Skip to main content
logoTetrate Global Load BalancerVersion: Latest

Install Tetrate Global Load Balancer

Create the Helm Values File​

For each Edge Gateway cluster, we configure the solution using a cluster-specific helm values file. This defines the configurations needed for tetrate-gslb-controller and the two external-dns instances (one each for the regional and global zones).

External DNS configuration

For more details about configuring External-DNS, refer to:

Pull the helm chart and extract the appropriate values.yaml file to use as the template:

helm pull tetrate-tsb-helm/tetrate-gslb --version 1.2.1
tar -xzvf tetrate-gslb-1.2.1.tgz

ls tetrate-gslb/values*.yaml
# tetrate-gslb/values-aws.yaml  # template for AWS config
# tetrate-gslb/values.yaml      # template for Azure config

Copy the appropriate values file once for each cluster and fill it in.

Common Values for all clusters

The values marked (*) are common for all clusters. Other values are specific for each cluster

The values you will need to modify are:

  • Globally

    • dnsProvider (*): set to azure or aws
    • image:registry (*): set this to the address of your private registry
    • imagePullSecrets:name (*): set this to the name of the pull secret (if necessary)
    • allClustersGeoTags (*): a list of all clusterGeoTags across all regions
    • globalDNSZone (*): the base name (FQDN) of the Global Gateway DNS name
    • localDNSZone (*): the base name (FQDN) of the Regional Gateway DNS name
    • clusterIdentifier: each Edge Gateway cluster should have a unique identifier
    • clusterGeoTag: a common tag for all clusters in that region, such as 'eastus'
    • allClustersInLocalGeoTag: a list of all the clusterIdentifier values in the region
    • enableIstioProxyStatusCheck: this optional feature enables additional gateway health monitoring, verifying that all Gateway configuration has stabilized (not just that the gateway is ready)

  • For the regional external-dns install:

    • image:registry (*): as above
    • imagePullSecrets:name (*): as above
    • domainFilters (*): this list should contain the base name of the Regional Gateway DNS name

  • For the global external-dns install:

    • image:registry (*): as above
    • imagePullSecrets:name (*): as above
    • domainFilters (*): this list should contain the base name of the Global Gateway DNS name

  • For both external-dns installs - additional Azure settings:

    • azure:tenantId (*): your Azure Tenant ID
    • azure:subscriptionId (*): your Azure Subscription ID
    • azure:aadClientId (*): the appId value for the Global Service Principal (from the .json file)
    • azure:aadClientSecret (*): the password value for the Global Service Principal (from the .json file)
    • azure:resourceGroup (*): the name of the Resource Group for the Global Gateway DNS

  • For both external-dns installs - additional AWS settings:

    • aws.region: This cluster's region
    • zoneIdFilters: Both regional zones share a name, and External DNS can see every zone in the account, so without the zone ID it may write to the wrong region's zone.
    • serviceAccount.annotations: The IRSA role ARN; you just need to specify this once

Once the tetrate-gslb-values.yaml file is ready for each cluster, install or upgrade on each Edge Gateway cluster as follows.

Install the Tetrate GSLB Controller​

tip

Prerequisites: The Tetrate GSLB controller requires ServiceMonitor CRDs. These should be present in your target Kubernetes clusters. They are installed by Prometheus tooling.

kubectl config use-context aks-glbdemo01-eastus-0

helm upgrade --install tetrate-gslb tetrate-tsb-helm/tetrate-gslb -f tetrate-gslb-values-e1.yaml -n tetrate-gslb-system --create-namespace

# Check if the tetrate-gslb-controller and external-dns are up and running
kubectl get pods -n tetrate-gslb-system

# You should see output resembling:
#
# NAME                                                READY   STATUS    RESTARTS   AGE
# tetrate-gslb-69c748fd96-5sqbs                       1/1     Running   0          76s
# tetrate-gslb-external-dns-global-5c678b7979-9npq6   2/2     Running   0          76s
# tetrate-gslb-external-dns-local-5b49cffdfc-bmkbc    2/2     Running   0          76s

If the pods fail to start, the status will indicate the most likely reason:

  • Error ImagePullBackOff implies either an error in the secrets or registry configuration, meaning the image cannot be pulled
  • Error CrashLoopBackOff implies the image cannot start; perhaps an error in the authentication or service account configuration

The status (kubectl describe pod) and logs (kubectl logs) will provide more information.

AWS

Check that IRSA took effect — if this is empty, the service account annotation was missing when the pod started, so fix it and restart the deployment:

kubectl -n tetrate-gslb-system get pod -l app.kubernetes.io/name=external-dns-local \
  -o jsonpath='{.items[0].spec.containers[0].env[?(@.name=="AWS_ROLE_ARN")].value}'

Upgrade the Tetrate GSLB Controller​

Use the same helm upgrade command to upgrade each instance of the Tetrate GSLB controller to a newer version.

The GSLB Controller shares state between instances using DNS TXT records in the regional and global DNS zones. The schema and contents of the records may change between releases. It is possible that between upgrades, some records may no longer be required by the newer GSLB version and will be left orphaned.

It is safe to delete all DNS TXT records at any point. The Tetrate GSLB solution is robust to DNS failures and will re-create the required records. Note that you may see a short period of instability while the TXT records are recreated.