Eu tenho um cluster EKS com a seguinte configuração
2 VPCS 1 produto, 1 estágio
cada vpc tem 3 sub-redes, 1 pública e 2 privadas
cada vpc tem 1 gateway de internet e 1 gateway nat
As sub-redes privadas são conectadas ao natgateway por meio de associação de tabela de rotas.
Eu tenho um cluster eks e um grupo de nós gerenciado pelo aws
o grupo de nós é mapeado para as sub-redes privadas.
Instalei um controlador ingress-nginx que cria um balanceador de carga de rede.
Este balanceador de carga de rede funciona perfeitamente em estágio, mas não em produção.
Os balanceadores de carga de rede para ambos os vpcs são criados na zona eu-norte-1a
A instância de destino do balanceador de carga de teste é criada na zona eu-north-1a, enquanto a do balanceador de carga prod é criada na zona eu-north-1b e retorna o seguinte erro:
Targets are not within enabled Availability Zones
Some targets are not receiving traffic because they are in Zones that are not enabled for your load balancer.
Unused target zones
eu-north-1b
To resolve
There are two options:
Enable these Zones on the load balancer by visiting the load balancer detail page and adding subnets in these Zones. View load balancer
Or, deregister targets that are in these Zones. View targets in unused Zones
```
So the staging and prod clusters are identical. The subnets and ingress-nginx configs are identical, everything is identical. But I can't seem to figure out why prod is failing, and staging is not. What could I be missing?
The values file for the ingress:
ingress-nginx:
controller:
replicaCount: 2
resources:
limits:
memory: 300Mi
requests:
memory: 256Mi
service:
annotations:
service.beta.kubernetes.io/aws-load-balancer-type: nlb
externalTrafficPolicy: Local
healthCheckNodePort: 30254
stats:
enabled: true
config:
client-max-body-size: "25m"
http-redirect-code: "301"
proxy-buffer-size: 128k
proxy-buffers: 4 256k
proxy-connect-timeout: "600"
proxy-read-timeout: "600"
ssl-ciphers: "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA"
ssl-protocols: "TLSv1.2 TLSv1.3"
# use-forwarded-headers: "true"
# use-proxy-protocol: "true"
# compute-full-forwarded-for: "true"
# enable-real-ip: "true"
# forwarded-for-header: X-Forwarded-For
log-format-upstream: '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" "$http_x_forwarded_for" $upstream_http_resonseHeaderName $ssl_protocol $ssl_cipher'
rbac:
create: true
serviceAccount:
create: true