Providing guidelines to configure a Load Balancer - HA proxy example

[dario-vega]

Providing guidelines to configure a Load Balancer

This discussion provides an example for educational purposes only. We are not providing expertise about how to choose a Load Balancer, instructions to configure a specific Load Balancer, or the impact of using a Load Balancer, especially on performance.

This document provides an example of configuring an open-source Load Balancer in the Oracle NoSQL HTTP proxy context. It shows the impact of using a Load Balancer when configuring the Oracle NoSQL HTTP proxy in a Secure store—configuring the certificates.

SSL termination (a.k.a. SSL Offloading)

Load Balancer decrypts all HTTPS traffic when it arrives at the load balancer, and the data is sent to the destination server as plain HTTP traffic. This configuration cannot be used with Oracle NoSQL HTTP proxy

SSL passthrough

Load Balancer passes encrypted HTTPS traffic directly to the backend servers without decrypting the traffic on the load balancer (using the same certificate )

# Configure HAProxy to listen on port 8080
frontend http_front
   bind *:8080 ssl crt /etc/haproxy/certs/full.pem
   timeout http-keep-alive 20s
   stats uri /haproxy?stats
   default_backend http_back

# Configure HAProxy to route requests to Oracle NoSQL Database Proxy nodes on port 8080
backend http_back
   balance roundrobin
   timeout http-keep-alive 20s
   server node1-nosql 10.0.0.216:8080 check maxconn 20 ssl verify none
   server node2-nosql 10.0.0.230:8080 check maxconn 20 ssl verify none
   server node3-nosql 10.0.0.2:8080 check maxconn 20 ssl verify none

SSL Bridging

Load Balancer decrypts all HTTPS traffic when it arrives at the load balancer, and encrypts the traffic to the destination server (allow to use another SSL certificate to contact the backend - each backend)

# Configure HAProxy to listen on port 8080
frontend http_front
  bind *:8080 ssl crt /etc/haproxy/certs/full.pem
  timeout http-keep-alive 20s
  stats uri /haproxy?stats
  default_backend http_back


# Configure HAProxy to route requests to Oracle NoSQL Database Proxy nodes on port 8080
backend http_back
  balance roundrobin
  timeout http-keep-alive 20s
  server node1-nosql 10.0.0.216:8080 check maxconn 20 ssl ca-file /root/node1-nosql.pem
  server node2-nosql 10.0.0.215:8080 check maxconn 20 ssl ca-file /root/node2-nosql.pem

Note: The Oracle NoSQL Database Proxy can run in one or multiple dedicated hosts. It can be hosted inside the nodes of the data store. You can use a load balancer as the front end, which has a back-end set of multiple NoSQL proxies on different hosts. While configuring a load balancer, you can add an HTTP health check. The Oracle NoSQL Database Proxy provides the following URI /V2/health for the HTTP health check. An HTTP request to this URI returns a successful response 200 OK.