Use naive TCP instead of SSL for ELB health checks

[jayunit100]

/kind bug

What steps did you take and what happened:

I ran ELB's with apiserver arguments which include a small set of cipher's not in the AWS 2016 defaults

What happened --- the ELBs never send traffic to apiservers, which means kubelets never register their static pods, and scheduler/kcm never get to start doing anything - so you just have an orphan API Server talking to ETCD, and cluster is effectively dead.

What did you expect to happen:

ELBs to happily handshake with my apiserver and forward traffic along.

Environment:

• Cluster-api-provider-aws version: v1alpha3 (.4)
• Kubernetes version: (use kubectl version): 1.17
• OS (e.g. from /etc/os-release): any

[detiber]

/close
Closing, since this would cause log spamming related to the health checks. Longer term we want to explore migrating over to using an NLB for the load balancer, but there are other challenges that we need to solve related to handling in hairpinning before we can make that switch.

[k8s-ci-robot]

@detiber: Closing this issue.

In response to this:

/close
Closing, since this would cause log spamming related to the health checks. Longer term we want to explore migrating over to using an NLB for the load balancer, but there are other challenges that we need to solve related to handling in hairpinning before we can make that switch.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[seh]

Longer term we want to explore migrating over to using an NLB for the load balancer, but there are other challenges that we need to solve related to handling in hairpinning before we can make that switch.

@detiber, is there an issue tracking this potential move to using an NLB?

[detiber]

@seh #1484 is probably the closest issue we have for supporting NLBs

[sedefsavas]

/reopen

Following this slack thread.

[k8s-ci-robot]

@sedefsavas: Reopened this issue.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[k8s-ci-robot]

@jayunit100: This issue is currently awaiting triage.

If CAPA/CAPI contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[Ankitasw]

/assign

[Ankitasw]

@sedefsavas just to clarify, we have not changed the scope of this issue right, we want classic ELB health check to use TCP instead of SSL, that's all, right?

[Ankitasw]

/lifecycle active