Aws-load-balancer-controller: controller deletes route53 entries not created by ingress

[yawboateng]

I currently have some route53 dns entries that are created using the classic elb (k8s service Type:LoadBalancer)

However, After deploying this controller, and creating an ingress object (hostname not taken) that uses the controller, I noticed that some of my original dns records (not associated with the ingress object) are automatically being deleted when the controller is creating a route53 entry for the ingress object

[joshrosso]

Hi @yawboateng

Could you give me an example of the pre-existing domain that is being deleted along with the desired domain you put in your ingress object?

[yawboateng]

pre-existing domain = scrummaster.infra.sometest.com

ingress:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: "elasticsearch"
  namespace: "logging"
  annotations:
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/subnets: subnet-1,subnet-2,subnet-3
    alb.ingress.kubernetes.io/security-groups: sg-1
    alb.ingress.kubernetes.io/certificate-arn: [cert_arn_link]
    kubernetes.io/ingress.class: "alb"

spec:
  rules:
  - host: elasticsearch.infra.sometest.com
    http:
      paths:
      - path: /
        backend:
          serviceName: "elasticsearch"
          servicePort: 9200

[treyhyde]

anecdotally, I saw the same thing.

I had host rules in the ALB controller like servicename.namespace.domainx.com and saw several random r53 deletions right after I fired up the ALB controller to test it like jira.domainx.com, bamboo.domainx.com and (my kube cluster endpoint) api.clustername.domainx.com

[joshrosso]

@yawboateng @treyhyde

Thanks. This should be sufficient to reproduce. I'll keep you updated.

[joshrosso]

I've located the issue, it relates to when a record that is not of Type A exists in same hosted zone as your ingress resource's record. It'll be fixed tomorrow.

[joshrosso]

@yawboateng @treyhyde

Please note that quay.io/coreos/alb-ingress-controller:1adffb1d reflects this change. Please re-open this if the issue persists.

Thanks again for filing this.

[yawboateng]

@joshrosso thanks for the quick fix,

using 1adffb1d, im getting a 504 Gateway Time-out and I noticed the target groups shows all the nodes as unhealthy with message:
None of these Availability Zones contains a healthy target. Requests are being routed to all targets.

services are exposed as NodePort and ingress uses the same configuration as one above

[yawboateng]

nevermind. I had the wrong security group

[joshrosso]

@yawboateng, great, yes sounded SG/Subnet related.

[yawboateng]

yep. are there any plans to have the controller automatically create the appropriate security groups? and maybe also detect the right subnet?

[joshrosso]

@yawboateng

There are, soon. We need to burn down some more stability fixes before we can tackle #6 and #7.

I could see them coming in roughly 1 week.

[yawboateng]

great! thanks @joshrosso