# EKS Cluster Router :"failed to dial fabric

**URL:** <https://openziti.discourse.group/t/eks-cluster-router-failed-to-dial-fabric/2872>\
**Category:** Ziti Overlay\
**Created:** [July 19, 2024, 5:38pm UTC](https://openziti.discourse.group/t/eks-cluster-router-failed-to-dial-fabric/2872 "2024-07-19T17:38:58Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![sadath-12](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/sadath-12/32/2043_2.png) [@sadath-12](https://openziti.discourse.group/u/sadath-12)\
**Post date:** [July 19, 2024, 5:38pm UTC](https://openziti.discourse.group/t/eks-cluster-router-failed-to-dial-fabric/2872/1 "2024-07-19T17:38:59Z")

</div>

I installed public router so I can connect to other private routers .  
But it works only when I install public router in k3d cluster not in eks .

Following config of router

```auto
linkListeners:
  transport: # https://docs.openziti.io/docs/reference/configuration/router/#transport
    containerPort: 10080
    advertisedHost: routerlistener.domain.co
    advertisedPort: 443
    service:
      enabled: true
      type: ClusterIP
      labels:
      annotations:
    ingress:
      enabled: true
      ingressClassName: nginx
      annotations:
        kubernetes.io/ingress.allow-http: "false"
        nginx.ingress.kubernetes.io/ssl-passthrough: "true"

# listen for edge clients
edge:
  enabled: true
  containerPort: 3022
  advertisedHost: routeredge.domain.co
  advertisedPort: 443
  service:
    enabled: true
    # -- expose the service as a ClusterIP, NodePort, or LoadBalancer
    type: ClusterIP
    # -- service labels
    labels:
    # -- service annotations
    annotations:
  ingress:
    enabled: true
    ingressClassName: nginx
    annotations:
      kubernetes.io/ingress.allow-http: "false"
      nginx.ingress.kubernetes.io/ssl-passthrough: "true"

tunnel:
  mode: host

helm upgrade "ziti-router" openziti/ziti-router \
  --namespace "ziti" \
  --values=ziti-router-helm.yaml \
  --set-file enrollmentJwt=./router1.jwt \
  --set ctrl.endpoint="ctrlhost:6262"

```

The loadbalancer url I see on both the ingress was added as cname for respective domains

In the logs of router I get

```auto
{"_context":"ch{edge}-\u003eu{classic}-\u003ei{1Vr1}","chSeq":2,"connId":15,"edgeSeq":0,"error":"can't route from OSkP5ZEL2O -\u003e N0FndZEL2O","file":"github.com/openziti/ziti/router/xgress_edge/listener.go:199","func":"github.com/openziti/ziti/router/xgress_edge.(*edgeClientConn).processConnect","level":"warning","msg":"failed to dial fabric","time":"2024-07-19T17:20:02.181Z","token":"68e0b72b-ed86-48c7-a792-633a7eefd7ea","type":"EdgeConnectType"}

```

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [July 19, 2024, 5:42pm UTC](https://openziti.discourse.group/t/eks-cluster-router-failed-to-dial-fabric/2872/2 "2024-07-19T17:42:24Z")

</div>

If it works when you install a public router, it sounds to me like there's some kind of issue with the underlay (IP) and it sounds like not all the routers are linked up.

> "can't route from OSkP5ZEL2O -\u003e N0FndZEL2O"

That also sounds like the controller can't find a path to route the traffic to me.

@plorenz might have more to add

---

<div class="post-metadata">

**Author:** ![sadath-12](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/sadath-12/32/2043_2.png) [@sadath-12](https://openziti.discourse.group/u/sadath-12)\
**Post date:** [July 19, 2024, 5:46pm UTC](https://openziti.discourse.group/t/eks-cluster-router-failed-to-dial-fabric/2872/3 "2024-07-19T17:46:32Z")

</div>

I have controller in a cluster1 (k3d) , a private router in cluster1 (k3d) . I wanted to tunnel and reach a service connected to private router .

So for that I had to deploy atleast one public router with reachable edge and listener  
so I deployed one public router in some other cluster2 (k3d) . I was able to reach the app whereas if I remove that and deploy in an eks cluster configuring the ingress given in docs , I cant reach

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [July 19, 2024, 5:58pm UTC](https://openziti.discourse.group/t/eks-cluster-router-failed-to-dial-fabric/2872/4 "2024-07-19T17:58:35Z")

</div>

Sure. What you're describing _will_ work, but it all comes to do how you're doing, what you're doing.

