kinit inside ECS in one VPC unable to contact KDC in another VPC

0

I have a container inside ECS which is in a VPC, say VPC1. I have an AD Server & Directory Service configured in another VPC (VPC2). These 2 VPCs are peered. However, from the ECS, when I am trying to execute kinit command(for getting Kerberos ticket), I am getting the error "Cannot contact any KDC for realm 'my-domain.com' while getting initial credentials". If the ECS is also in the same VPC, then it works fine. The peering seems to be fine. I am not at all an expert on Directory Service or VPC or DNS or Route53. So, I am struggling to fix this, although I tried a few options. Please help. It will be great, if I can get detailed steps to resolve this.

1개 답변
0

I understand that you are getting the error "Cannot contact any KDC for realm 'my-domain.com' while getting initial credentials" when trying to connect from ECS Container launched in a peered VPC. Researching on this error, I found that this error is generally seen if the machine running kinit is unable to resolve the domain controller. Now, since it is not clear as to how the AD Service and Directory Service is configured, I am unable to comment as to what can be the possible reasons for such failure in DNS Resolution from the ECS in a peered VPC. However, considering the fact that you are not seeing issues when you run the ECS Cluster in the same VPC as the AD Server. One common scenario when ECS will fail to resolve a domain is in the below case -

For example, if you create a private domain called "example.com" and associated with the VPCA then by default only resources within VPCA will be able to resolve the domain "example.com". Even if you peer the VPCA with VPCB, resources in VPCB will not be able to resolve the domain "example.com". I just wanted to let you know that generally Private hosted Zones are not resolvable outside of the VPC it is created. https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zone-private-considerations.html

To better answer your question, we require details that are non-public information. Therefore, please open a support case with AWS using the following link

AWS
지원 엔지니어
답변함 10달 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