Elastic Load Balancing
Elastic Load Balancing (ELB) spreads incoming traffic across healthy targets. The platform uses one flavor of it, the Application Load Balancer (ALB), to terminate HTTPS in front of the Web App Blueprint API and, on the private side, in front of ArgoCD.
What it does
An ALB listens on a port, terminates TLS with a certificate from AWS Certificate Manager, checks the health of its targets and routes each request by host name or path. It lives in your VPC subnets and gets its own DNS name. An internet-facing ALB sits in public subnets; an internal ALB sits in private subnets and is reachable only from inside the network.
How BuiltForProd uses it
No unit creates a load balancer directly. Load balancers are created on demand by the AWS Load Balancer Controller whenever a Kubernetes Ingress with ingressClassName: alb appears in the cluster. Each stage has two:
| Ingress | Scheme | Host | Certificate | Notes |
|---|---|---|---|---|
blueprint-app (Helm chart in acme-aws-blueprint-webapp-gitops) | internet-facing | blueprint-api.dev.company.com | Discovered from ACM by host name; ingress.certificateArn empty | HTTPS 443 only, no HTTP listener; health check GET /health on port 8080; group blueprint-app |
argocd-server (the argocd unit's Helm release) | internal | argocd.dev.internal.company.com | The stage's internal ACM certificate, passed by ARN | HTTPS 443 only; inbound restricted to the private address ranges; group internal-tools |
Both use target-type: ip, so the ALB sends traffic straight to pod IP addresses rather than to node ports. That is why the application's NetworkPolicy allows port 8080 from the stage VPC CIDR. The internet-facing ALB lands in the spoke VPC's public subnets, which the AWS Baseline creates only for this purpose; workloads themselves stay in private subnets. The internal ALB lands in the private subnets and is reached over the Client VPN, which is what keeps ArgoCD off the internet.
Two other services complete the picture. ExternalDNS watches the Ingress host names and writes the matching Route 53 records, and Firewall Manager in the security account applies a baseline WAF policy to ALBs in the platform accounts (the aws-fms-waf unit).
Terms you will see
| Term | Meaning |
|---|---|
| Listener | The port and protocol an ALB accepts, here HTTPS on 443. |
| Target group | The set of pod IP addresses an ALB forwards to, with its health check. |
| Ingress | The Kubernetes object that declares a host, a path and a backend service. |
| Ingress group | ALBs that share one group.name annotation are merged into a single load balancer. |
Where to read more
- Web App Blueprint overview
- AWS Load Balancer Controller
- ACM for the certificates
- ExternalDNS for the DNS records
- WAF for the web ACL applied to the ALB