AWS Global Accelerator in front of ALB managed with EKS alb ingress health checks fail

Question

got an EKS cluster with alb ingress controller and external DNS connected to route53, now some clients want static IPs or IP range for connecting to our servers and whitelisting these IPs in their firewall.

Tried the new AWS Global Accelerator, followed this tutorial https://docs.aws.amazon.com/global-accelerator/latest/dg/getting-started.html but it fails with :

Listeners in this accelerator have an unhealthy status. To make sure that Global Accelerator can run health checks successfully, ensure that a service is responding on the protocol and port that you specified in the health check configuration. Learn more

With further reading understood that the healthchecks will be the same configured at the ALB, also that it might fail because of the route53 Healthchecks ips are not whitelisted but all the inbound traffic is open in ports 80 and 443, so not quite sure how to further debug this or if there is any other solution for getting an ip range or static ip for the ALB.

Answer 1

You need to add a healthcheck rule like this one to the ingress controller:

- http:
    paths:
      - path: /global-accelerator-healthcheck
        backend:
          serviceName: global-accelerator-healthcheck
          servicePort: use-annotation

Then an annotation:

    alb.ingress.kubernetes.io/actions.global-accelerator-healthcheck: '{"Type": "fixed-response", "FixedResponseConfig": {"ContentType": "text/plain", "StatusCode": "200", "MessageBody": "healthy" }}'

Then configure the global accelerator to the health checks to that endpoint

Answer 2

When it comes to AWS ALB Ingress controller, always try to think of it as you are working with AWS ALB, and its Target Groups.

• You can even identify the ALB and its target groups by logging in to AWS console UI.
• To answer your question try adding following details to your ingress,

code:

annotations:
alb.ingress.kubernetes.io/healthcheck-protocol: HTTP
alb.ingress.kubernetes.io/healthcheck-port: "8161"
alb.ingress.kubernetes.io/healthcheck-path: /admin
alb.ingress.kubernetes.io/success-codes: '401'
alb.ingress.kubernetes.io/backend-protocol: HTTP`

Note: If you have different health check settings for different services, remove this block from K8s "Ingress" and add blocks per K8s "Service".

If more information required, please refer to: https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.1/guide/ingress/annotations/