At the end of the day, whether it's deployed in one cluster or another cluster won't matter whatsoever. What does matter is whether the private router form a link to the public router. I expect that is what's failing.

If the private router has successfully formed a link to the public router, the next question is: "is the user authorized to use the public router".

If the user is authorized, the next question is: "is the service authorized to use the public router and the private router".

Can you confirm the link exists from private router to public router and can you confirm (using policy advisor) that the identity accessing the private service has authorization to the public router and that the service has access to both routers?

---

<div class="post-metadata">

**Author:** ![sadath-12](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/sadath-12/32/2043_2.png) [@sadath-12](https://openziti.discourse.group/u/sadath-12)\
**Post date:** [July 19, 2024, 6:13pm UTC](https://openziti.discourse.group/t/eks-cluster-router-failed-to-dial-fabric/2872/5 "2024-07-19T18:13:56Z")

</div>

@TheLumberjack , I'm not linking the public router to any service specifically (meaning I'm not assigning attributes) . I was just told that If I want to work with private routers having one public router is a must . So I just simply deployed one public router with reachable edge and link listeners

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [July 19, 2024, 6:15pm UTC](https://openziti.discourse.group/t/eks-cluster-router-failed-to-dial-fabric/2872/6 "2024-07-19T18:15:24Z")

</div>

Yes, "link listeners" are what will allow the private router to "link" to the public router. If you have a public router and a private router you should see 1 link when you run:

```auto
ziti fabric list links

```

Do you have the link?

---

<div class="post-metadata">

**Author:** ![sadath-12](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/sadath-12/32/2043_2.png) [@sadath-12](https://openziti.discourse.group/u/sadath-12)\
**Post date:** [July 19, 2024, 6:15pm UTC](https://openziti.discourse.group/t/eks-cluster-router-failed-to-dial-fabric/2872/7 "2024-07-19T18:15:35Z")

</div>

The private router is deployed like

```auto
helm upgrade --install "private-router2" openziti/ziti-router \
--namespace ziti \
--set-file enrollmentJwt=./router2.jwt \
--set edge.advertisedHost=private-router2-edge.ziti.svc.cluster.local \
--set linkListeners.transport.service.enabled=false \
--set tunnel.mode=host \
--set ctrl.endpoint="${NODE_IP}:6262"

```

A follow up from [Not able to install router via helm chart to connect to ziti controller at port 443 but able to connect via router script - #17 by qrkourier](https://openziti.discourse.group/t/not-able-to-install-router-via-helm-chart-to-connect-to-ziti-controller-at-port-443-but-able-to-connect-via-router-script/2859/17)

---

<div class="post-metadata">

**Author:** ![sadath-12](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/sadath-12/32/2043_2.png) [@sadath-12](https://openziti.discourse.group/u/sadath-12)\
**Post date:** [July 19, 2024, 6:18pm UTC](https://openziti.discourse.group/t/eks-cluster-router-failed-to-dial-fabric/2872/8 "2024-07-19T18:18:48Z")

</div>

Ya ,

router2 (dailer) , router1 (acceptor) in connected state

router2 is the private one and router1 is public one

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [July 19, 2024, 6:19pm UTC](https://openziti.discourse.group/t/eks-cluster-router-failed-to-dial-fabric/2872/9 "2024-07-19T18:19:51Z")

</div>

Now, following the steps outlined prior, run `ziti edge policy-advisor identities ${the.identity.here}` and let's see if it shows OKAY.

example:

```auto
ziti edge policy-advisor identities edgex.core-metadata -q
OKAY : edgex.core-metadata (1) -> edgex.core-data (2) Common Routers: (1/1) Dial: Y Bind: N

OKAY : edgex.core-metadata (1) -> edgex.ui (2) Common Routers: (1/1) Dial: Y Bind: N

OKAY : edgex.core-metadata (1) -> edgex.core-command (2) Common Routers: (1/1) Dial: Y Bind: N

OKAY : edgex.core-metadata (1) -> edgex.core-metadata (2) Common Routers: (1/1) Dial: Y Bind: Y

```

that identity has access to 3 services, and has 1 common router so it gets OKAY as a result

---

<div class="post-metadata">

**Author:** ![sadath-12](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/sadath-12/32/2043_2.png) [@sadath-12](https://openziti.discourse.group/u/sadath-12)\
**Post date:** [July 19, 2024, 6:23pm UTC](https://openziti.discourse.group/t/eks-cluster-router-failed-to-dial-fabric/2872/10 "2024-07-19T18:23:04Z")

</div>

Here is the response

```auto
OKAY : hello-client (2) -> router2-service (2) Common Routers: (2/2) Dial: Y Bind: N 

OKAY : hello-client (2) -> hello-service (2) Common Routers: (2/2) Dial: Y Bind: N

```

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [July 19, 2024, 6:26pm UTC](https://openziti.discourse.group/t/eks-cluster-router-failed-to-dial-fabric/2872/11 "2024-07-19T18:26:07Z")

</div>

And can you do the same thing for your router identity now and confrim it has Bind access to one or both services?

