What things to do after setting up load balancer on top of management servers.

[anirudh09041]

Hi Everyone,

In our setup we have 3 management servers and i have done setup of one Oracle cloud loadbalancer with below listeners and backend sets .

now i am able to access the cloudstack dashboard using the load balancer IP.

I want to know what other configurations are required after these.

[daviftorres]

Dear @anirudh09041,

I haven't used Oracle LB for ACS myself, but it is straightforward.

Note: you do not need to use the LB for port 8250, since the hosts will receive a list of MGMT servers they can connect to. I would go this route because the LB may close idle TCP connections, forcing hosts to reconnect frequently (this may be adjustable in the settings, like stickiness or long timeouts). I'm not saying it is a bad idea, it just needs some testing and adjustments.

For the UI/API, there is not much mystery: the LB can terminate TLS and manage the certificate, then relay HTTP traffic to port 8080 as you described. ACS does not really check which Host header is used or anything like that, so it behaves as a simple web app. Still, it is good to have the headers proxied to the targets so they get logged appropriately.

And, of course, create a rule to redirect requests that arrive on port 80 to HTTPS on the same host and URI.

Here is an equivalent setup for NGINX, if you want to take a peek:

ssl_certificate /etc/nginx/fullchain.crt;
ssl_certificate_key /etc/nginx/privatekey.key;
ssl_ciphers HIGH:!aNULL:!MD5;

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name example.com;

    location / {
        proxy_pass http://10.10.10.10:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_connect_timeout 300;
        proxy_send_timeout 300;
        proxy_read_timeout 300;
        send_timeout 300;
    }
}

[anirudh09041]

Hi @daviftorres ,

Do i also have to replace host field in global settings to VIP of load balancer ?