Configure Data Load Balancer¶

In a multi-node context, the system is highly available and the traffic is evenly distributed across the system.

Load balancing can be implemented in different ways, depending on the use case and the infrastructure:

You can configure Data Virtual IPs in combination with DNS Round Robin. Data Virtual IPs are managed by ARTESCA, and are balanced across the running nodes of the cluster. They are not statically assigned to a specific node.

A guide on how to configure such DNS on Windows Server can be found here.
You can configure a load balancer in front of ARTESCA that will distribute the traffic flow to each node of the cluster.

The following section explains how to configure such a load balancer.

Note

If you have a load balancer, do not use virtual IPs. Configure your load balancer to point at the real IP on each node’s workload plane and use the healthcheck endpoint to monitor the health of the nodes.

A healthcheck endpoint exists on HTTPS (port 443) and HTTP (port 80) on path /healthz for every node data IP.

When using HTTPS and once ARTESCA is deployed, retrieve the CA certificate file on the Bootstrap node on /etc/metalk8s/pki/nginx-ingress/ca.crt.

If using a load balancer: the load balancer needs to be configured as a TCP proxy, and no TLS termination on the load balancer.

To retrieve all data node IPs, once ARTESCA is deployed, run the following command from the Bootstrap node:

[artesca-os@bootstrap ~]$

sudo kubectl exec -n kube-system -c salt-master \
  --kubeconfig /etc/kubernetes/admin.conf \
  $(sudo kubectl --kubeconfig /etc/kubernetes/admin.conf \
    get pods -n kube-system -l app=salt-master -o name) \
  -- salt '*' metalk8s_network.get_portmap_ips

node-1:
   - 127.0.0.1
   - <node-1 data IP 1>
   - <node-1 data IP 2>
node-2:
   - 127.0.0.1
   - <node-2 data IP 1>
   - <node-2 data IP 2>
node-3:
   - 127.0.0.1
   - <node-3 data IP 1>
   - <node-3 data IP 2>

Note

You can have multiple data IPs per node. In that case, you can pick any of them to configure the load balancer.

If you are using HAProxy, here is a full config example where the placeholders need to be replaced with the actual data node IPs and the path to the CA certificate file. Feel free to add options to match your use case.

defaults
   mode tcp

frontend artesca-frontend
   bind :::443  # NOTE: This can be changed to match your needs
   default_backend artesca-backend

backend |project|
   option httpchk GET /healthz
   server |project|-node-1 <node-1 data ip>:443 check check-ssl ca-file <path to ca file>
   server |project|-node-2 <node-2 data ip>:443 check check-ssl ca-file <path to ca file>
   server |project|-node-3 <node-3 data ip>:443 check check-ssl ca-file <path to ca file>