# Exposing MongoDB via Load balancer - switch from internet-facing to internal facing (AWS)

**URL:** <https://forums.percona.com/t/exposing-mongodb-via-load-balancer-switch-from-internet-facing-to-internal-facing-aws/25322>\
**Category:** Percona Operator for MongoDB\
**Created:** [September 20, 2023, 1:59pm UTC](https://forums.percona.com/t/exposing-mongodb-via-load-balancer-switch-from-internet-facing-to-internal-facing-aws/25322 "2023-09-20T13:59:39Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kay\_Khan](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/kay_khan/32/17023_2.png) [@Kay\_Khan](https://forums.percona.com/u/Kay_Khan)\
**Post date:** [September 20, 2023, 1:59pm UTC](https://forums.percona.com/t/exposing-mongodb-via-load-balancer-switch-from-internet-facing-to-internal-facing-aws/25322/1 "2023-09-20T13:59:39Z")

</div>

We have a Kubernetes cluster provisioned on AWS EKS. We have had a mongodb replicaset running for some time now using the percona mongodb operator and mongodb server (thank you).

We exposed our mongodb instance to be accessible via a load balancer , this load balancer scheme is set to `internet facing` by default.

```auto
    expose:
      enabled: true
      exposeType: LoadBalancer
      serviceAnnotations:
        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing

```

**Goal:**

Due to security considerations we now need to switch this load balancer sceme from being `internet-facing` to be `internal` facing. [Annotations - AWS Load Balancer Controller](https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.6/guide/service/annotations/#lb-scheme)

**I’m looking for some guidance on how we might go ahead and make this change.**

**Attempt:**

i have setup a test environment and and changed the config to

```auto
service.beta.kubernetes.io/aws-load-balancer-scheme: internal

```

We then upgraded and a new revision was deployed.

```auto
helm upgrade psmdb-db percona/psmdb-db --namespace mongodb -f psmdb-db.values.yaml

```

**However upon observing the load balancer we can see that it still remains as `internet facing`**

**Any help is appreciated.**

 ![image](https://us1.discourse-cdn.com/flex019/uploads/percona1/original/2X/4/4959cb293b54fdc0005800e0c2c96756822b6ce4.png)

**Update**

I just checked the operator logs and i came across

```auto
2023-09-20T13:46:33.484Z ERROR Reconciler error {"controller": "psmdb-controller", "object": {"name":"psmdb-db","namespace":"mongodb"}, "namespace": "mongodb", "name": "psmdb-db", "reconcileID": "4c899e9e-bb3f-43b0-a060-f2ef7fec3104", "error": "failed to ensure services of replset rs0: failed to create external service for replset rs0: Service \"psmdb-db-rs0-0\" is invalid: spec.loadBalancerClass: Invalid value: \"null\": may not change once set", "errorVerbose": "failed to ensure services of replset rs0: failed to create external service for replset rs0: Service \"psmdb-db-rs0-0\" is invalid: spec.loadBalancerClass: Invalid value: \"null\": may not change once set\ngithub.com/percona/percona-server-mongodb-operator/pkg/controller/perconaservermongodb.(*ReconcilePerconaServerMongoDB).Reconcile\n\t/go/src/github.com/percona/percona-server-mongodb-operator/pkg/controller/perconaservermongodb/psmdb_controller.go:477\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.14.4/pkg/internal/controller/controller.go:122\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.14.4/pkg/internal/controller/controller.go:323\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.14.4/pkg/internal/controller/controller.go:274\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.14.4/pkg/internal/controller/controller.go:235\nruntime.goexit\n\t/usr/local/go/src/runtime/asm_amd64.s:1594"}

```

---

<div class="post-metadata">

**Author:** ![Sergey\_Pronin](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/sergey_pronin/32/14887_2.png) [@Sergey\_Pronin](https://forums.percona.com/u/Sergey_Pronin)\
**Post date:** [October 2, 2023, 8:14am UTC](https://forums.percona.com/t/exposing-mongodb-via-load-balancer-switch-from-internet-facing-to-internal-facing-aws/25322/2 "2023-10-02T08:14:02Z")

</div>

@Kay_Khan  
Do you have mongos or it is just a replica set?

