EKS collector custom domain — cert-manager certificate

Issued in-cluster, free, and renews itself. DNS must already point at the NLB.

Start at EKS collector custom domains overview if you are not sure this is the right path.

Use this when no ACM certificate is wanted — typically to avoid the per-certificate ACM cost on internal or low-value domains.

The important constraint: cert-manager solves an HTTP-01 challenge on the Traefik ingress. Let's Encrypt must reach the domain over the NLB to issue the certificate. The certificate cannot be issued before DNS is cut over. There is therefore no staging key for this path, and a short window of failed TLS between the DNS change and the certificate being issued is normal.

If that window is not acceptable, use ACM instead. See EKS collector custom domain — Snowplow-managed DNS, ACM certificate or
EKS collector custom domain — Customer-managed DNS, ACM certificate.

Consul keys

customer/<client>/aws_rt_pipeline_<env>/input/collector/dns/delegated_cert_manager_domains
customer/<client>/aws_rt_pipeline_<env>/input/collector/dns/external_cert_manager_domains

Both are comma-separated lists of fully qualified domain names. Default is empty.

Steps — delegated

1. Confirm the zone is delegated to the customer's Snowplow AWS account.

2. Add the domain to collector/dns/delegated_cert_manager_domains.

3. Apply aws_rt_pipeline. The record is written and the certificate is requested in the same apply.

4. Wait a minute or two, then verify. The certificate is issued once DNS propagates.

Steps — external

1. Add the domain to collector/dns/external_cert_manager_domains.

2. Apply aws_rt_pipeline. The ingress and the certificate request exist, but the certificate stays
   pending.

3. Give the customer the NLB IPs from
   aws_eks_namespace_<env>/output/load_balancer_public_ip_addresses. They replace their record with
   A records for each IP.

4. The certificate issues shortly after their change takes effect.

A customer proxy in front of the collector will usually break the HTTP-01 challenge, and must
forward the collector hostname as SNI for TLS to work at all. For proxied domains prefer an imported
certificate — see EKS collector custom domain — Customer-managed DNS, imported certificate.

Issuer override

Two keys change which ACME issuer is used:

customer/<client>/aws_rt_pipeline_<env>/input/collector/certificate_issuer_override_enabled
customer/<client>/aws_rt_pipeline_<env>/input/collector/certificate_issuer_override_external_name

Set certificate_issuer_override_enabled to true to switch off the default issuer and use the
external one named by certificate_issuer_override_external_name. The only permitted value is
external-zerossl. Use this when Let's Encrypt rate limits are a problem.

Verify

dig +short <domain>
curl -sI https://<domain>/health

aws/collector/validate_eks_collector 0.1.0 prints the certificate served. Check the issuer to confirm it
came from Let's Encrypt, or ZeroSSL if the override is on.

Common failures