" in a pool corresponds directly to a worker node in your cluster. If you run a large cluster with a high number of worker nodes, or expect your cluster to dynamically scale to a large size, keep this limit in mind since a single backend Service port mapping cannot route traffic to more than 250 worker nodes simultaneously.

		#### When to watch out for the listener limit


		Because each IngressClass provisions a dedicated ALB instance, hitting the 20-listener threshold is rarely an issue for a basic setup but becomes a real risk when you start stacking custom ports across multiple applications sharing that same ALB. If your Ingress resources use the `alb.stackit.cloud/http-port` or `alb.stackit.cloud/https-port` annotations to expose different apps on unique custom port numbers, each distinctive port allocates its own listener on the shared ALB instance. This risk compounds quickly when those applications also require TLS encryption; since the controller must keep an extra HTTP listener active alongside the HTTPS listener to smoothly process automated ACME certificate challenges, a single secure app immediately consumes two slots instead of one, accelerating how fast you approach the API limit if multiple unique custom ports are configured.

		### Configuration

Uh oh!

Conversation

fischerman commented Jun 24, 2026

Uh oh!

nschad commented Jun 25, 2026

Uh oh!

ske-prow Bot commented Jun 25, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dergeberl left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ske-prow Bot commented Jun 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants