Ingress and Route53 Issues with Druid AWS Deployments

Background

When deploying Druid with Kubernetes on AWS, it is common to use AWS ALB (Application Load Balancer) for traffic routing and load balancing. By configuring Kubernetes’ Ingress resource, ALB can route traffic to different services. At the same time, Route 53 needs to be configured to handle DNS domain name resolution so that applications can be accessed via domain names.

This configuration example shows how to set up the AWS ALB Ingress Controller to associate with the Kubernetes Ingress resource.

Debug

1. Obtaining the ALB Certificate ARN: If you need to configure an SSL/TLS certificate for ALB, you can obtain the certificate ARN through AWS ACM (AWS Certificate Manager), which you need to request from the SRE team. This certificate is used for HTTPS configuration. The following is a sample configuration:

   ingress:
     name: alb-ingress-route
     domain: druid-1.net
     enabled: true
   
   ingress2:
     name: alb-ingress2-route
     domain: druid-2.net
     enabled: true
   
   ingressClass:
     enable: true
     name: alb
     annotations:
       alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:xxx
       alb.ingress.kubernetes.io/subnets: sub-xxx
       alb.ingress.kubernetes.io/group.name: druid
       alb.ingress.kubernetes.io/healthcheck-path: /status/health
       alb.ingress.kubernetes.io/healthcheck-port: "8888"
       alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS": 443}]'
       alb.ingress.kubernetes.io/manage-backend-security-group-rules: "true"
       alb.ingress.kubernetes.io/scheme: internal
       alb.ingress.kubernetes.io/success-codes: "200"
       alb.ingress.kubernetes.io/tags: Owner=Gary
       alb.ingress.kubernetes.io/target-type: ip

2. Get Kubernetes Ingress address: Query the Ingress resource in Kubernetes via kubectl to get the ALB address. The following is a sample command and output:

   bwdev get ingress
   NAME                      CLASS   HOSTS                               ADDRESS                                                                  PORTS   AGE
   alb-ingress-route         alb     druid-1.net          internal-k8s-druid-xxx.elb.amazonaws.com   80      31d
   alb-ingress2-route        alb     druid-2.net   internal-k8s-druid-xxx.elb.amazonaws.com   80      31d

   The ADDRESS field is the DNS address of the AWS ALB. Use it as a record for configuring Route 53.

3. Modify the AWS Route 53 resource: Configure the appropriate A record or CNAME record for your domain name in AWS Route 53, ensuring that the druid-1.net and druid-2.net domain names point to the DNS address of the ALB (for example: internal-k8s-druid-xxx.elb.amazonaws.com).

   In the AWS Route 53 console, perform the following steps:

   • Create or update an A record that points to the DNS address of the ALB.
   • Ensure that the domain name resolution is set to Public or Private as required.

   Example record:

   druid-1.net   A   internal-k8s-druid-xxx.elb.amazonaws.com
   druid-2.net   A   internal-k8s-druid-xxx.elb.amazonaws.com

4. Verify Configuration: After completing the ALB and Route 53 configuration, you can verify that the ALB is routing traffic properly by accessing domain names such as druid-1.net and druid-2.net.

Conclusion

With the ALB Ingress Controller and Route 53 properly configured, you can route traffic to services in Kubernetes and use AWS-provided certificates for HTTPS encryption. The key steps include obtaining the certificate ARN, querying the Ingress address, and updating the Route 53 configuration. Ensure that all resources and domains are configured correctly to access your application.