TLS detection timed out

[channyein87]

Hello, we are seeing too manay connections dropped from ingress nginx to kong gateway. May I know any reason why?

The traffic flow is alb --> nginx ingress --> kong gateway and both are meshed.

The below error is from linkerd-proxy in one of the kong gateway pods.

[829174.306830s]  INFO ThreadId(01) inbound: linkerd_app_core::serve: Connection closed error=TLS detection timed out client.addr=10.56.101.243:42330

[kflynn]

@channyein87 Hey there – that error implies that NGINX is connecting to Kong and then not send any data. Are both the NGINX and Kong pods meshed?

[kflynn]

(While we're at it, I'm curious about your use case for having both NGINX and Kong...)

[channyein87]

Hi @kflynn yes both the Nginx and Kong pods are meshed.

The difference between theses two is Kong pods are applied with ServerAuthorization but Nginx doesn't has any authorization policies.
In the Kong's ServerAuthorization is also allowed the identity of the Nginx.

apiVersion: policy.linkerd.io/v1beta1                                                                                                                                                                                 
kind: ServerAuthorization                                                                                                                                                                                             
metadata:                                                                                                                                                                                                             
  annotations:                                                                                                                                                                                                        
    name: kong-server-authorization                                                                                                                                                          
  namespace: kong                                                                                                                                                                   
spec:                                                                                                                                                                                                                 
  client:                                                                                                                                                                                                             
    meshTLS:                                                                                                                                                                                                          
      identities:                                                                                                                                                                                                     
      - nginx-ingress-private.ingress-private.serviceaccount.identity.linkerd.cluster.local                                                                                                     
      - nginx-ingress-public.ingress-public.serviceaccount.identity.linkerd.cluster.local                                                                                                       
  server:                                                                                                                                                                                                             
    name: kong-server