Kubernetes | Edge-to-Aembit Cloud Network & Connectivity Validation

Overview

This article provides a unified diagnostic procedure to validate the network egress path from the Aembit Agent Controller to the Aembit Cloud Tenant. It verifies both DNS Resolution and the TLS Handshake, ensuring that the Controller can securely register with the management plane.

Relates To

• Deployment Type: Kubernetes (EKS, GKE, K8s Self-Hosted)

• Connectivity Path: Agent Controller Pod --> Aembit Cloud (*.aembit.io)

• Standard Namespace: aembit

Cause (The Symptom)

Run this diagnostic if the Agent Controller pod is Running but you observe:

• Tenant UI: The Agent Controller status is "Unhealthy" or "Never Seen."

• Logs: tcp connect error: Connection refused (os error 111)

• Logs: Failed to resolve DNS for <TENANT_ID>.aembit.io

• Keywords: "Controller registration failed," "TLS handshake error"

Solution 

Unified Connectivity Diagnostic

To minimize troubleshooting time, we use a single command string that installs the necessary tools (bind9-host and openssl) and performs a sequential test of the network stack.

1. Prepare Variables

• <NAMESPACE>: Your Aembit deployment namespace (Default: aembit).

• <TENANT_ID>: Your unique Aembit Tenant identifier.

• <AGENT-CONTROLLER-POD>: The name of a running Agent Controller pod.

2. Run the Diagnostic Command

kubectl -n <NAMESPACE> exec -it <AGENT-CONTROLLER-POD> -c aembit-agent-controller -- /bin/bash -c \
'apt update && apt install -y bind9-host openssl && host -v <TENANT_ID>.ec.us-east-2.useast2.aembit.io && echo Q | openssl s_client -showcerts -connect <TENANT_ID>.ec.us-east-2.useast2.aembit.io:443'

ROSA / OpenShift:

oc -n aembit exec -it <agent-controller-pod> -c aembit-agent-controller -- /bin/bash -c \
'apt update && apt install -y bind9-host openssl && \
host -v <TENANT_ID>.ec.us-east-2.useast2.aembit.io && \
echo Q | openssl s_client -showcerts -connect <TENANT_ID>.ec.us-east-2.useast2.aembit.io:443'

3. Evaluate the Outcome

Certificate Chain Validation