AWS ALB not resolving

2/11/2019

So I have an EKS cluster, and have set up the AWS Alb Ingress Controller:

https://github.com/kubernetes-sigs/aws-alb-ingress-controller

I'm trying to set up Grafana here, and the Ingress is created but it doesn't seem to resolve at all.

I have the follow Ingress:

$ kubectl describe ingress grafana
Name:             grafana
Namespace:        orbix-mvp
Address:          4ae1e4ba-orbixmvp-grafana-fd7d-993303634.eu-central-1.elb.amazonaws.com
Default backend:  default-http-backend:80 (<none>)
Rules:
  Host                        Path  Backends
  ----                        ----  --------
  grafana-orbix.orbixpay.com  
                              /   grafana:80 (<none>)
Annotations:
  alb.ingress.kubernetes.io/scheme:         internet-facing
  alb.ingress.kubernetes.io/ssl-policy:     ELBSecurityPolicy-2016-08
  alb.ingress.kubernetes.io/subnets:        subnet-08431d96168e36c30,subnet-0e2a7e2766852bf8a
  alb.ingress.kubernetes.io/success-codes:  302
  kubernetes.io/ingress.class:              alb
Events:
  Type    Reason  Age   From                    Message
  ----    ------  ----  ----                    -------
  Normal  CREATE  45m   alb-ingress-controller  LoadBalancer 4ae1e4ba-orbixmvp-grafana-fd7d created, ARN: arn:aws:elasticloadbalancing:eu-central-1:109153834985:loadbalancer/app/4ae1e4ba-orbixmvp-grafana-fd7d/4b98cb7027b71697
  Normal  CREATE  45m   alb-ingress-controller  rule 1 created with conditions [{    Field: "host-header",    Values: ["grafana-orbix.orbixpay.com"]  },{    Field: "path-pattern",    Values: ["/"]  }]

The backend fro it is the following service:

$ kubectl describe service grafana
Name:                     grafana
Namespace:                orbix-mvp
Labels:                   app=grafana
                          chart=grafana-1.25.1
                          heritage=Tiller
                          release=grafana
Annotations:              <none>
Selector:                 app=grafana,release=grafana
Type:                     NodePort
IP:                       172.20.11.232
Port:                     service  80/TCP
TargetPort:               3000/TCP
NodePort:                 service  30772/TCP
Endpoints:                10.0.0.180:3000
Session Affinity:         None
External Traffic Policy:  Cluster
Events:                   <none>

It does have a proper endpoint:

$ kubectl get endpoints | grep grafana
grafana                         10.0.0.180:3000                  46m

The pod itself is properly tagged and has the correct IP that's the endpoint above:

$ kubectl describe pod grafana-bdc977fd4-ptzhg
Name:               grafana-bdc977fd4-ptzhg
Namespace:          orbix-mvp
Priority:           0
PriorityClassName:  <none>
Node:               ip-10-0-0-230.eu-central-1.compute.internal/10.0.0.230
Start Time:         Mon, 11 Feb 2019 13:24:43 +0200
Labels:             app=grafana
                    pod-template-hash=687533980
                    release=grafana
Annotations:        <none>
Status:             Running
IP:                 10.0.0.180

My AWS account has the LoadBalancer listed as Active, the subnets are on the same VPC as the cluster, security groups are being generated by the Ingress Controller.

Everything seems to be set up properly, however when I access the LoadBalancer address, it just times out.

$ kubectl get ingresses
NAME                HOSTS                           ADDRESS                                                                     PORTS   AGE
grafana             grafana-orbix.orbixpay.com      4ae1e4ba-orbixmvp-grafana-fd7d-993303634.eu-central-1.elb.amazonaws.com     80      49m
-- Neekoy
amazon-web-services
kubernetes

1 Answer

2/11/2019

I actually figured it out - the Ingress configuration was allowing for traffic for the domain only. That excludes traffic to the load balancer address (which I assumed is allowed by default).

Basically it needs to be allowed for * in order for the Load Balancer URL to work too. Also, if the app redirects to /login like in my case, all paths need to be allowed too, since that redirect doesn't work if the path specified is for / only.

-- Neekoy
Source: StackOverflow