MarkLogic迁移至ALB后使用Roxy部署模块时出现TCP连接超时问题

问题概述 #

将MarkLogic集群从Classic Load Balancer (CLB)迁移到Application Load Balancer (ALB)后，使用Roxy框架结合XDBC/XCC（8034端口）部署XQuery模块时出现TCP连接超时，但通过Postman访问HTTPS端口（8000）能正常返回HTTP 200。此前CLB使用TCP监听器可正常转发XDBC流量，而ALB仅支持HTTP/HTTPS协议，已配置HTTPS监听器。

使用Ruby版本：2.6.10p210 (2022-04-12 revision 67958) [universal.arm64e-darwin23]

部署时错误日志：

(base) 214691@AMBIN07363 atom-marklogic % ./ml dev-aws deploy modules
-v [POST]  mydomain.com:8000/v1/eval (Protocol- https) Login for admin user:xxxxxx Password for vvasan user:  [POST]
mydomain.com:8000/v1/eval (Protocol- https) source permissions:
[{:capability=>"E", :role=>"mdm-role"}, {:capability=>"R",
:role=>"mdm-role"}, {:capability=>"U", :role=>"mdm-role"}] Deploying
application configurations deploying application configuration
src/app/config/config.xqy with name /config.xqy on mdm-modules Login
for admin user:xxxx loading: /config.xqy => /app/config/config.xqy
[PUT]
mydomain.com:8034/insert?uri=%2Fapp%2Fconfig%2Fconfig.xqy&perm=Emdm-role&perm=Rmdm-role&perm=Umdm-role&tzoffset=19800&dbname=mdm-modules

Roxy::Http : request failure count: 1, exception: #<Net::OpenTimeout:
execution expired>

Roxy::Http : request failure count: 2, exception: #<Net::OpenTimeout:
execution expired> Roxy::Http : request failure count: 3, exception:
#<Net::OpenTimeout: execution expired> Roxy::Http : request failure count: 4, exception: #<Net::OpenTimeout: execution expired> Roxy::Http
: re-raising same error: mydomain.com temporarily unavailable:
(execution expired) -- error count: 4, error age: 0
deploy/lib/ml.rb:176: warning: constant Net::HTTPServerException is
deprecated ERROR: mydomain.com temporarily unavailable: (execution
expired) ERROR:
["/Users/214691/Documents/GitHub/atom-marklogic/deploy/lib/RoxyHttp.rb:362:in
`block in request'", "/Users/214691/Documents/GitHub/atom-marklogic/deploy/lib/RoxyHttp.rb:352:in `loop'",
"/Users/214691/Documents/GitHub/atom-marklogic/deploy/lib/RoxyHttp.rb:352:in
`request'", "/Users/214691/Documents/GitHub/atom-marklogic/deploy/lib/MLClient.rb:113:in `go'",
"/Users/214691/Documents/GitHub/atom-marklogic/deploy/lib/xcc.rb:175:in
`go'", "/Users/214691/Documents/GitHub/atom-marklogic/deploy/lib/xcc.rb:156:in `load_buffer'",
"/Users/214691/Documents/GitHub/atom-marklogic/deploy/lib/server_config.rb:2160:in
`block (2 levels) in deploy_src'", "/Users/214691/Documents/GitHub/atom-marklogic/deploy/lib/server_config.rb:2144:in `each'",
"/Users/214691/Documents/GitHub/atom-marklogic/deploy/lib/server_config.rb:2144:in
`block in deploy_src'", "/Users/214691/Documents/GitHub/atom-marklogic/deploy/lib/server_config.rb:2118:in `each'",
"/Users/214691/Documents/GitHub/atom-marklogic/deploy/lib/server_config.rb:2118:in
`deploy_src'", "/Users/214691/Documents/GitHub/atom-marklogic/deploy/lib/server_config.rb:2083:in `deploy_modules'",
"/Users/214691/Documents/GitHub/atom-marklogic/deploy/lib/server_config.rb:1190:in
`deploy'", "deploy/lib/ml.rb:166:in `'"]

问题原因 #

ALB仅支持HTTP/HTTPS协议的流量转发，不支持纯TCP协议的端口监听。而XDBC/XCC是基于TCP的协议，之前CLB的TCP监听器可以正常转发8034端口流量，迁移到ALB后，ALB未配置对应TCP端口的转发规则，导致Roxy请求8034端口时无法建立连接，触发超时。

解决方案 #

方案1：改用MarkLogic REST API部署模块（推荐） #

Roxy框架支持通过MarkLogic的REST API（8000端口，HTTPS）部署模块，无需依赖XDBC/XCC端口：

• 打开Roxy的环境配置文件（如dev-aws.properties），修改配置项：
  • 替换xcc-host=mydomain.com为rest-host=mydomain.com
  • 替换xcc-port=8034为rest-port=8000
  • 添加ssl=true确保使用HTTPS协议
• 重新执行部署命令：./ml dev-aws deploy modules

方案2：新增Network Load Balancer（NLB）转发XDBC流量 #

如果必须使用XDBC/XCC协议部署，可通过NLB转发TCP流量（NLB支持TCP协议）：

• 在AWS控制台创建NLB，配置TCP监听器监听8034端口，目标组指向MarkLogic集群的XDBC端口（默认8034）
• 修改Roxy配置中的xcc-host为NLB的域名，保持xcc-port=8034不变
• 验证NLB端口连通性后重新执行部署

方案3：调整Roxy SSL配置（若存在证书信任问题） #

如果超时是因为SSL证书验证失败（测试环境常见），可临时关闭证书验证：

• 在配置文件中添加ssl-verify=false
• 生产环境建议配置正确的CA证书路径，添加ssl-ca-cert=/path/to/ca.crt

方案4：验证端口可达性 #

先确认ALB确实无法转发TCP端口：

• 执行命令测试端口连通性：nc -zv mydomain.com 8034
• 如果返回connection refused，说明ALB未监听该TCP端口，需按方案1或2调整

内容的提问来源于stack exchange，提问作者user26849883