Edit

Load balancer

Requirements

note

You only have to configure load balancer, if you are planning to setup IA Cloud Enterprise in the high-availability mode. In case of the basic installation, ignore this instruction.

A hardware load balancer must be provided and configured in advance before installation of Enterprise Edition.

• The load balancer must support Layer 4 TCP load balancing.

• The load balancer must listen to the specific ports described in the table below. Port numbers can be overridden in the config file before the installation. The table describes default values of port numbers set initially in the config file inside installation package. If you want to use different ports, make sure that the ports configured to listen on load balancer are updated accordingly in the configuration file during installation:

  Port numbers (default values from config.yml)	Respective setting in config.yml
  TCP: 80	lb_port
  TCP: 443	lb_port_ssl
  TCP: 8202	vault_port

• The load balancer must be configured to route all TCP traffic from the mentioned ports to the same ports on APP1 and APP2 servers (simple round-robin balancing between APP1 and APP2). This means that the mentioned ports must be accessible from load balancer's network interface to APP1 and APP2 servers' network interfaces.

• We recommend to configure the load balancer to perform TCP health-checks of "lb_port_ssl" port of APP1 and APP2 servers every 5 seconds to check that a server is alive.

• All load balancer ports from the table above must be accessible over network from every server of the environment.

• TLS termination must be disabled on the external load balancer.

How to configure load balancer

In the load balancer's configuration, specify the following parameters for it:

1. Configure the list of servers to be balanced:

   • APP Server hostname 01 (for example, host-ct1.example.com)
   • APP Server hostname 02 (for example, host-ct2.example.com)

2. Create the following list of ports that VIP will listen to:

   • TCP: 80
   • TCP: 443
   • TCP: 8202

3. Create one VIP address.

   Alternatively, you can create a separate VIP for each port. In this case:

   • Each domain name must be mapped to a separate virtual IP address.
   • The health check parameter (step 4) must listen to the same port, the VIP is mapped to.
   • A separate servers' group must be created for each VIP.

4. Configure health checks:

   • Ports to listen: TCP 443. If the port is unavailable, HAProxy is down.
   • Servers in the Target group to check: APP Server hostname 01, APP Server hostname 02.
   • Rules:
     • The number of failed health checks to consider the server is down. By default, 3.
     • The number of passed checks to consider the server is restored. By default, 1.
     • The interval of health checks. By default, 20 seconds.

5. In the SSL configuration menu, add your SAN or wildcard certificate.

6. Set Sticky sessions to the Round Robin mode.

7. Set Client NAT.

8. Map the components' domain names to the VIP. The domain names are specified in the hosts.yml file.

   Example domain names

   • vault.example.com
   • minio.example.com
   • nexus.example.com
   • rabbitmq.example.com
   • mesos.example.com
   • marathon.example.com
   • workspace.example.com
   • workfusion.example.com
   • bot-manager.example.com
   • kibana.example.com
   • ocr.example.com
   • bi.example.com
   • int1.example.com
   • int2.example.com
   • int3.example.com
   • host-ct1.example.com
   • host-ct2.example.com
   • ocr1.example.com
   • ocr2.example.com
   • bi1.example.com
   • bi2.example.com
   • bepmaster1.example.com
   • bepmaster2.example.com
   • bepmaster3.example.com
   • bepagent1.example.com
   • bepagent2.example.com
   • bepagent3.example.com
   • rpa1.example.com
   • rpa2.example.com
   • rpa3.example.com