AWS ACM support for GRPC protocol as backend #12795
Comments
|
This issue is currently awaiting triage. If Ingress contributors determines this is a relevant issue, they will accept it by applying the The Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
k8s-ci-robot
added
needs-triage
|
/remove-kind bug
I can expose my kube-prometheus-stack's prometheus service without GRPC, and using plain old HTTPS to controller and plaintext from controller to backend
|
k8s-ci-robot
added
needs-kind
|
Hey @longwuyuan , I'm trying to reach out to Thanos Sidecar exposed over gRPC protocol so that it can then ship metrics to Thanos store. So, I believe I need to use gRPC here. Also, I tried to remove these two annotations too but the same error in ingress controller pod |
|
Ingress is incoming rules so just adding backendprotocol gRPC annotation is
the only change needed AFAIK. What is the error message and more important
show a grpcurl request.
…On Tue, 4 Feb, 2025, 20:53 Lavesh S, ***@***.***> wrote:
Hey @longwuyuan <https://github.com/longwuyuan> ,
I'm trying to reach out to Thanos Sidecar exposed over gRPC protocol so
that it can then ship metrics to Thanos store. So, I believe I need to use
gRPC here.
Also, I tried to remove these two annotations too but the same error in
ingress controller pod
nginx.ingress.kubernetes.io/grpc-backend: "true"
nginx.ingress.kubernetes.io/protocol: h2c
—
Reply to this email directly, view it on GitHub
<#12795 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/ABGZVWQ3F6COD5T4WO2YEPD2ODLQZAVCNFSM6AAAAABWOQAVXWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDMMZUGMYDCNRVGE>
.
You are receiving this because you were mentioned.Message ID:
***@***.***>
|
|
We discussed this yesterday in the community meeting but could not conclude much.
There is one factor you are not understanding that when you use AWS ACM cert, then the termination of TLS is on the NLB and not on the controller. That means your installation of the controller needs to use the NLB-TEERMINATION related documentation to install the ingress-nginx controller https://kubernetes.github.io/ingress-nginx/deploy/#tls-termination-in-aws-load-balancer-nlb |
What happened:
I have a Thanos sidecar pod exposed on GRPC protocol. So, I want to create an nginx ingress for GRPC backend protocol with ingress controller load balancer service using AWS NLB having AWS ACM configured to it. With this in place, I wanted the requests to go flow smoothly but I see errors in ingress controller logs without any info which I can act on and troubleshoot.
Below are few manifest files
What you expected to happen:
I expected that metrics get exported to Thanos sidecar as expected and no connectivity issue. But I see the nginx ingress controller giving below error logs
So, I want to know how can I achieve this wherein I need to use AWS ACM Certs which is a requirement in my case and also use the nginx ingress.
NGINX Ingress controller version: 1.9.3
Kubernetes version (use
kubectl version): 1.30Environment:
Cloud provider or hardware configuration: AWS EKS 1.30
How was the ingress-nginx-controller installed:
If helm was used then please show output of
helm ls -A | grep -i ingress:ingress-nginx ingress 36 2024-11-04 11:53:23.847501744 +0000 UTC deployed ingress-nginx-4.8.2 1.9.3If helm was used then please show output of
helm -n <ingresscontrollernamespace> get values <helmreleasename>USER-SUPPLIED VALUES:
clusterName: SHARED-CUSTOMER-DEV-CL
controller:
allowSnippetAnnotations: true
autoscaling:
enabled: true
maxReplicas: 2
config:
enable-modsecurity: true
enable-real-ip: true
enable-underscores-in-headers: true
http-snippet: 'more_set_headers "X-ModSecurity: enabled";'
log-format-escape-json: true
log-format-upstream: '{"timestamp": "$time_iso8601", "requestID": "$req_id", "proxyUpstreamName":
"$proxy_upstream_name", "proxyAlternativeUpstreamName": "$proxy_alternative_upstream_name","upstreamStatus":
$upstream_status, "upstreamAddr": "$upstream_addr", "httpRequest": {"requestMethod":
"$request_method", "requestUrl": "$host$request_uri", "status": $status,"requestSize":
$request_length, "responseSize": $upstream_response_length, "userAgent": "$http_user_agent",
"remoteIp": "$remote_addr", "referer": "$http_referer", "latency": "$upstream_response_time
s", "protocol": "$server_protocol"}}'
modsecurity-snippet: |
# this enables the default OWASP Core Rule Set
Include /etc/nginx/owasp-modsecurity-crs/nginx-modsecurity.conf
extraArgs:
default-ssl-certificate: ingress/default-tls
metrics:
enabled: true
podAnnotations:
'"prometheus.io/port"': 10254
'"prometheus.io/scrape"': true
replicaCount: 1
tolerations:
key: mainnode
operator: Exists
The text was updated successfully, but these errors were encountered: