Openflow BYOC - 사용자 지정 수신 설정¶

Load balancer target health check¶

The target group for your network load balancer should list the IP addresses of the Openflow-managed internal network load balancer as targets. All of these targets should show as Healthy. If targets are Unhealthy, use the following checks to narrow down where traffic is failing.

1. In the AWS console, open EC2 » Load Balancers.

2. Locate the Openflow-managed load balancer that manages ingress to the Kubernetes cluster. This load balancer is named runtime-ingress-{deployment-key}.

3. Review the target health for that load balancer under the Resource map tab.

4. If the Openflow-managed load balancer is not active or has Unhealthy targets:

   • Traffic may be blocked between the Openflow-managed load balancer and the BYOC cluster, or a service inside the cluster may not be ready.

   • Generate a diagnostic bundle by running ./diagnostics.sh from the openflow-agent-{deployment-key} EC2 instance and attach it to a Snowflake Support case.

5. If the Openflow-managed load balancer is active and has healthy targets, check the target health for your load balancer.

6. If your load balancer’s targets are Unhealthy, the path from your load balancer to the Openflow-managed load balancer is the most likely problem:

   • Incorrect or stale IP addresses in your target group. The Openflow-managed load balancer exposes multiple IP addresses that can change over time. To get the latest values, run nslookup with the DNS name of the Openflow-managed load balancer. Update your load balancer’s targets as necessary.

   • Security group rules. Confirm that inbound rules on the Openflow-managed load balancer’s security groups allow TCP 443 from your load balancer. Traffic can fail if your load balancer can’t reach the Openflow load balancer on port 443.

Browser security blocking¶

Some problems with custom ingress are caused by corporate browser security, firewalls, or web proxies that block or inspect traffic to your custom hostname. Those policies are separate from AWS load balancer configuration. You may find that users can’t open the Openflow UI even when AWS load balancers report healthy targets.

To verify connectivity through the load balancers to the Openflow services:

1. In the AWS console, open EC2 » Load Balancers to get the DNS name of the load balancer that is serving traffic and the TLS certificate for your custom ingress domain name.

   • This is not the runtime-ingress-{deployment-key} load balancer.

2. From the openflow-agent-{deployment-key} EC2 instance, verify connectivity through the load balancers to the Openflow deployment. Run the command:

   CopyExpand

   curl -kv https://{your-load-balancer-dns-name}
   

   Show lessSee more

   Scroll to top

   • If the command outputs the expected certificate information and a successful 404 status code response, you have successfully verified connectivity to your Openflow deployment.

   • If the command times out or returns an error, create a Snowflake Support case and attach a diagnostic bundle generated by running ./diagnostics.sh from the Openflow Agent instance.

3. From the Openflow Agent instance, you can also verify the DNS CNAME record for your custom ingress FQDN. Run the command:

   CopyExpand

   source ~/.env && nslookup $DOMAIN
   

   Show lessSee more

   Scroll to top

   • If the command returns the IP addresses of the load balancer that is performing TLS termination for your custom ingress domain name, you have successfully verified the DNS CNAME record.

   • If the command returns no results, the DNS CNAME record is not configured correctly. Check the DNS record for your custom ingress FQDN and ensure it points to your load balancer’s DNS name.

If the Openflow Agent connected successfully through your load balancer’s DNS and you have verified the DNS CNAME record, a security policy or firewall is likely blocking traffic from your browser to the Openflow BYOC deployment. Work with your security team to allowlist your custom ingress FQDN.