---

<div class="post-metadata">

**Author:** ![Kay\_Khan](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/kay_khan/32/17023_2.png) [@Kay\_Khan](https://forums.percona.com/u/Kay_Khan)\
**Post date:** [October 2, 2023, 8:31am UTC](https://forums.percona.com/t/exposing-mongodb-via-load-balancer-switch-from-internet-facing-to-internal-facing-aws/25322/3 "2023-10-02T08:31:16Z")

</div>

Just replicaset. I later learned that you cannot do this change in place and it will require recreating mongodb instance.

```auto
2023-09-20T13:46:33.484Z ERROR Reconciler error {"controller": "psmdb-controller", "object": {"name":"psmdb-db","namespace":"mongodb"}, "namespace": "mongodb", "name": "psmdb-db", "reconcileID": "4c899e9e-bb3f-43b0-a060-f2ef7fec3104", "error": "failed to ensure services of replset rs0: failed to create external service for replset rs0: Service \"psmdb-db-rs0-0\" is invalid: spec.loadBalancerClass: Invalid value: \"null\": may not change once set", "errorVerbose": "failed to ensure services of replset rs0: failed to create external service for replset rs0: Service \"psmdb-db-rs0-0\" is invalid: spec.loadBalancerClass: Invalid value: \"null\": may not change once set\ngithub.com/percona/percona-server-mongodb-operator/pkg/controller/perconaservermongodb.(*ReconcilePerconaServerMongoDB).Reconcile\n\t/go/src/github.com/percona/percona-server-mongodb-operator/pkg/controller/perconaservermongodb/psmdb_controller.go:477\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.14.4/pkg/internal/controller/controller.go:122\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.14.4/pkg/internal/controller/controller.go:323\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.14.4/pkg/internal/controller/controller.go:274\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.14.4/pkg/internal/controller/controller.go:235\nruntime.goexit\n\t/usr/local/go/src/runtime/asm_amd64.s:1594"}

```

---

<div class="post-metadata">

**Author:** ![Tiago\_Barreto](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/tiago_barreto/32/15237_2.png) [@Tiago\_Barreto](https://forums.percona.com/u/Tiago_Barreto)\
**Post date:** [February 21, 2024, 4:11pm UTC](https://forums.percona.com/t/exposing-mongodb-via-load-balancer-switch-from-internet-facing-to-internal-facing-aws/25322/4 "2024-02-21T16:11:10Z")

</div>

Hi @Sergey_Pronin and @Kay_Khan,

I hope you have been well!

Do you have any example of how to set mongodb shard to expose mongos using internal loadbalancer?

I have already tried using [Exposing the cluster - Percona Operator for MongoDB](https://docs.percona.com/percona-operator-for-mongodb/expose.html#using-single-entry-point-in-a-sharded-cluster), but it seems to be not working to expose the DNS outside the cluster. Internally I am able to access mongos from other pods in the same cluster.

The custom-values.yaml is:

```auto
fullnameOverride: "mongodb"
sharding:
  mongos:
    size: 3
    expose:
      exposeType: ClusterIP
backup:
  enabled: false

```

---

<div class="post-metadata">

**Author:** ![Sergey\_Pronin](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/sergey_pronin/32/14887_2.png) [@Sergey\_Pronin](https://forums.percona.com/u/Sergey_Pronin)\
**Post date:** [February 22, 2024, 7:05am UTC](https://forums.percona.com/t/exposing-mongodb-via-load-balancer-switch-from-internet-facing-to-internal-facing-aws/25322/5 "2024-02-22T07:05:32Z")

</div>

Hello @Tiago_Barreto,

1. Set expose type to “LoadBalancer”
2. Set the annotation to use internal load balancer. Annotation depends on the vendor you use. Below is the example for AWS EKS:

```auto
sharding:
  mongos:
    size: 3
    expose:
      exposeType: LoadBalancer
      serviceAnnotations:
        service.beta.kubernetes.io/aws-load-balancer-type: "internal"

```

---

<div class="post-metadata">

**Author:** ![Tiago\_Barreto](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/tiago_barreto/32/15237_2.png) [@Tiago\_Barreto](https://forums.percona.com/u/Tiago_Barreto)\
**Post date:** [February 22, 2024, 7:24pm UTC](https://forums.percona.com/t/exposing-mongodb-via-load-balancer-switch-from-internet-facing-to-internal-facing-aws/25322/6 "2024-02-22T19:24:37Z")

</div>

Thank you @Sergey_Pronin!