ALB Ingress
This approach uses the ALB Ingress Controller functionality provided by EKS.
Note
This approach will not address ODBC exposition, as ALB Ingress only supports HTTP/HTTPS connections. See ODBC connection through Ingress in EKS for further information.
ALB Ingress limitations
100 total rules per application load balancer.
Typically, only 100 Ingresses per ALB.
5 condition values per rule.
5 wildcards per rule.
5 weighted target groups per rule.
Only HTTP/HTTPS protocol.
Install ALB Ingress
To install ALB Ingress, see AWS Load Balancer Controller installation.
Note
To use External DNS, see Setup External DNS.
This feature is still in alpha release and should not be used in production.
Ingress definition
When you install ALB Ingress, the Ingress definition automatically creates an ALB.
Configure the paths
To configure the paths, use these values in the values.yaml
file in the HAProxy section of the Helm Chart:
# Used if MarkLogic Default APP-Servers are meant to be exposed under subpath different from / ####################################################################### # IMPORTANT NOTE: # # This feature is only supported with MarkLogic 11.1 and higher. # # See Limitations and known Issues in the README file. # ####################################################################### pathbased: enabled: true # This the default listening port in the Front-End section of the HAProxy when using Path based routing frontendPort: 443 # Path and port used on HAProxy # The same path will be used on Ingress for Default AppServers defaultAppServers: appservices: path: /console port: 8000 admin: path: /adminUI port: 8001 manage: path: /manage port: 8002
Configure the Ingress definition
The Ingress definition can be configured in the values.yaml
file:
## Configure Ingress ####################################################################### # IMPORTANT NOTE: # # Ingress is only supported with MarkLogic 11.1 and higher. # # See Limitations and known Issues in the README file. # ####################################################################### ## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/ ingress: enabled: true ## Ingress class ## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class className: "alb" ## Ingress labels ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ labels: app.kubernetes.io/instance: marklogic app.kubernetes.io/name: ml ## Ingress annotations ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ annotations: alb.ingress.kubernetes.io/healthcheck-port: '443' alb.ingress.kubernetes.io/healthcheck-path: /adminUI alb.ingress.kubernetes.io/success-codes: '200-401' alb.ingress.kubernetes.io/load-balancer-name: ml alb.ingress.kubernetes.io/scheme: internet-facing alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]' alb.ingress.kubernetes.io/target-group-attributes: load_balancing.algorithm.type=least_outstanding_requests alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-west-2:XXXXXXXXXXX:certificate/XxXXXXXX-xxxx-XXXX-XXXX-XXXXXXXxxxxXXX alb.ingress.kubernetes.io/target-type: ip alb.ingress.kubernetes.io/group.name: ml-group alb.ingress.kubernetes.io/load-balancer-attributes: idle_timeout.timeout_seconds=600,routing.http.xff_header_processing.mode=append
Note
The path definition of the Ingress will be the same as defined in the HAProxy section.
Configuration details
Code |
Description |
---|---|
alb.ingress.kubernetes.io/healthcheck-port |
Specifies the port on which to perform the health check. |
alb.ingress.kubernetes.io/healthcheck-path |
Specifies the path used for the health check. |
alb.ingress.kubernetes.io/load-balancer-name: ml |
Specifies the prefix for the name of the ALB. Note that name impacts the entire IngressGroup. |
alb.ingress.kubernetes.io/scheme: internet-facing |
Specifies the scheme. Because MarkLogic app-servers should be exposed from outside of the cluster and outside of the cloud, this is set it to internet-facing. |
alb.ingress.kubernetes.io/listen-ports |
Specifies the listening port for each Ingress. The syntax is : <protocol>:<port>. Protocol can only be HTTP or HTTPS. |
alb.ingress.kubernetes.io/target-group-attributes |
Specifies the target group attributes as the load balancing algorithm. |
alb.ingress.kubernetes.io/certificate-arn |
Specifies the certificates to be used (HTTPS termination on the ALB should be enabled). |
alb.ingress.kubernetes.io/target-type |
Specifies the target type. The target type can be instance or ip. instance type is only available if the target service is type NodePort. |
alb.ingress.kubernetes.io/group.name |
Specifies the group name for the ALB. This allows several Ingresses to use the same ALB. group.name and load.balancer.name have to be the same in the same IngressGroup. |
For additional annotations, see the complete list.
Check the ALB
Go to the AWS Console and check what the created ALB looks like:
![The AWS Console.](../../image/166a15b326ff38.png)
![The AWS Console](../../image/166a15b3272401.png)
Route53
Because the ALB scheme is specified as internet-facing, the automatically generated DNS name can be used. However, it is more convenient to use a proper DNS name. This is done using Route53:
Configure Route53 with one hosted zone:
Create a dedicated record to point to the ALB: