Migrating from AWS classic ELB to ALB

AWS classic ELB does not support FIPS 140-3 so it's recommended to migrate to an ALB.

For self-hosted AWS deployments that were originally configured with a LoadBalancer it likely created a classic ELB which does not support TLS 1.3 or FIPS 140-3. Since release 1.81.0 the Paramify application will no longer be accessible via TLS from a classic ELB. It is recommended to move to an Ingress which creates an ALB that does support FIPS policies. See the note on the AWS site Elastic Load Balancing in AWS GovCloud (US) page for more info.

If you're not sure which you have you can check the Config tab under "Ingress Settings" if you're using Admin Console or your values.yaml if you're using Helm.

Switch from LoadBalancer to Ingress

1. Update your configuration from LoadBalancer to Ingress

When using Helm for deployment you should update your values.yaml to something like the following:

services:
  paramify:
    type: ClusterIP
    ports:
      http:
        nodePort: 30000

ingresses:
  paramify:
    enabled: true
    ingressClassName: "alb"
    annotations:
      kubernetes.io/ingress.class: "alb"
      alb.ingress.kubernetes.io/load-balancer-name: "paramify-alb"
      alb.ingress.kubernetes.io/scheme: "internet-facing"  # or "internal"
      alb.ingress.kubernetes.io/target-type: "ip"
      alb.ingress.kubernetes.io/listen-ports: '[{"HTTP":80},{"HTTPS":443}]'
      alb.ingress.kubernetes.io/ssl-redirect: "443"
      alb.ingress.kubernetes.io/certificate-arn: "arn:aws:acm:<region>:<account_id>:certificate/<guid>"  # replace with your SSL cert
      alb.ingress.kubernetes.io/ssl-policy: ELBSecurityPolicy-TLS13-1-2-FIPS-2023-04  # specify desired ssl policy
      alb.ingress.kubernetes.io/healthcheck-path: /health-check
      alb.ingress.kubernetes.io/healthcheck-port: traffic-port
      alb.ingress.kubernetes.io/healthcheck-protocol: HTTPS
      alb.ingress.kubernetes.io/healthcheck-interval-seconds: "10"
      alb.ingress.kubernetes.io/backend-protocol: HTTPS
      alb.ingress.kubernetes.io/load-balancer-attributes: idle_timeout.timeout_seconds=300
    hosts:
    - host: 'paramify.mycompany.com'
      paths:
      - path: /
        pathType: Prefix
        service:
          name: paramify
          port: 3000

See this values-eks.yaml.example for a more complete example configuration.

When using the Admin Console you would go to the Config tab and set the following:

• In the "Ingress Settings" section change from "Load Balancer" to "Ingress Controller"
• Enter your desired hostname, like paramify.mycompany.com
• Verify the ingress class is alb
• Add the appropriate annotations, likely similar to those in the annotations: section above.

Then save the configuration.

2. Deploy the changes to destroy the old ELB and create the new ALB

Either do the usual helm upgrade command or click the "Deploy" button in the Admin Console after you have updated the configuration. Once the deployment is complete it should have created the new AWS ALB (which relies on the aws-load-balancer-controller running in your cluster, otherwise this may require manually creating the ALB or an alternative ingress strategy).

3. Update DNS to the new ALB

If you already have a DNS CNAME entry for paramify.mycompany.com then you should be able to update it to point at the newly created ALB endpoint, which looks something like paramify-alb-1234567890.us-west-2.elb.amazonaws.com.