11

Yes, F5's do support Configuration as Code. Historically, F5 has made an appliance to manage Configuration as Code called "Enterprise Manager" which pragmatically managed client endpoint F5s (LTMs, etc) using the iControl XML API. They rather quickly discovered this management appliance was terrible and added a more robust REST API to the client appliances ...


8

If you want something quick to get this sorted without much more knowledge I'd recommend elastic beanstalk. It's another AWS application which will handle the load balancer configuration and instance scaling for you. There's no extra cost on top of the load balancer and instances so you can keep using t2 type instances but let elastic beanstalk scale as ...


7

Sonatype's Nexus 3 Pro supports High Availability through a couple of mechanisms that are collectively known as Component Fabric: Peer-to-peer Repository Managers means there is no one master, also known as a single point of failure. Packages are replicated between the nodes to ensure they are eventually consistent. Storage Backends mean you can use high ...


5

Tuning the parameters you have identified will certainly have an effect - to degrade performance. For example, net.ipv4.tcp_window_scaling is an on or off option. Similarly, net.ipv4.tcp_sack is either on or off. Both default to a value of on on Linux and on all load balancers. Both of these were defined in RFC1323 which was published in order to give us the ...


5

You can't add deny rules to GC firewall. The default policy is Deny. You can only add allow rules - allow everything you need and let everything else get rejected. Since the ports you need to block are allowed by default, you simply need to remove them. Check the name of the default rule: gcloud compute firewall-rules list [NAME …] [--regexp=REGEXP, -r ...


4

James, you are correct in that BIG-IQ replaced Enterprise Manager. However, like Enterprise Manager, BIG-IQ is for 'device/feature' management. For integrating via REST APIs directly, or to 3rd party automation tools/tool-chains, you should look at F5 iWorkflow (programmable/extensible API gateway). The team behind iWorkflow are focussed on 'services ...


4

There's no need to delete it from the first account. AWS will issue certificates as long as you can prove domain ownership. Nothing stopping you from having a cert for the same domain in multiple accounts.


3

1) you are using 2 classic ELBs instead of 1 ALB so costs savings can be a factor 2) using a layer7 loadbalancer vs a layer4 gives many features and capabilities not possible otherwise you can see a comparrison here: https://aws.amazon.com/elasticloadbalancing/details/#compare 3) yes that wildcard would fit all your needs (sub1/sub2.domain.com)


3

The best practice is to have your web, app and db servers in private subnets and only the actual front end - which is ALB in your case - in the public subnet. The reason is that web, app and db servers shouldn't be accessible from outside even if by accident (e.g. through security group left too open). Technically it will still work to have both the ALB and ...


3

Here's a rough approach to scaling any stateless app on AWS: Run the app in an Auto Scaling Group (ASG). An ASG makes it easy to manage multiple servers, will automatically replace failed servers, and allows you to automatically scale the number of servers up or down in response to load. To run an ASG, you need to create a Launch Configuration. This is a "...


3

It depends on how much time you can invest into configuration and your configuration. I have built my own cluster on AWS using Nomad and Consul where Fabio was used as Application Load Balancing layer (AWS ALB was lacking for my purposes). Alternatively if you use k8s and do not need additional ALB you can use DNS RR (multiple A or AAAA records for your ...


3

You missed a point that there's still a need in balancing traffic before nodes in Docker cluster, and ELB is great for it (managed cluster, healthchecks, you don't pay for number of ELB instances per VPC, you can spawn spare nodes and register them in ELB automagically with Cloudwatch), great discussion on ServerFault. Basically, external balancer will split ...


3

It's not currently possible to restrict a GCP load balancer's ports and protocols used like you can with an AWS ELB. This is a feature request. https://issuetracker.google.com/issues/35904903


2

I looked for that too but I don't think you can as these are the ports used by Google to do LB: HTTP requests can be load balanced based on port 80 or port 8080. HTTPS requests can be load balanced on port 443. TCP Proxy Load Balancing supports the following ports: 25, 43, 110, 143, 195, 443, 465, 587, 700, 993, 995, 1883, 5222 From: GCP HTTP(S) LB and GCP ...


2

Historically, F5's Application Delivery Controller has been the enterprise-grade industry solution for doing this. With this solution you can: Use iRules LX to communicate with other software to auto-scale on an as-needed basis Load balance at Layer 4 (to achieve better throughput/acceleration) or Layer 7 Share memory between Virtual Servers (there may be a ...


