Deploying Graph Explorer in K8S (AWS EKS)

[felipe-loka]

Hi, I'm trying to deploy Graph Explorer in Kubernetes (private EKS cluster). I've used the public ECR image of Graph Explorer and the deployment was a success. The Graph Explorer tool is only accessible within the VPC (only people with VPN access can use it).

In this scenario I'm confused if I should or should not use the Proxy. My understanding is that I shouldn't use a Proxy, since the EKS cluster is using private EC2 nodes and the Graph Explorer is also deployed in same private subnets, but I was not able to connect.

[BeyondEvil]

From my understanding (blood, sweat, tears from trial and error), you need the proxy if you're using IAM auth regardless of how and where you deploy the graph. The proxy is responsible to signing the requests with the V4 sig.

[kmcginnes]

This is correct. You should use the proxy server. In the future I hope to make the proxy server automatically configured on all connections. This will remove the manual step necessary today to enable the proxy server.

[hf-13]

IRSA setup with converting ECS to EKS is working just perfectly for us, in case where IAM auth is enabled
https://github.com/aws/graph-explorer/blob/main/additionaldocs/ecs/ECS_FARGATE_DEPLOYMENT.md
Use your own chart with the IRSA setup, use ACM to attach the cert to the LB

And here are the params that we pass to the deployment:

AWS_REGION: "eu-west-1"
LOG_LEVEL: "debug" # to help you with the investigation
GRAPH_TYPE: "gremlin"
GRAPH_CONNECTION_URL: "https://<reader_neptute_endpoint>:8182"
GRAPH_EXP_HTTPS_CONNECTION: "true"
IAM: "true"
HOST: "localhost"
SERVICE_TYPE: "neptune-db"
USING_PROXY_SERVER: "true"
PROXY_SERVER_HTTPS_CONNECTION: "true"
PUBLIC_OR_PROXY_ENDPOINT: "https://<url of the graph explorer>" # graphexplorer.domain.com

Container ports

ports:
  - containerPort: 80
    name: http
    protocol: TCP
  - containerPort: 443
    name: https
    protocol: TCP

Ingress configuration with the aws load balancer controller

alb.ingress.kubernetes.io/backend-protocol: HTTPS
alb.ingress.kubernetes.io/healthcheck-path: /explorer/
alb.ingress.kubernetes.io/healthcheck-port: "443"
alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig":{ "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
alb.ingress.kubernetes.io/ssl-redirect: '443'
alb.ingress.kubernetes.io/certificate-arn: <cert_arn>

Available at https://graphexplorer.domain.com/explorer

[ssheladiya]

Any thoughts on adding support for assumeRole credentials? We have a EKS environment and the DB access is usually done via assume-role with IRSA. I feel other people might also see this use-case in future.

[hf-13]

i support that idea, since a lot of people would benefit from it

[kmcginnes]

@hf-13 Thank you for sharing this helpful information. I don't have much experience with these sorts of setups, but from a quick glance this all looks great.

[ssheladiya]

@kmcginnes I created a local patch in my local to get it working, maybe I can create a PR and you can review the patch?

[kmcginnes]

@ssheladiya Sure. I'll take a look.