mirror of https://github.com/puppetmaster/typhoon.git synced 2024-12-26 08:29:34 +01:00

Dalton Hubble a12833531e Add new load balancing, TCP/UDP, and firewall docs/diagrams

* Describe kube-apiserver load balancing on each platform
* Describe HTTP/S Ingress load balancing on each platform
* Describe TCP/UDP load balancing apps on each platform
(some clouds don't support UDP)
* Describe firewall customization (e.g. for TCP/UDP apps)
* Update IPv6 status for each platform

2019-08-03 11:50:03 -07:00

2.5 KiB

Raw Blame History

Azure

Load Balancing

kube-apiserver

A load balancer distributes IPv4 TCP/6443 traffic across a backend address pool of controllers with a healthy kube-apiserver. Clusters with multiple controllers use an availability set with 2 fault domains to tolerate hardware failures within Azure.

HTTP/HTTPS Ingress

A load balancer distributes IPv4 TCP/80 and TCP/443 traffic across a backend address pool of workers with a healthy Ingress controller.

The Azure LB IPv4 address is output as ingress_static_ipv4 for use in DNS A records. See Ingress on Azure.

TCP/UDP Services

Load balance TCP/UDP applications by adding rules to the Azure LB (output). A rule may map different ports (e.g. 3333 external, 30333 internal).

# Forward traffic to the worker backend address pool
resource "azurerm_lb_rule" "some-app-tcp" {
  resource_group_name = module.ramius.resource_group_name

  name                           = "some-app-tcp"
  loadbalancer_id                = module.ramius.loadbalancer_id
  frontend_ip_configuration_name = "ingress"

  protocol                = "Tcp"
  frontend_port           = 3333
  backend_port            = 30333
  backend_address_pool_id = module.ramius.backend_address_pool_id
  probe_id                = azurerm_lb_probe.some-app.id
}

# Health check some-app
resource "azurerm_lb_probe" "some-app" {
  resource_group_name = module.ramius.resource_group_name

  name            = "some-app"
  loadbalancer_id = module.ramius.loadbalancer_id
  protocol        = "Tcp"
  port            = 30333
}

Firewalls

Add firewall rules to the worker security group.

resource "azurerm_network_security_rule" "some-app" {
  resource_group_name = "${module.ramius.resource_group_name}"

  name                        = "some-app"
  network_security_group_name = module.ramius.worker_security_group_name
  priority                    = "3001"
  access                      = "Allow"
  direction                   = "Inbound"
  protocol                    = "Tcp"
  source_port_range           = "*"
  destination_port_range      = "30333"
  source_address_prefix       = "*"
  destination_address_prefix  = module.ramius.worker_address_prefix
}

IPv6

Azure does not provide public IPv6 addresses at the standard SKU.

IPv6 Feature	Supported
Node IPv6 address	No
Node Outbound IPv6	No
Kubernetes Ingress IPv6	No

2.5 KiB Raw Blame History