Z
ZITADEL•6mo ago
Shardool

Issues with using AWS application load balancer

Hi i've installed the zitadel helm chart and i've been trying to expose it over AWS ALB but without much luck. I have a next.js frontend which redirects to zitadel for login and then my backend Go performs token introspection and grpc calls to zitadel. With following configuration, login works but the grpc calls don't (which i guess is expected). 
    ExternalSecure: true
    ExternalPort: 443
    ExternalDomain: auth.ryvn.app
    ExternalSecure: true
    ExternalPort: 443
    ExternalDomain: auth.ryvn.app
ingress:
  enabled: true
  className: "alb"
  className: "nginx"
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-1:70402007981:certificate/32674b10-3478-4b72-8144-2837c51fd23a
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/listen-ports: '[{HTTP:80},{"HTTPS":443}]'
    alb.ingress.kubernetes.io/group.name: "alb-group"
    alb.ingress.kubernetes.io/healthcheck-path: /debug/healthz
    alb.ingress.kubernetes.io/healthcheck-port: "8080"
  hosts:
    - host: example.test.app
      paths:
        - path: /
          pathType: Prefix
ingress:
  enabled: true
  className: "alb"
  className: "nginx"
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-1:70402007981:certificate/32674b10-3478-4b72-8144-2837c51fd23a
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/listen-ports: '[{HTTP:80},{"HTTPS":443}]'
    alb.ingress.kubernetes.io/group.name: "alb-group"
    alb.ingress.kubernetes.io/healthcheck-path: /debug/healthz
    alb.ingress.kubernetes.io/healthcheck-port: "8080"
  hosts:
    - host: example.test.app
      paths:
        - path: /
          pathType: Prefix
Forcing the backend fixes the backend calls made to zitadel but next.js stops working (presumably because next-auth force HTTP1.1). 
    alb.ingress.kubernetes.io/backend-protocol-version: "HTTP2"
    alb.ingress.kubernetes.io/backend-protocol-version: "HTTP2"
In both cases, i get 464 which is ALB's error so I don't think this is primarily a zitadel concern but just wanted to ask in here in case anyone has bumped into this before. Thanks!
1 Reply
Shardool
ShardoolOP•6mo ago
update - I moved to using nginx, and am no longer blocked on this

Did you find this page helpful?