Consul-k8s Helm Install Fails on EKS with ALB Configuration

Consul on EKS: Helm Install Fails with ALB Configuration

This article focuses on installing Consul on Amazon EKS via Helm, specifically when deploying Consul's access UI via a Network Load Balancer (NLB) but wanting to utilize an Application Load Balancer (ALB) instead. The configuration process will be discussed, highlighting the key concepts required to ensure a successful installation.

Installing Consul on EKS Using Helm

The installation of Consul on EKS using Helm involves the following general steps:

Installing Helm on your local machine.

Creating an EKS cluster with the appropriate node group configurations.

Installing Consul on the EKS cluster using Helm.

Focusing on ALB Configuration

The problem arises when deploying the Consul access UI via a Network Load Balancer (NLB) instead of an Application Load Balancer (ALB) which is the preferred method. The issue is with the configuration of the ALB to work with the Consul access UI.

To use an ALB for the Consul access UI, the following steps should be taken:

1. Create a new ALB using AWS console or AWS CLI, specifying the correct listeners and security groups.

   $ aws elbv2 create-load-balancer --name my-alb --type application --subnets subnet-1 subnet-2 --security-groups sg-1
   

2. Create an Ingress resource for Consul, specifying the ALB's DNS name as the host and the correct path.

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: consul-ingress
     annotations:
       nginx.ingress.kubernetes.io/proxy-body-size: 50m
       nginx.ingress.kubernetes.io/proxy-read-timeout: 600
   spec:
     rules:
     - host: my-alb-dns-name # replace with the actual name
       http:
         paths:
         - path: /ui(/|$)(.*)
           pathType: Prefix
           pathRewrite: /ui/
           backend:
             service:
               name: consul
               port:
                 name: http
   

Key Concepts

To ensure a successful installation, it is required to understand the following concepts:

• AWS Elastic Load Balancer (ALB) vs. Network Load Balancer (NLB): ALB is better suited for HTTP and HTTPs traffic due to its flexibility in routing, security, and additional features, making it the preferred option for the Consul access UI.

• Consul Ingress Resource: Ingress resources are used for exposing services within a cluster, i.e., allowing external access to a service inside the cluster. This resource is used to specify the ALB as the frontend and Consul as the backend service, as well as the path for the Consul access UI.

• Annotations for the Consul Ingress: These provide additional control over the behavior of the Ingress resource, such as the proxy body size and read timeout settings.

Troubleshooting and Summary

If the installation still fails, it is recommended to verify the following:

• Check the configuration of the ALB and Ingress resource, ensuring the settings are correct.
• Ensure the security group and network settings for the ALB allow traffic from and to the correct resources.
• Check the EKS cluster and node group configurations to ensure they are compatible with Consul and the ALB.

In conclusion, successfully installing Consul on EKS using Helm while deploying the Consul access UI via an Application Load Balancer (ALB) requires a proper configuration of the ALB and the Consul Ingress resource. Understanding the key concepts, such as the differences between ALB and NLB, Consul Ingress, and annotations, as well as verifying the configuration settings, can aid in a successful installation.

References

• Consul Helm Chart: https://github.com/hashicorp/consul-helm
• AWS Elastic Load Balancer (ALB) vs. NLB: https://aws.amazon.com/elasticloadbalancing/features/
• Consul Ingress Resource: https://www.consul.io/docs/k8s/inception.html