Skip to content

Commit 3630c5c

Browse files
gytis-ivaskeviciusgytis-ivaskevicius
authored
Merge pull request #1371 from input-output-hk/global-accelerator
chore: implement AWS Global Accelerator
2 parents 95ac6d5 + 96a5a61 commit 3630c5c

File tree

5 files changed

+59
-25
lines changed

5 files changed

+59
-25
lines changed

‎nix/cardano-services/deployments/backend-ingress.nix

+51-21
Original file line numberDiff line numberDiff line change
@@ -6,35 +6,65 @@
66
utils,
77
...
88
}: {
9+
templates.accelerator = lib.mkIf (values.useAccelerator && values.ingress.enabled) {
10+
apiVersion = "operator.h3poteto.dev/v1alpha1";
11+
kind = "EndpointGroupBinding";
12+
metadata.name = "${chart.name}-main";
13+
spec = {
14+
endpointGroupArn = values.acceleratorArn;
15+
ingressRef.name = "${chart.name}-backend";
16+
};
17+
};
18+
919
templates.backend-ingress = lib.mkIf values.ingress.enabled {
1020
apiVersion = "networking.k8s.io/v1";
1121
kind = "Ingress";
1222
metadata = {
1323
name = "${chart.name}-backend";
1424
labels = utils.appLabels "backend";
15-
annotations = {
16-
"alb.ingress.kubernetes.io/actions.ssl-redirect" = builtins.toJSON {
17-
Type = "redirect";
18-
RedirectConfig = {
19-
Protocol = "HTTPS";
20-
Port = "443";
21-
StatusCode = "HTTP_301";
25+
annotations =
26+
if values.useAccelerator
27+
then {
28+
"service.beta.kubernetes.io/aws-load-balancer-backend-protocol" = "tcp";
29+
"service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled" = "true";
30+
"service.beta.kubernetes.io/aws-load-balancer-type" = "external";
31+
"alb.ingress.kubernetes.io/scheme" = "internet-facing";
32+
"service.beta.kubernetes.io/aws-load-balancer-scheme" = "internet-facing";
33+
"alb.ingress.kubernetes.io/target-type" = "ip";
34+
"service.beta.kubernetes.io/aws-load-balancer-nlb-target-type" = "ip";
35+
"service.beta.kubernetes.io/aws-load-balancer-proxy-protocol" = "*";
36+
"service.beta.kubernetes.io/aws-load-balancer-target-group-attributes" = "proxy_protocol_v2.enabled=true,preserve_client_ip.enabled=true";
37+
38+
"alb.ingress.kubernetes.io/listen-ports" = builtins.toJSON [{HTTP = 80;} {HTTPS = 443;}];
39+
#"alb.ingress.kubernetes.io/wafv2-acl-arn" = values.backend.wafARN;
40+
"alb.ingress.kubernetes.io/healthcheck-path" = "${values.cardano-services.httpPrefix}/health";
41+
"alb.ingress.kubernetes.io/healthcheck-interval-seconds" = toString values.backend.albHealthcheck.interval;
42+
"alb.ingress.kubernetes.io/healthcheck-timeout-seconds" = toString values.backend.albHealthcheck.timeout;
43+
"alb.ingress.kubernetes.io/group.order" = toString values.cardano-services.ingresOrder;
44+
"external-dns.alpha.kubernetes.io/disabled" = "true";
45+
}
46+
else {
47+
"alb.ingress.kubernetes.io/actions.ssl-redirect" = builtins.toJSON {
48+
Type = "redirect";
49+
RedirectConfig = {
50+
Protocol = "HTTPS";
51+
Port = "443";
52+
StatusCode = "HTTP_301";
53+
};
2254
};
55+
"alb.ingress.kubernetes.io/listen-ports" = builtins.toJSON [{HTTP = 80;} {HTTPS = 443;}];
56+
"alb.ingress.kubernetes.io/target-type" = "ip";
57+
"alb.ingress.kubernetes.io/scheme" = "internet-facing";
58+
"alb.ingress.kubernetes.io/wafv2-acl-arn" = values.backend.wafARN;
59+
"alb.ingress.kubernetes.io/healthcheck-path" = "${values.cardano-services.httpPrefix}/health";
60+
"alb.ingress.kubernetes.io/healthcheck-interval-seconds" = toString values.backend.albHealthcheck.interval;
61+
"alb.ingress.kubernetes.io/healthcheck-timeout-seconds" = toString values.backend.albHealthcheck.timeout;
62+
# Use latency routing policy
63+
"external-dns.alpha.kubernetes.io/aws-region" = config.region;
64+
"external-dns.alpha.kubernetes.io/set-identifier" = values.backend.dnsId;
65+
"alb.ingress.kubernetes.io/group.name" = chart.namespace;
66+
"alb.ingress.kubernetes.io/group.order" = toString values.cardano-services.ingresOrder;
2367
};
24-
"alb.ingress.kubernetes.io/listen-ports" = builtins.toJSON [{HTTP = 80;} {HTTPS = 443;}];
25-
"alb.ingress.kubernetes.io/target-type" = "ip";
26-
"alb.ingress.kubernetes.io/scheme" = "internet-facing";
27-
"alb.ingress.kubernetes.io/wafv2-acl-arn" = values.backend.wafARN;
28-
"alb.ingress.kubernetes.io/healthcheck-path" = "${values.cardano-services.httpPrefix}/health";
29-
"alb.ingress.kubernetes.io/healthcheck-interval-seconds" = toString values.backend.albHealthcheck.interval;
30-
"alb.ingress.kubernetes.io/healthcheck-timeout-seconds" = toString values.backend.albHealthcheck.timeout;
31-
# Use latency routing policy
32-
"external-dns.alpha.kubernetes.io/aws-region" = config.region;
33-
"external-dns.alpha.kubernetes.io/set-identifier" = values.backend.dnsId;
34-
"alb.ingress.kubernetes.io/group.name" = chart.namespace;
35-
# ACM
36-
"alb.ingress.kubernetes.io/group.order" = toString values.cardano-services.ingresOrder;
37-
};
3868
};
3969
spec = {
4070
ingressClassName = "alb";

