[Reverse Proxy / Calico] Research and document routing configuration from load balancers to revproxy in EKS

[jhouse-solvd]

Product Outline

Application Hosting and Deployment using Container Orchestration

High Level User Story/ies

As a DevOps engineer on the Platform Operations team, I need to understand how Calico is routing from load balancers outside of a Kubernetes cluster to services running inside of the cluster.

Hypothesis or Bet

If we research and document routing configuration for Calico, then we will be prepared to configure Calico to support revproxy (and other related services, ie fwdproxy) running in EKS.

OKR

O3. Platform security and stability approach is comprehensive, on par with industry leaders

Definition of done

What must be true in order for you to consider this epic complete?

• Instructions exist that explain how to set up calico to allow routing from the ALB to pod IPs in the ALB's target group
• Investigation has been performed around how SRC/DST checks are set up (IP-based packet header filtering; routing) ###

[jhouse-solvd]

Need to create issues for initial tasks:

• Research how to set up calico to allow routing from the ALB to pod IPs in the ALB's target group (research task!)
• Investigate how SRC/DST checks are set up; may need to be disabled (IP-based packet header filtering; routing!)

[jhouse-solvd]

We are going to investigate a potentially more direct solution, and will link here. This may end up being closed, or we will pick it back depending on what we find.

[jhouse-solvd]

Please see #32615 for the current approach. Moving this to the backlog.