2

What you have installed, the ingress controller, is only one part of the story. The other part is an ingress: in an ingress you define what pods/services should receive traffic of what domain and request path. The ingress controller picks this information up, and dynamically reconfigures the underlying proxy, in your case nginx. You can find examples of ...


2

Ingress controllers allow you to not manually wire stuff up, that's the whole point. If you'd rather do it manually You could have an nginx array (either inside Kubernetes our outside of it) and just point to the ip/port of the services that expose your microservices. If you use an nginx array external to Kubernetes you'd have to use the externalIP service ...


2

You create a CNAME record referencing the assigned hostname of the balancer as the target. CNAME records are not valid at the apex of a zone (i.e. the "naked" domain, without www or any other prefix) but Cloudflare allows you to create one there -- sort of -- they actually allow you to believe that you're creating one there, and then their service ...


2

You can use the GCP HTTP(S) Load balancer. Since you are running a kubernetes cluster (Assuming you are using GKE), GKE uses Google compute VM instance groups which can be put behind a load balancer as target group. You can follow the below steps to setup a load balancer and put your kubernetes node behind a load balancer. Login to GCP console and go to ...


2

Try directly accessing https://my-api-lb-111222333.us-east-1.elb.amazonaws.com from your web browser and you'll get a similar error. The SSL certificate is not just used for encryption -- it also verifies that the host is not an impostor, by being consulted in a check of whether the hostname used to access the target matches the hostname of the certificate ...


1

My solution is based on signed cookies (find how to implement it here, https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-signed-cookies.html); I've created a lambda that handles this for me a bit differently, as I need users to access a location to get their cookie in the easiest way possible and have someone control to whom ...


1

You can archive that, but you will need to use the Application Load Balancer (ALB) which allows you to create rules (like HTTP URL paths, host header conditionals, query strings, HTTP method) to forward the traffic to a specific pool of servers that on your case would be those 2 EC2 instances. e.g.: /app1 --> :/app1 /app2 --> :/app2 Notice that you ...


1

This is similar to: https://stackoverflow.com/questions/55023570/how-to-run-a-job-on-first-available-node/55567958 Have you considered Least Load plugin? https://plugins.jenkins.io/leastload By default Jenkins tries to allocate a jobs to the last node is was executed on. This can result in nodes being left idle while other nodes are overloaded. This ...


1

The default behavior of Jenkins is to use the same node over and over unless it's unavailable. If you use labels you can target resources. Take a look at plugins like Least Load and Scoring Load Balancer to help distribute the load. CloudBees also provides an Even Scheduler plugin as a commercial offering. Kubernetes (e.g. Kubernetes Plugin) to schedule ...


1

What you have above seems like a reasonable update procedure, however you can also use persistence or a sticky session so that when a user goes to a web server, they will be routed to the same web server for the life of their browser session (or for the next hour, or whatever you decide to configure). This also allows for some A/B testing if you need to get ...


1

Not impossible, very easy in fact with read-only routing. Clients intending to be read-only specify it in their connect string, so this is per-session rather than per-statement. You can have up to 9 replicas in an availability group. With modern hardware and storage, that goes a long way to being “scalable” - 10’s of thousands of concurrent connections ...


1

There are several related system engineering trade-offs and choices involved in answering your question. It may be helpful going forward to tackle this question by first prioritizing your objectives and then making the selection and trade-off decisions about VLAN structure, cluster(pod) sizes, etc. to decide which options give you the most bang for the buck ...


1

You can do this a couple of ways, but I have never seen anyone do this with a CNAME. One option, if you have control over your IP addressing is to use BGP to fail-over (or load balance) an IP to your cloud hosting providers. A second option is to invest in a DNS-based geographic load balancing solution, such as the GTM from F5, the GSLB solution from A10, ...


1

Currently all of our PHP (Laravel) applications are running on one EC2 instance. To deploy code, we SSH onto the live box and pull from CodeCommit. The first thing you need to decide on is a Continuous Deploy strategy. There's a lot of servers out there with different use cases, you don't have to pick the most popular, just pick the one that fits your use ...


1

There are two general strategies for dealing with traffic surges: increasing capacity and reducing cost. Increasing capacity means auto-scaling, which everyone was very excited about when public clouds first became available. In its most basic sense, this will boot up more webservers for you based on load and add them to a load balancer, but since can be a ...


Only top voted, non community-wiki answers of a minimum length are eligible