EKS collector custom domain - Customer-managed DNS, ACM certificate

The customer owns the DNS. Snowplow issues the certificate, but the customer must add a validation record and repoint their domain.

Start at EKS collector custom domains overview if you are not sure this is the right path.

Use this when the collector domain lives in the customer's own DNS provider — Cloudflare, Namecheap, or a Route53 zone in an account we do not control.

This path always needs customer action, so it is a two-stage process.

Consul keys

customer/<client>/aws_rt_pipeline_<env>/input/collector/dns/external_ack_managed_domains
customer/<client>/aws_rt_pipeline_<env>/input/collector/dns/staging/external_ack_managed_domains

Both are comma-separated lists of fully qualified domain names. Default is empty.

Neither key writes a Route53 record. The difference is bookkeeping: staging/ means we are still waiting on the customer, the final key means the customer has repointed and the domain is live on the NLB.

Steps

1. Stage the domain

Add the domain to collector/dns/staging/external_ack_managed_domains and apply
aws_rt_pipeline. This creates the Traefik ingress and requests the ACM certificate. The certificate stays in PENDING_VALIDATION until the customer acts.

2. Give the customer the validation record

Run the aws/external_collector_cert_validation 0.1.0 handler. It prints the ACM validation CNAME and the NLB IPs. Pass stage:staging to limit output to staged domains.

Send the customer:

• The validation CNAME — name, type CNAME, and value. They add it to their DNS.

• The NLB IPs, for step 4.

3. Wait for the certificate to issue

Re-run aws/external_collector_cert_validation 0.1.0 until the certificate status is ISSUED. This usually takes minutes after the CNAME propagates. Do not go further until it is issued.

4. Ask the customer to repoint the domain

The customer replaces their existing record with A records for each NLB IP. If their provider requires a single target, they can use a CNAME to the collector's NLB hostname instead, but A records to the IPs is the supported form.

Ask them to leave the validation CNAME in place. ACM uses it to renew the certificate.

5. Promote

Once the customer confirms the change and dig +short <domain> returns the NLB IPs, move the domain from staging/external_ack_managed_domains to external_ack_managed_domains and apply. Remove it from the staging key — leaving it in both fails the apply.

Verify

dig +short <domain>
curl -sI https://<domain>/health

aws/collector/validate_eks_collector 0.1.0 does both and prints the certificate actually served.

Notes

• The customer's proxy, if any, must forward the collector hostname as SNI. Traefik routes on SNI, where the old ALB did not. A CDN origin configured to send its own hostname will break TLS.

• If the domain is currently served through the old EC2/ALB collector, keep collector/_deploy_asg at 1 until the customer has repointed. We cannot control the timing of their change.

Common failures