1

I am using Kong ingress controller on EKS.

High level flow: NLB → Kong ingress controller and proxy(running in the same pod) → k8s service → backend pods

I am trying to achieve stickiness using hash_on cookies configuration on upstream. I am using session and hmac_auth plugin for generating session/cookie.

1st request from the client: First time when the client sends a message to the NLB, NLB sends the traffic to Kong ingress controller and from there it’s goes to one of the backend pods. This is the first time and so Kong will generate a cookie and send it back in the response to the client.

2nd request from the client: Now second time when client is sending the request it is including the cookie as well it got from the response of 1st request. Now when the request comes to Kong it forwards the request to some other pod, other than the pod it forwarded the request for the first time.

On 3rd, 4th…nth request Kong is forwarding the request to the same pod it forwarded to in the 2nd request.

How can we achieve stickiness for every request ?

My expectation was first time when Kong receives a request from a client it will generate a Cookie and it will put some detail specific to the pod it is sending traffic to and next time whenever the same client sends a request it will send the cookie with it, kong should use the cookie and forward the request to the same pod it forwarded the first time…but this is not happening…I am getting stickiness after 2nd to nth request but not for the 1st request.


`Ingress resource used for defining path:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    konghq.com/strip-path: "true"
  name: kong-ingress-bk-srvs
  namespace: default
spec:
  ingressClassName: kong
  rules:
  - http:
      paths:
      - backend:
          service:
            name: httpserver-service-cip
            port:
              number: 8084
        path: /api/v1/serverservice
        pathType: Prefix
      - backend:
          service:
            name: httpserver-service-cip-health
            port:
              number: 8084
        path: /api/v1/healthservice
        pathType: Prefix`

`upstream config:

apiVersion: configuration.konghq.com/v1
kind: KongIngress
metadata:
  name: stickiness-upstream
upstream:
  hash_on: cookie
  hash_on_cookie: my-test-cookie
  hash_on_cookie_path: /`

`session plugin:

apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: session-plugin
config:
  cookie_path: /
  cookie_name: my-test-cookie
  storage: cookie
  cookie_secure: false
  cookie_httponly: false
  cookie_samesite: None
plugin: session`

`hmac plugin

apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: hmac-plugin
config:
  validate_request_body: true
  enforce_headers:
    - date
    - request-line
    - digest
  algorithms:
    - hmac-sha512
plugin: hmac-auth`


`consumer:

apiVersion: configuration.konghq.com/v1
kind: KongConsumer
metadata:
  name: kong-consumer
  annotations:
    kubernetes.io/ingress.class: kong
username: consumer-user-3
custom_id: consumer-id-3
credentials:
- kong-cred
`

`Pod service config:(ingress backend service)

apiVersion: v1
kind: Service
metadata:
  annotations:
    konghq.com/override: stickiness-upstream
    konghq.com/plugins: session-plugin,hmac-plugin
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","kind":"Service","metadata":{"annotations":{"configuration.konghq.com":"stickiness-upstream"},"labels":{"app":"httpserver"},"name":"httpserver-service-cip","namespace":"default"},"spec":{"ports":[{"name":"comm-port","port":8085,"targetPort":8085},{"name":"dur-port","port":8084,"targetPort":8084}],"selector":{"app":"httpserver"},"sessionAffinity":"ClientIP","sessionAffinityConfig":{"clientIP":{"timeoutSeconds":10000}}}}
  creationTimestamp: "2023-02-04T16:44:00Z"
  labels:
    app: httpserver
  name: httpserver-service-cip
  namespace: default
  resourceVersion: "6729057"
  uid: 481b7d8c-1f07-4293-809c-3b4b7dca41e0
spec:
  clusterIP: 10.101.99.87
  clusterIPs:
  - 10.101.99.87
  internalTrafficPolicy: Cluster
  ipFamilies:
  - IPv4
  ipFamilyPolicy: SingleStack
  ports:
  - name: comm-port
    port: 8085
    protocol: TCP
    targetPort: 8085
  - name: dur-port
    port: 8084
    protocol: TCP
    targetPort: 8084
  selector:
    app: httpserver
  sessionAffinity: ClientIP
  sessionAffinityConfig:
    clientIP:
      timeoutSeconds: 10000
  type: ClusterIP
status:
  loadBalancer: {}`
saurabh
  • 39
  • 4

0 Answers0