‎nix/cardano-services/deployments/default.nix

+5-1
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,8 @@ in
102102
};
103103

104104
values = {
105+
useAccelerator = false;
106+
acceleratorArn = tf-outputs.${final.region}.accelerators.${final.namespace} or null;
105107
postgresName = "${final.namespace}-postgresql";
106108
stakepool.databaseName = "stakepool";
107109
ingress.enabled = true;
@@ -216,6 +218,7 @@ in
216218
};
217219

218220
values = {
221+
useAccelerator = true;
219222
ws-server.enabled = true;
220223
stakepool.databaseName = "stakepoolv2";
221224
cardano-services = {
@@ -417,6 +420,7 @@ in
417420
};
418421

419422
values = {
423+
useAccelerator = true;
420424
ws-server.enabled = true;
421425
stakepool.databaseName = "stakepoolv2";
422426
backend.allowedOrigins = lib.concatStringsSep "," allowedOriginsDev;
@@ -866,7 +870,6 @@ in
866870
(map (v: "/v${v}/handle") versions.handle)
867871
];
868872
};
869-
chain-history-provider.enabled = false;
870873
};
871874

872875
"ops-preview-1@us-east-1" = final: {
@@ -902,6 +905,7 @@ in
902905
};
903906

904907
values = {
908+
useAccelerator = true;
905909
cardano-services = {
906910
ingresOrder = 99;
907911
};

‎nix/cardano-services/deployments/tf-outputs/lace-dev-us-east-1.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
{"acm_arn":"arn:aws:acm:us-east-1:926093910549:certificate/f136a39b-3556-4ddf-85ac-ac5b7431dd34","acm_dapp_arn":"arn:aws:acm:us-east-1:926093910549:certificate/84cb06a8-cf8e-4485-b117-d0ff5c8304b0","waf_arn":"arn:aws:wafv2:us-east-1:926093910549:regional/webacl/rate-limit/d4216c0e-b464-4383-953f-3262f4cd3cb6"}
1+
{"accelerators":{"dev-preprod":"arn:aws:globalaccelerator::926093910549:accelerator/75241ddd-9ca6-4907-9fb4-ed6973e39563/listener/2e35ef83/endpoint-group/cd0c364c0002","dev-preview":"arn:aws:globalaccelerator::926093910549:accelerator/792713c0-b902-47c1-ba82-4d38a8e06ae9/listener/18235bfe/endpoint-group/c487a8452002","ops-preprod-1":"arn:aws:globalaccelerator::926093910549:accelerator/3c1f8a14-aa0b-4114-b287-33ea56f0ddcb/listener/51576def/endpoint-group/7fde6f56d002"},"acm_arn":"arn:aws:acm:us-east-1:926093910549:certificate/f136a39b-3556-4ddf-85ac-ac5b7431dd34","acm_dapp_arn":"arn:aws:acm:us-east-1:926093910549:certificate/84cb06a8-cf8e-4485-b117-d0ff5c8304b0","waf_arn":"arn:aws:wafv2:us-east-1:926093910549:regional/webacl/rate-limit/d4216c0e-b464-4383-953f-3262f4cd3cb6"}