After that, if yes, run the policy advisor again with `services` as the param:

```auto
ziti edge policy-advisor services hello-service -q
ziti edge policy-advisor services router2-service -q

```

---

<div class="post-metadata">

**Author:** ![sadath-12](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/sadath-12/32/2043_2.png) [@sadath-12](https://openziti.discourse.group/u/sadath-12)\
**Post date:** [July 19, 2024, 6:27pm UTC](https://openziti.discourse.group/t/eks-cluster-router-failed-to-dial-fabric/2872/12 "2024-07-19T18:27:24Z")

</div>

ya ,

```auto
OKAY : hello-client (2) -> hello-service (2) Common Routers: (2/2) Dial: Y Bind: N 

OKAY : hello-client2 (2) -> hello-service (2) Common Routers: (2/2) Dial: Y Bind: N 

OKAY : router2 (2) -> hello-service (2) Common Routers: (2/2) Dial: N Bind: Y 

OKAY : hello-client (2) -> router2-service (2) Common Routers: (2/2) Dial: Y Bind: N 

OKAY : hello-client2 (2) -> router2-service (2) Common Routers: (2/2) Dial: Y Bind: N 

OKAY : router2 (2) -> router2-service (2) Common Routers: (2/2) Dial: N Bind: Y 

```

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [July 19, 2024, 6:29pm UTC](https://openziti.discourse.group/t/eks-cluster-router-failed-to-dial-fabric/2872/13 "2024-07-19T18:29:39Z")

</div>

can you include the command you run when you show me the output please? that appears to be

```auto
ziti edge policy-advisor identities

```

?

Now show the policy-advisor for the services

---

<div class="post-metadata">

**Author:** ![sadath-12](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/sadath-12/32/2043_2.png) [@sadath-12](https://openziti.discourse.group/u/sadath-12)\
**Post date:** [July 19, 2024, 6:30pm UTC](https://openziti.discourse.group/t/eks-cluster-router-failed-to-dial-fabric/2872/14 "2024-07-19T18:30:34Z")

</div>

sure ,

```auto
OKAY : hello-client (2) -> router2-service (2) Common Routers: (2/2) Dial: Y Bind: N 

OKAY : hello-client (2) -> hello-service (2) Common Routers: (2/2) Dial: Y Bind: N 

OKAY : hello-client2 (2) -> router2-service (2) Common Routers: (2/2) Dial: Y Bind: N 

OKAY : hello-client2 (2) -> hello-service (2) Common Routers: (2/2) Dial: Y Bind: N 

OKAY : router2 (2) -> router2-service (2) Common Routers: (2/2) Dial: N Bind: Y 

OKAY : router2 (2) -> hello-service (2) Common Routers: (2/2) Dial: N Bind: Y 

ERROR: Default Admin 
  - Identity does not have access to any services. Adjust service policies.

ERROR: router1 
  - Identity does not have access to any services. Adjust service policies.

```

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [July 19, 2024, 6:32pm UTC](https://openziti.discourse.group/t/eks-cluster-router-failed-to-dial-fabric/2872/15 "2024-07-19T18:32:05Z")

</div>

Please include the command and output. That again appears to be

```auto
ziti edge policy-advisor identities -q

```

I have asked for

```auto
ziti edge policy-advisor services -q

```

without seeing the command you ran, it's hard for me to know if it's an identity or a service is all. thx

---

<div class="post-metadata">

**Author:** ![sadath-12](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/sadath-12/32/2043_2.png) [@sadath-12](https://openziti.discourse.group/u/sadath-12)\
**Post date:** [July 19, 2024, 6:33pm UTC](https://openziti.discourse.group/t/eks-cluster-router-failed-to-dial-fabric/2872/16 "2024-07-19T18:33:14Z")

