How to use AWS Application Load Balancer (ALB) for Jenkins Server | By M. Sharma

Summary

In this tutorial, the presenter demonstrates how to secure a Jenkins server running on AWS using an Application Load Balancer (ALB) and SSL/TLS encryption. The process includes creating a target group, configuring secure connections via HTTPS, and setting up DNS records with Route 53 for easier access to the Jenkins server. The presenter highlights the importance of SSL for security and shows how to manage DNS propagation issues. Future tutorials will cover additional Jenkins configurations, such as connecting to Kubernetes clusters and customizing Jenkins jobs for automated pipelines.

Takeaways

• 😀 The tutorial demonstrates how to secure a Jenkins server hosted on an AWS EC2 instance using an Application Load Balancer (ALB) and HTTPS.
• 😀 The Jenkins server is initially installed on an Ubuntu 20.04 LTS instance in the AWS Virginia region, with access using a dynamic IP address.
• 😀 The main goal of the video is to replace the insecure, direct IP-based access to Jenkins with a secure HTTPS connection behind an ALB.
• 😀 AWS offers four types of load balancers: Application, Network, Gateway, and Classic (deprecated). The tutorial focuses on the Application Load Balancer (ALB).
• 😀 The ALB routes traffic based on HTTP and HTTPS protocols, forwarding requests to a target group, which contains EC2 instances running Jenkins.
• 😀 The video walks through the process of creating a load balancer, setting up target groups, and configuring health checks for Jenkins.
• 😀 A wildcard SSL/TLS certificate is used for securing the connection, which allows multiple DNS records to point to the same ALB, all being secured by the same certificate.
• 😀 The tutorial emphasizes that for production environments, internal load balancers are recommended over internet-facing ones, unless the application needs to be publicly accessible.
• 😀 After the ALB is created, an HTTP listener is set up to automatically redirect any HTTP requests to HTTPS, ensuring secure communication.
• 😀 The tutorial also highlights the importance of DNS propagation and the use of Route 53 for managing DNS records that point to the ALB, allowing secure access via custom domain names.
• 😀 Finally, the video mentions future plans to explore more Jenkins configurations, such as modifying the Jenkins interface, connecting to Kubernetes clusters, and setting up dynamic Jenkins agents.

Q & A

What is the purpose of DNS propagation in the video tutorial?

DNS propagation is the process of updating DNS records across various servers worldwide. In the video, it's discussed that the DNS records need time to propagate, which can take anywhere from 5 minutes to several hours, depending on the record type. This ensures that users can access the application through the correct domain name after updating DNS settings.

Why is the user creating two different DNS records pointing to the same load balancer?

The user is creating two different DNS records to provide redundancy and ensure that both domain names (Jenkins X demo and Charmo demo) point to the same load balancer. This setup ensures that multiple domains can route to the same backend, providing flexibility and improving fault tolerance.

What is the significance of using a wildcard certificate in this setup?

The wildcard certificate allows multiple subdomains (such as jenkins.xdemo.sho.com) to share the same SSL certificate. In this tutorial, the user leverages the wildcard certificate to secure both domain records pointing to the same load balancer, ensuring secure HTTPS connections without needing individual certificates for each subdomain.

What tool does the user suggest for checking DNS propagation status?

The user suggests using the website 'WhatsMyDNS.net' to check DNS propagation status. This tool allows users to verify whether DNS changes have propagated across multiple locations globally.

Why is securing the Jenkins server with SSL/TLS important?

Securing the Jenkins server with SSL/TLS is crucial because it ensures encrypted communication between the client and the server, preventing malicious users from intercepting sensitive data. This is a best practice to secure Jenkins, which might otherwise be vulnerable to attacks like cross-site scripting (XSS).

What are the risks of not securing Jenkins with SSL/TLS?

Without SSL/TLS, Jenkins would transmit sensitive information over an insecure HTTP connection, making it susceptible to various attacks such as data interception and man-in-the-middle attacks. Additionally, exposing Jenkins without SSL could allow malicious users to exploit vulnerabilities in the application, such as cross-site scripting (XSS).

What is the role of the Application Load Balancer (ALB) in this setup?

The Application Load Balancer (ALB) is used to route incoming traffic to the appropriate backend services. In this tutorial, the ALB handles the HTTPS requests and directs them to the Jenkins server, ensuring secure access to Jenkins via both domain names.

What is the difference between the two DNS records created (Jenkins X demo and Charmo demo)?

The two DNS records (Jenkins X demo and Charmo demo) are essentially aliases for the same application load balancer. Both records point to the same IP address, ensuring that traffic directed to either domain will be routed to the same backend infrastructure.

What should you do if DNS propagation is not happening as expected?

If DNS propagation is taking longer than expected or isn't happening correctly, you can use tools like 'WhatsMyDNS.net' to check the status. If propagation issues persist, you may need to wait longer for global DNS servers to update, or verify your DNS settings to ensure they are configured correctly.

What is the purpose of creating Target Groups in the tutorial?

Target Groups are used in AWS to define and manage the backend instances (e.g., Jenkins servers) that will receive traffic routed by the Application Load Balancer. By setting up target groups, the user ensures that requests are directed to the correct servers based on health checks and load balancing configurations.