如何通过Istio入口网关部署配置AWS NLB/ALB标签及自定义标签？

Absolutely! You can totally add custom AWS tags to the NLB or ALB provisioned by your Istio Ingress Gateway. Here are the two most reliable methods to achieve this:

Method 1: Add Annotations to the Istio Ingress Gateway Service #

The easiest way is to modify the Kubernetes Service associated with your Istio Ingress Gateway, using AWS-specific annotations supported by the AWS Load Balancer Controller (the component that manages AWS LBs for Kubernetes).

Step-by-Step: #

1. Edit the existing istio-ingressgateway Service in the istio-system namespace:

   kubectl edit service istio-ingressgateway -n istio-system
   

2. Add the service.beta.kubernetes.io/aws-load-balancer-additional-resource-tags annotation under the metadata.annotations section. Use comma-separated key-value pairs for your custom tags:

   metadata:
     name: istio-ingressgateway
     namespace: istio-system
     annotations:
       # Add your custom tags here
       service.beta.kubernetes.io/aws-load-balancer-additional-resource-tags: "Environment=Production,Team=DevOps,App=IstioIngress,CostCenter=CC-456"
       # Keep other existing annotations as-is
   

3. Save the changes. The AWS Load Balancer Controller will automatically sync these tags to your NLB/ALB within a few minutes.

Method 2: Configure Tags During Istio Installation (Using IstioOperator) #

If you're setting up Istio from scratch with IstioOperator, you can predefine the annotations directly in your installation config so the tags are applied right away.

Example IstioOperator Config: #

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: istio-system
spec:
  profile: default
  components:
    ingressGateways:
      - name: istio-ingressgateway
        enabled: true
        k8s:
          serviceAnnotations:
            # Define custom tags here
            service.beta.kubernetes.io/aws-load-balancer-additional-resource-tags: "Environment=Staging,Owner=SRE-Team"
          # Include other service specs (ports, selector, etc.) as needed

Apply this config with:

istioctl install -f your-istio-operator-config.yaml

Key Notes #

• Prerequisite: Make sure the AWS Load Balancer Controller is installed in your cluster. Istio relies on this controller to manage AWS LB resources and sync tags—without it, the annotations won't take effect.
• AWS Tag Rules: Ensure your tag keys/values follow AWS's rules: keys max 128 characters, values max 256 characters, allowed characters include letters, numbers, spaces, and symbols like + - = . _ : / @.
• Sync Delay: After applying changes, it might take 2-5 minutes for the tags to appear in the AWS Console—this is normal as the controller syncs the configuration.

内容的提问来源于stack exchange，提问作者Harsha G V