</div>

sure ,

```auto
root@ip-172-31-21-248:/home/ubuntu# ziti edge policy-advisor identities -q
OKAY : hello-client (2) -> router2-service (2) Common Routers: (2/2) Dial: Y Bind: N 

OKAY : hello-client (2) -> hello-service (2) Common Routers: (2/2) Dial: Y Bind: N 

OKAY : hello-client2 (2) -> router2-service (2) Common Routers: (2/2) Dial: Y Bind: N 

OKAY : hello-client2 (2) -> hello-service (2) Common Routers: (2/2) Dial: Y Bind: N 

OKAY : router2 (2) -> router2-service (2) Common Routers: (2/2) Dial: N Bind: Y 

OKAY : router2 (2) -> hello-service (2) Common Routers: (2/2) Dial: N Bind: Y 

ERROR: Default Admin 
  - Identity does not have access to any services. Adjust service policies.

ERROR: router1 
  - Identity does not have access to any services. Adjust service policies.

root@ip-172-31-21-248:/home/ubuntu# ziti edge policy-advisor services -q
OKAY : hello-client (2) -> router2-service (2) Common Routers: (2/2) Dial: Y Bind: N 

OKAY : hello-client2 (2) -> router2-service (2) Common Routers: (2/2) Dial: Y Bind: N 

OKAY : router2 (2) -> router2-service (2) Common Routers: (2/2) Dial: N Bind: Y 

OKAY : hello-client (2) -> hello-service (2) Common Routers: (2/2) Dial: Y Bind: N 

OKAY : hello-client2 (2) -> hello-service (2) Common Routers: (2/2) Dial: Y Bind: N 

OKAY : router2 (2) -> hello-service (2) Common Routers: (2/2) Dial: N Bind: Y 

```

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [July 19, 2024, 6:34pm UTC](https://openziti.discourse.group/t/eks-cluster-router-failed-to-dial-fabric/2872/17 "2024-07-19T18:34:15Z")

</div>

Thank you 🙂

and now let's make sure the binding router has created a terminator properly:

```auto
ziti edge list terminators

```

I would expect to see two

---

<div class="post-metadata">

**Author:** ![sadath-12](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/sadath-12/32/2043_2.png) [@sadath-12](https://openziti.discourse.group/u/sadath-12)\
**Post date:** [July 19, 2024, 6:35pm UTC](https://openziti.discourse.group/t/eks-cluster-router-failed-to-dial-fabric/2872/18 "2024-07-19T18:35:04Z")

</div>

right

```auto
root@ip-172-31-21-248:/home/ubuntu# ziti edge list terminators
╭────────────────────────┬─────────────────┬─────────┬─────────┬────────────────────────┬──────────┬──────┬────────────┬──────────────╮
│ ID │ SERVICE │ ROUTER │ BINDING │ ADDRESS │ IDENTITY │ COST │ PRECEDENCE │ DYNAMIC COST │
├────────────────────────┼─────────────────┼─────────┼─────────┼────────────────────────┼──────────┼──────┼────────────┼──────────────┤
│ 22dI0xaavp0LtBp5IZ0V3X │ hello-service │ router2 │ tunnel │ 22dI0xaavp0LtBp5IZ0V3X │ │ 0 │ default │ 0 │
│ wGrHurfGxg7oJ1eUwE2Rx │ router2-service │ router2 │ tunnel │ wGrHurfGxg7oJ1eUwE2Rx │ │ 0 │ default │ 0 │
╰────────────────────────┴─────────────────┴─────────┴─────────┴────────────────────────┴──────────┴──────┴────────────┴──────────────╯
results: 1-2 of 2

```

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [July 19, 2024, 6:36pm UTC](https://openziti.discourse.group/t/eks-cluster-router-failed-to-dial-fabric/2872/19 "2024-07-19T18:36:41Z")

</div>

And right now, this is using the "k3d cluster" (working) or is this using eks (not working)? Let's clarify that too 🙂

---

<div class="post-metadata">

**Author:** ![sadath-12](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/sadath-12/32/2043_2.png) [@sadath-12](https://openziti.discourse.group/u/sadath-12)\
**Post date:** [July 19, 2024, 6:37pm UTC](https://openziti.discourse.group/t/eks-cluster-router-failed-to-dial-fabric/2872/20 "2024-07-19T18:37:35Z")

</div>

right now , router1 is in eks cluster which is not working

[Next page](https://openziti.discourse.group/t/eks-cluster-router-failed-to-dial-fabric/2872.md?page=2)