Chapter 16. Take site offline 16.1. When to use this procedure During the deployment lifecycle it might be required that one of the sites is temporarily taken offline for maintenance or to allow for software upgrades. To ensure that no user requests are routed to the site requiring maintenance, it is necessary for the site to be removed from your load balancer configuration. 16.2. Procedure Follow these steps to remove a site from the load balancer so that no traffic can be routed to it. 16.2.1. Global Accelerator Determine the ARN of the Network Load Balancer (NLB) associated with the site to be kept online Command: NAMESPACE= 1 REGION= 2 HOSTNAME=USD(oc -n USDNAMESPACE get svc accelerator-loadbalancer --template="{{range .status.loadBalancer.ingress}}{{.hostname}}{{end}}") aws elbv2 describe-load-balancers \ --query "LoadBalancers[?DNSName=='USD{HOSTNAME}'].LoadBalancerArn" \ --region USD{REGION} \ --output text 1 The Kubernetes namespace containing the Keycloak deployment 2 The AWS Region hosting the Kubernetes cluster Output: arn:aws:elasticloadbalancing:eu-west-1:606671647913:loadbalancer/net/a49e56e51e16843b9a3bc686327c907b/9b786f80ed4eba3d Update the Accelerator EndpointGroup to only include a single site List the current endpoints in the Global Accelerator's EndpointGroup Command: ACCELERATOR_NAME= 1 ACCELERATOR_ARN=USD(aws globalaccelerator list-accelerators \ --query "Accelerators[?Name=='USD{ACCELERATOR_NAME}'].AcceleratorArn" \ --region us-west-2 \ 2 --output text ) LISTENER_ARN=USD(aws globalaccelerator list-listeners \ --accelerator-arn USD{ACCELERATOR_ARN} \ --query "Listeners[*].ListenerArn" \ --region us-west-2 \ --output text ) aws globalaccelerator list-endpoint-groups \ --listener-arn USD{LISTENER_ARN} \ --region us-west-2 1 The name of the Accelerator to be updated 2 The region must always be set to us-west-2 when querying AWS Global Accelerators Output: { "EndpointGroups": [ { "EndpointGroupArn": "arn:aws:globalaccelerator::606671647913:accelerator/d280fc09-3057-4ab6-9330-6cbf1f450748/listener/8769072f/endpoint-group/a30b64ec1700", "EndpointGroupRegion": "eu-west-1", "EndpointDescriptions": [ { "EndpointId": "arn:aws:elasticloadbalancing:eu-west-1:606671647913:loadbalancer/net/a49e56e51e16843b9a3bc686327c907b/9b786f80ed4eba3d", "Weight": 128, "HealthState": "HEALTHY", "ClientIPPreservationEnabled": false }, { "EndpointId": "arn:aws:elasticloadbalancing:eu-west-1:606671647913:loadbalancer/net/a3c75f239541c4a6e9c48cf8d48d602f/5ba333e87019ccf0", "Weight": 128, "HealthState": "HEALTHY", "ClientIPPreservationEnabled": false } ], "TrafficDialPercentage": 100.0, "HealthCheckPort": 443, "HealthCheckProtocol": "TCP", "HealthCheckIntervalSeconds": 30, "ThresholdCount": 3 } ] } Update the EndpointGroup to only include the NLB retrieved in step 1. Command: aws globalaccelerator update-endpoint-group \ --endpoint-group-arn arn:aws:globalaccelerator::606671647913:accelerator/d280fc09-3057-4ab6-9330-6cbf1f450748/listener/8769072f/endpoint-group/a30b64ec1700 \ --region us-west-2 \ --endpoint-configurations ' [ { "EndpointId": "arn:aws:elasticloadbalancing:eu-west-1:606671647913:loadbalancer/net/a49e56e51e16843b9a3bc686327c907b/9b786f80ed4eba3d", "Weight": 128, "ClientIPPreservationEnabled": false } ] '

Commands:
NAMESPACE= 1 REGION= 2 HOSTNAME=USD(oc -n USDNAMESPACE get svc accelerator-loadbalancer --template="{{range .status.loadBalancer.ingress}}{{.hostname}}{{end}}") aws elbv2 describe-load-balancers --query "LoadBalancers[?DNSName=='USD{HOSTNAME}'].LoadBalancerArn" --region USD{REGION} --output text
arn:aws:elasticloadbalancing:eu-west-1:606671647913:loadbalancer/net/a49e56e51e16843b9a3bc686327c907b/9b786f80ed4eba3d
ACCELERATOR_NAME= 1 ACCELERATOR_ARN=USD(aws globalaccelerator list-accelerators --query "Accelerators[?Name=='USD{ACCELERATOR_NAME}'].AcceleratorArn" --region us-west-2 \ 2 --output text ) LISTENER_ARN=USD(aws globalaccelerator list-listeners --accelerator-arn USD{ACCELERATOR_ARN} --query "Listeners[*].ListenerArn" --region us-west-2 --output text ) aws globalaccelerator list-endpoint-groups --listener-arn USD{LISTENER_ARN} --region us-west-2
{ "EndpointGroups": [ { "EndpointGroupArn": "arn:aws:globalaccelerator::606671647913:accelerator/d280fc09-3057-4ab6-9330-6cbf1f450748/listener/8769072f/endpoint-group/a30b64ec1700", "EndpointGroupRegion": "eu-west-1", "EndpointDescriptions": [ { "EndpointId": "arn:aws:elasticloadbalancing:eu-west-1:606671647913:loadbalancer/net/a49e56e51e16843b9a3bc686327c907b/9b786f80ed4eba3d", "Weight": 128, "HealthState": "HEALTHY", "ClientIPPreservationEnabled": false }, { "EndpointId": "arn:aws:elasticloadbalancing:eu-west-1:606671647913:loadbalancer/net/a3c75f239541c4a6e9c48cf8d48d602f/5ba333e87019ccf0", "Weight": 128, "HealthState": "HEALTHY", "ClientIPPreservationEnabled": false } ], "TrafficDialPercentage": 100.0, "HealthCheckPort": 443, "HealthCheckProtocol": "TCP", "HealthCheckIntervalSeconds": 30, "ThresholdCount": 3 } ] }
aws globalaccelerator update-endpoint-group --endpoint-group-arn arn:aws:globalaccelerator::606671647913:accelerator/d280fc09-3057-4ab6-9330-6cbf1f450748/listener/8769072f/endpoint-group/a30b64ec1700 --region us-west-2 --endpoint-configurations ' [ { "EndpointId": "arn:aws:elasticloadbalancing:eu-west-1:606671647913:loadbalancer/net/a49e56e51e16843b9a3bc686327c907b/9b786f80ed4eba3d", "Weight": 128, "ClientIPPreservationEnabled": false } ] '