‎nix/cardano-services/deployments/tf-outputs/lace-live-eu-central-1.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
{"acm_arn":"arn:aws:acm:eu-central-1:926093910549:certificate/c0da842b-45c2-4306-ab09-139c47b437d0","acm_dapp_arn":"arn:aws:acm:eu-central-1:926093910549:certificate/07886406-64df-477c-b76b-f6a8d7c708ce","waf_arn":"arn:aws:wafv2:eu-central-1:926093910549:regional/webacl/rate-limit/bee0cf89-9c9a-4fb3-a609-88a3bb2edc7e"}
1+
{"accelerators":{"dev-preprod":"arn:aws:globalaccelerator::926093910549:accelerator/75241ddd-9ca6-4907-9fb4-ed6973e39563/listener/2e35ef83/endpoint-group/247304504909","dev-preview":"arn:aws:globalaccelerator::926093910549:accelerator/792713c0-b902-47c1-ba82-4d38a8e06ae9/listener/18235bfe/endpoint-group/a58684e05909","ops-preprod-1":"arn:aws:globalaccelerator::926093910549:accelerator/3c1f8a14-aa0b-4114-b287-33ea56f0ddcb/listener/51576def/endpoint-group/82f43e613909"},"acm_arn":"arn:aws:acm:eu-central-1:926093910549:certificate/c0da842b-45c2-4306-ab09-139c47b437d0","acm_dapp_arn":"arn:aws:acm:eu-central-1:926093910549:certificate/07886406-64df-477c-b76b-f6a8d7c708ce","waf_arn":"arn:aws:wafv2:eu-central-1:926093910549:regional/webacl/rate-limit/bee0cf89-9c9a-4fb3-a609-88a3bb2edc7e"}

‎nix/cardano-services/deployments/tf-outputs/lace-prod-us-east-2.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
{"acm_arn":"arn:aws:acm:us-east-2:926093910549:certificate/5ecbcb9a-222f-40ed-9067-05a70e416b30","acm_dapp_arn":"arn:aws:acm:us-east-2:926093910549:certificate/2f2912ea-f2eb-4fe7-adab-080fabcda0be","waf_arn":"arn:aws:wafv2:us-east-2:926093910549:regional/webacl/rate-limit/78a416a5-74d6-4215-95eb-575dd9146a6e"}
1+
{"accelerators":{"dev-preprod":"arn:aws:globalaccelerator::926093910549:accelerator/75241ddd-9ca6-4907-9fb4-ed6973e39563/listener/2e35ef83/endpoint-group/af197b8fb300","dev-preview":"arn:aws:globalaccelerator::926093910549:accelerator/792713c0-b902-47c1-ba82-4d38a8e06ae9/listener/18235bfe/endpoint-group/6868e24ff300","ops-preprod-1":"arn:aws:globalaccelerator::926093910549:accelerator/3c1f8a14-aa0b-4114-b287-33ea56f0ddcb/listener/51576def/endpoint-group/73ad3825b300"},"acm_arn":"arn:aws:acm:us-east-2:926093910549:certificate/5ecbcb9a-222f-40ed-9067-05a70e416b30","acm_dapp_arn":"arn:aws:acm:us-east-2:926093910549:certificate/2f2912ea-f2eb-4fe7-adab-080fabcda0be","waf_arn":"arn:aws:wafv2:us-east-2:926093910549:regional/webacl/rate-limit/78a416a5-74d6-4215-95eb-575dd9146a6e"}

0 commit comments

Comments
 (0)