Configure the ARTESCA Network

This section describes how to design and set up the network configuration for ARTESCA. Network configuration is a required step during the installation process.

Refer to ARTESCA Network Architecture for more information on underlying network concepts and reserved IP ranges.

Physical Network Architecture

The physical architecture defines how many networks ARTESCA uses, how many network ports they consume, and how they are routed.

Important

The physical assignment cannot be changed after the initial installation, so make sure to plan it carefully.

ARTESCA requires an underlying network connection for two internal communication planes:

  • The Control Plane Network, used by the cluster for its internal orchestration communications.

  • The Workload Plane Network, used to carry data traffic between the nodes.

Both planes can rely on the same network, in which case you use a single network, or each can rely on its own independent network.

A single network is recommended for simplicity.

Note

The Control Plane and Workload Plane Networks are distinct from the front-end services that ARTESCA exposes. By default, the Management Service is exposed on the Control Plane Network and the Data Service on the Workload Plane Network, but either service can be exposed on any network. Refer to Logical Network Architecture for more information.

Every network must be backed by a bond of at least two network ports (LACP preferred), so that the loss of a single port does not disconnect the node.

If your security policy requires a separation between the Control Plane and the Workload Plane, the deployment options are the following:

  • Single bond with two VLAN networks: two VLANs are configured on a single bond, one VLAN for the Control Plane Network and one for the Workload Plane Network. This option requires two network ports per node.

  • Two bonds with two networks: one bond for the Control Plane Network and a second bond for the Workload Plane Network. This option requires four network ports per node.

Note

If you use a hardware appliance or an off-site deployment, refer to Hardware Appliance and Off-Site Deployment Specifics.

Routing

When using two networks, whether they are separated by VLAN tagging or by distinct bonds, only one of them can carry the default gateway. ARTESCA supports a single default route.

Choose which network carries the default gateway based on where the clients of each service connect from:

  • Assign the default gateway to the network that exposes the Data Service when you do not know, or cannot enumerate, all the subnets your S3 clients connect from.

  • Assign the default gateway to the network that exposes the Management Service when you do not know, or cannot enumerate, all the subnets your administrators connect from.

The network that does not carry the default gateway is reachable only from the subnets it is directly connected to.

Note

Refer to Change Default Gateway to move the default gateway from one network to the other after the installation.

Classless Inter-Domain Routing

The installer requires the Classless Inter-Domain Routing (CIDR) notation of each network, which defines the network range of the Control Plane and Workload Plane subnets. A Class C network is common, but other classes can be used.

Logical Network Architecture

The Management and Data Services can be exposed on an IP address that is separate from the physical IP of the nodes. The following sections explain when an additional IP address is needed.

Management Service

The Management Service provides access to the UI and the ARTESCA API.

Important

The Management Service is always exposed on TCP port 8443, and this port cannot be changed after installation.

The Management Service can be exposed on one IP address only, in one of the following ways:

  • Physical IP address: the installer prompts you for the IP address to expose the Management Service on, and defaults to the Control Plane IP address of the first node.

  • Virtual IP address managed by ARTESCA: on a multi-node deployment, a virtual IP keeps the UI reachable when a node fails. ARTESCA ensures it is always exposed on a node that is currently available.

  • Load balancer: when a load balancer is placed in front of ARTESCA, the IP address of the load balancer must be provisioned at installation time.

  • External IP address (such as a cloud elastic IP): the IP address used must be provisioned at installation time.

Data Service

The Data Service provides access to the S3 and IAM APIs.

Important

The Data Service is always exposed on TCP port 443 (optionally on TCP port 80), and this port cannot be changed after installation.

Unlike the Management Service, the Data Service can be exposed on any number of IP addresses, in one of the following ways:

  • Load balancer: place a load balancer in front of the cluster to distribute data traffic.

  • Virtual IPs managed by ARTESCA: use virtual IPs to provide High Availability Network Configuration for the cluster when no external load balancer is used.

If virtual IPs are used, client-side DNS records must resolve to these IP addresses. Refer to General DNS Setup for more information on the required records.

A single set of virtual IPs is configured only at installation time and is linked to the domain selected during that process.

You can have multiple data endpoints, but they must all be mapped to the same virtual IPs.

High Availability Network Configuration

Note

This section applies to multi-node cluster deployments (3 or 6 nodes).

Data Service Availability

The number of virtual IPs must match the number of nodes. If a server fails, the virtual IP it hosts automatically moves to another server.

For the Data Service, this initially causes an imbalance in the HTTP endpoint scheduling. ARTESCA then internally rebalances the traffic to maintain consistent transaction handling. When using ARTESCA-based virtual IPs, the DNS must be configured to provide a round-robin response to resolver requests (base domain).

Management Service Availability

To maintain continuous access to the UI, even if a server fails, configure a single virtual IP. This virtual IP automatically moves if a server fails and must be used as the access point for the UI.

Using a Load Balancer

Instead of using virtual IPs, you can place a load balancer in front of the ARTESCA cluster. This approach applies to both the Management and Data Services and offers the following advantages and disadvantages.

Advantages:

  • Provides superior balancing and error handling compared to simple DNS round-robin.

  • Allows you to reuse existing network technologies.

  • Can be used to manage and terminate HTTPS traffic.

  • Allows you to use an existing SSL certificate.

Disadvantages:

  • Requires a deployed and functioning load balancer.

  • Requires specific technical skills to operate and administer the load balancer.

Hardware Appliance and Off-Site Deployment Specifics

On a single-node hardware appliance or an off-site deployment, the Control Plane and Workload Plane Networks are hardcoded to 1.1.1.1 and only accessible locally (advertised on the three nodes of the hardware appliance).

At installation time, you only provide a Management Service IP and a Data Service IP corresponding to the networks that the interfaces are connected to.