Service Profile and ingress from AWS ALB (no route metrics)

[liammurray]

Is my service profile supposed to work with an unmeshed ingress as in the case of an external ingress via an AWS ALB? In other words, traffic hits the meshed pod directly (via alb target group) and does not originate through a meshed source pod.

I created a second service profile named myservice.example.com so now I have two service profiles (both defining the same routes).

myservice.example.com (for traffic from ALB, matches DNS name for ALB)
myservice.ns.svc.cluster.local (from local traffic)

I created two profiles because the AWS ALB does not support modifying the request header, i.e. I can't set l5d-dst-override in the ALB. (See kubernetes-sigs/aws-load-balancer-controller#1081.)

These cases work (I see route metrics):

• hit the service from another meshed pod using myservice.ns:3002 (In tap output I see authority as the fully qualified Kubernetes DNS name for the service myservice.ns.svc.cluster.local).
• run a curl command from the same meshed pod overriding the host headers curl -H "host: myservice.example.com:3002" myservice.ns:3002/foo (I see authority myservice.example.com:3002 in tap output)

If I hit the service via the ALB I do not see route metrics even though the authority value is the same as my curl command (myservice.example.com:3002). I expected to see inbound metrics for my service. I do see the authority show up in the global metrics (i.e. response_total).

This is the tap output from my curl command (shows up)

req
id=151:13
proxy=in

src=10.101.24.21:46910
dst=10.101.43.96:3002
tls=true
:method=GET
:authority=myservice.example.com:3002
:path=/foo
src_client_id=otherservice.ns.serviceaccount.identity.linkerd.cluster.local
src_control_plane_ns=linkerd
src_deployment=otherservice
src_namespace=ns
src_pod=otherservice-856dfd6fff-csjsr
src_pod_template_hash=856dfd6fff
src_serviceaccount=otherservice
src_tls=true
dst_authz_group=
dst_authz_kind=default
dst_authz_name=all-unauthenticated
dst_control_plane_ns=linkerd
dst_deployment=myservice
dst_namespace=ns
dst_pod=myservice-6f49d6b9c8-65xt5
dst_pod_template_hash=6f49d6b9c8
dst_route_group=
dst_route_kind=default
dst_route_name=default
dst_serviceaccount=myservice
dst_srv_group=
dst_srv_kind=default
dst_srv_name=all-unauthenticated
dst_tls=loopback
rt_route=GET /foo

This is the tap output from the ALB (does not show up)

req
id=151:98
proxy=in

src=10.101.41.87:59128
dst=10.101.43.96:3002
tls=no_tls_from_remote
:method=GET
:authority=myservice.example.com:3002
:path=/foo
src_tls=no_tls_from_remote
dst_authz_group=
dst_authz_kind=default
dst_authz_name=all-unauthenticated
dst_control_plane_ns=linkerd
dst_deployment=myservice
dst_namespace=ns
dst_pod=myservice-6f49d6b9c8-65xt5
dst_pod_template_hash=6f49d6b9c8
dst_route_group=
dst_route_kind=default
dst_route_name=default
dst_serviceaccount=myservice
dst_srv_group=
dst_srv_kind=default
dst_srv_name=all-unauthenticated
dst_tls=loopback

These are the only related issues I was able to find:

• "linkerd routes" fails due to non-.default.svc.cluster.local Host header #2323
• External Service does not work with Service Profile (external http endpoint) #8611

I am using the CNI plugin BTW