Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

EKS - Oracle Connectivity getting stalled

1

Dear AWS Team,

Problem:

We have launched our application server in EKS and we are trying to connect the oracle server which is running outside of the VPC through VPN tunneling. We are using cx_oracle module to connect the oracle server from our EKS. Every time when we make the first request to connect oracle, the server get stalled at the below line:

      cx_Oracle.connect(
                user=xx-xx,
                password=xx-xx,
                dsn="hostname:port/servicename"
       )

We tried the same using a python script as well. When we run the script at first time, it get stalled and the connection response is not received from the oracle server. If we kill the python process and then re-run the script again then it works. This is happening when we try to connect any datasources through VPN tunneling.

We checked the NAT Gateway request log when the request is getting stalled. When we look into the NAT Gateway request log, we are getting the response from oracle server but that response is not sending back to the EKS pod where our app server / script is running. Need your guidance here to check whether we missed anything in-terms of config. Requesting you to guide us to get this issue fixed.

Attached the NAT Gateway request log for your reference:

#### FAILED (attempt-1)
2024-12-12T21:24:26.000+05:30 2 <account_id> eni-0ebcf79ce53e9640b XX.XX.XX.XX XX.XX.XX.XX 1526 54748 6 12 2310 1734018866 1734018895 ACCEPT OK
2024-12-12T21:24:26.000+05:30 2 <account_id> eni-0ebcf79ce53e9640b XX.XX.XX.XX XX.XX.XX.XX 54748 1526 6 16 6861 1734018866 1734018895 ACCEPT OK
2024-12-12T21:25:02.000+05:30 2 <account_id> eni-0f0e8027e64195c61 XX.XX.XX.XX XX.XX.XX.XX 43201 1526 6 12 2310 1734018902 1734018932 ACCEPT OK
2024-12-12T21:25:02.000+05:30 2 <account_id> eni-0f0e8027e64195c61 XX.XX.XX.XX XX.XX.XX.XX 43201 1526 6 16 6861 1734018902 1734018932 ACCEPT OK
++++++++++++++
#### SUCCESS (attempt-2)
2024-12-12T21:21:59.000+05:30 2 <account_id> eni-0ebcf79ce53e9640b XX.XX.XX.XX XX.XX.XX.XX 48666 1526 6 22 5488 1734018719 1734018747 ACCEPT OK
2024-12-12T21:21:59.000+05:30 2 <account_id> eni-0ebcf79ce53e9640b XX.XX.XX.XX XX.XX.XX.XX 1526 48666 6 19 6306 1734018719 1734018749 ACCEPT OK
2024-12-12T21:22:32.000+05:30 2 <account_id> eni-0f0e8027e64195c61 XX.XX.XX.XX XX.XX.XX.XX 1526 18197 6 19 6306 1734018752 1734018781 ACCEPT OK
2024-12-12T21:22:32.000+05:30 2 <account_id> eni-0f0e8027e64195c61 XX.XX.XX.XX XX.XX.XX.XX 18197 1526 6 22 5488 1734018752 1734018781 ACCEPT OK
+++++++++++++++

Please let me know if any further details required.

Thanks.

Topics
DatabaseNetworking & Content DeliveryContainers
Tags
Amazon EKS AnywhereAmazon VPCAWS Virtual Private Network (VPN)Oracle
Language
English

asked 2 years ago252 views

1 Answer
0

Based on the information provided, it appears that you're experiencing intermittent connectivity issues between your Amazon EKS cluster and an external Oracle database server connected via VPN. This type of problem can have several potential causes:

  1. VPN Configuration: The VPN connection might not be properly configured to allow consistent traffic between your EKS cluster and the Oracle server. Ensure that the VPN tunnels are stable and that the routing is correctly set up on both sides.

  2. Security Group and Network ACL Settings: Check that the security groups associated with your EKS nodes and the Network ACLs for your VPC subnets allow the necessary inbound and outbound traffic on the required ports for Oracle database connections (typically port 1521).

  3. DNS Resolution: If you're using hostnames to connect to the Oracle server, there might be issues with DNS resolution. Ensure that your EKS cluster can resolve the Oracle server's hostname consistently.

  4. Firewall Rules: Verify that any firewalls between your EKS cluster and the Oracle server (including the one on the Oracle server itself) are configured to allow the necessary traffic.

  5. Connection Pooling: The behavior you're describing, where the first attempt fails but subsequent attempts succeed, could be related to connection pooling. The cx_Oracle module might be caching connections, which could explain why it works after restarting the process.

  6. NAT Gateway Configuration: Since you mentioned NAT Gateway logs, ensure that your NAT Gateway is correctly configured and that it has enough capacity to handle the traffic.

  7. Oracle Database Configuration: The Oracle database might have settings that are causing it to drop or not respond to initial connection attempts. This could include listener configuration issues or database parameters that need adjustment.

To troubleshoot this issue:

  1. Review your VPN and network configurations to ensure all necessary routes and firewall rules are in place.

  2. Check the Oracle database logs for any errors or warnings during the connection attempts.

  3. Implement connection pooling in your application if you haven't already, which can help manage and reuse connections more efficiently.

  4. Consider using a connection timeout in your cx_Oracle.connect() call to prevent indefinite stalling.

  5. Monitor the VPN connection for any instability or intermittent drops that might be causing the initial connection attempts to fail.

  6. If possible, test the connection from an EC2 instance in the same VPC as your EKS cluster to isolate whether the issue is specific to EKS or more general to your AWS network setup.

If the issue persists after checking these areas, you may need to engage with AWS support for a more in-depth investigation of your specific network configuration and traffic patterns.
Sources
Troublehsoot connectivity between SIte-to-Site VPN and VPC | AWS re:Post
Resolving non-responsive connection issue to on-premises Oracle multitenant architecture database having local listeners behind firewall from the cloud | AWS Database Blog
Troubleshoot problems with Amazon EKS clusters and nodes - Amazon EKS

answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content