Skip to content

Load Balancer

This guide describes how to configure a Load Balancer (LB) with OpenStack CLI using a Floating IP. The Load Balancer service is powered by Octavia.

Prerequisites

  • A private network with a subnet (see Setup Network).
  • Backend servers with your application running.
  • Application Credentials (cloud.yaml) configured for CLI access (see Tools).

Using a Floating IP for the Load Balancer VIP ensures you retain control over the IP address in case the Load Balancer needs to be destroyed, moved, or recreated.

Note

Load balancing with IPv6 is not possible using this method, as Floating IPs do not work with IPv6.

HTTP Load Balancer

Scenario

  • Backend servers 192.0.2.10 and 192.0.2.11 in private-subnet run an HTTP application on TCP Port 80.
  • A health check is configured at the URL path /healthcheck.
  • The Neutron network public is the shared external network accessible via the internet.

Steps

  1. Create the Load Balancer lb1 in private-subnet.
  2. Create a Listener listener1 (HTTP, Port 80).
  3. Create a Pool pool1 as the default pool for listener1.
  4. Create a Health Monitor on pool1 testing the path /healthcheck.
  5. Add members 192.0.2.10 and 192.0.2.11 to pool1.
  6. Create a Floating IP in public.
  7. Associate the Floating IP with the VIP port of lb1.

CLI Commands

openstack loadbalancer create --name lb1 --vip-subnet-id private-subnet
# Re-run until lb1 shows ACTIVE and ONLINE:
openstack loadbalancer show lb1

openstack loadbalancer listener create --name listener1 --protocol HTTP --protocol-port 80 lb1
openstack loadbalancer pool create --name pool1 --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP
openstack loadbalancer healthmonitor create --delay 5 --max-retries 4 --timeout 10 --type HTTP --url-path /healthcheck pool1
openstack loadbalancer member create --subnet-id private-subnet --address 192.0.2.10 --protocol-port 80 pool1
openstack loadbalancer member create --subnet-id private-subnet --address 192.0.2.11 --protocol-port 80 pool1

openstack floating ip create public
# Use the VIP port ID and Floating IP ID from the outputs above:
openstack floating ip set --port <load_balancer_vip_port_id> <floating_ip_id>

HTTPS Terminated Load Balancer

Scenario

  • Backend servers 192.0.2.10 and 192.0.2.11 run an HTTP application on TCP Port 80.
  • A TLS certificate (server.crt), private key (server.key), and CA certificate (ca-chain.crt) for the domain www.example.com have been provided.
  • The private key must not be password-encrypted.
  • The Load Balancer terminates TLS and forwards requests unencrypted to the backend servers.
  • Certificates are stored securely in OpenStack Barbican Key Management.

Steps

  1. Create a PKCS12 file containing the certificate, key, and CA chain.
  2. Store it as a Barbican Secret (tls_secret1).
  3. Create the Load Balancer lb2 in private-subnet.
  4. Create a Listener listener2 with TERMINATED_HTTPS protocol, using tls_secret1.
  5. Create a Pool pool2 as the default pool for listener2.
  6. Add backend members to pool2.
  7. Create and associate a Floating IP.

CLI Commands

# Create a PKCS12 archive
openssl pkcs12 -export -inkey server.key -in server.crt -certfile ca-chain.crt -passout pass: -out server.p12

# Store the secret in Barbican
openstack secret store --name='tls_secret1' -t 'application/octet-stream' -e 'base64' --payload="$(base64 < server.p12)"

# Create the Load Balancer
openstack loadbalancer create --name lb2 --vip-subnet-id private-subnet
# Re-run until lb2 shows ACTIVE and ONLINE:
openstack loadbalancer show lb2

# Create the Listener with TLS termination
openstack loadbalancer listener create \
    --protocol-port 443 \
    --protocol TERMINATED_HTTPS \
    --name listener2 \
    --default-tls-container=$(openstack secret list | awk '/ tls_secret1 / {print $2}') \
    lb2

# Create the Pool
openstack loadbalancer pool create --name pool2 --lb-algorithm ROUND_ROBIN --listener listener2 --protocol HTTP

# Add members
openstack loadbalancer member create --subnet-id private-subnet --address 192.0.2.10 --protocol-port 80 pool2
openstack loadbalancer member create --subnet-id private-subnet --address 192.0.2.11 --protocol-port 80 pool2

# Create and assign a Floating IP
openstack floating ip create public
openstack floating ip set --port <load_balancer_vip_port_id> <floating_ip_id>

Note

For SNI (multiple domains or a wildcard certificate), see the Octavia Basic Cookbook — TLS-terminated HTTPS with SNI.