Private connectivity: per-zone ingest endpoints

Embed
Preview of the card
<a href="https://forumulate.com/p/watchtower/docs/private-connectivity"><img src="https://forumulate.com/api/public/orgs/watchtower/spaces/docs/pages/58e04b69-df9a-4444-af50-71eb2c0fa4f6/social-card.svg?v=3e7ae33eec8b" alt="Private connectivity: per-zone ingest endpoints" width="600" height="315"></a>

Send telemetry from your VPC or VNet to Watchtower without crossing the public internet. The Helm chart renders one gateway tier per entry of gateway.zones[]: a Deployment whose WT_ZONE makes the gateway stamp every record with the wt-zone header (1 to 32 characters of a-z0-9-, anything else is ignored), and an internal load-balanced Service that your provider's private-link feature attaches to. No public exposure is required.

gateway:
  zones:
    - { name: aws-use1, preset: aws-nlb-internal }
    - { name: gcp-euw1, preset: gcp-ilb }
    - { name: azure-weu, preset: azure-internal, loadBalancerSourceRanges: ["10.0.0.0/8"] }

preset

Service annotations

aws-nlb-internal

aws-load-balancer-type: external, nlb-target-type: ip, scheme: internal

gcp-ilb

networking.gke.io/load-balancer-type: Internal

azure-internal

azure-load-balancer-internal: "true"

annotations adds or overrides entries. Each zone creates <release>-gateway-<zone> (the Deployment and a ClusterIP Service) and <release>-gateway-<zone>-internal (the load balancer). Zones are separate Deployments, so size gateway replicas and resources for the sum.

DNS

Publish ingest.<zone>.<domain> (for example ingest.aws-use1.example.com) in a private DNS zone that resolves inside the consumer network to the private endpoint below. Senders then use https://ingest.<zone>.<domain>:4318 (OTLP/HTTP) or :4317 (gRPC) with the usual ingestion key. Terminate TLS with a certificate for that name (WT_TLS_CERT and WT_TLS_KEY).

  1. Apply the aws-nlb-internal zone; wait for the NLB to be active.

  2. Create a VPC endpoint service for that NLB (require acceptance) and allow the consumer account principals.

  3. In each consumer VPC create an interface endpoint to the service, enable private DNS or create a private hosted zone for ingest.<zone>.<domain> pointing to the endpoint.

GCP Private Service Connect

  1. Apply the gcp-ilb zone; note the forwarding rule of the internal passthrough load balancer.

  2. Publish it with a service attachment (accept list of consumer projects).

  3. In each consumer VPC create a PSC endpoint targeting the attachment and a Cloud DNS private zone record for ingest.<zone>.<domain>.

  1. Apply the azure-internal zone; the internal load balancer must be Standard SKU.

  2. Create a Private Link service on its frontend IP configuration with the consumer subscriptions in the visibility and auto-approval lists.

  3. In each consumer VNet create a private endpoint to that service and a Private DNS zone record for ingest.<zone>.<domain>.

Where the consumer cannot reach even a private endpoint all the time, put a relay in the consumer network and point it at the zone endpoint.

Updated