Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS Network Load Balancer

aws.amazon.com

Post reply on HN
Print view View original

81–90 of 122 posts

Re: AWS Network Load Balancer

#81

Post by krallin »

deafcalculus wrote: post #68

How does failover across zones work? The blog post says there's one static ip per zone. I suppose www.mydomain should have multiple A records each pointing to an elastic ip in a zone. What happens when one zone entirely fails? Does it need a DNS change at this point? Or does the NLB have a different IP with which it can do BGP failover?

AWS provides you with a number of DNS records for each NLB:

- One record per zone (which maps to the EIP for that zone) - A top-level record that includes all active zones (these are all zones you have registered targets in, IIRC)

The latter record is health checked, so if an AZ goes down, it'll stop advertising it automatically (there will be latency of course, so you'll have some clients connecting to a dead IP, but if we're talking unplanned AZ failure, that's sort of expected).

That said, this does mean you probably shouldn't advertise the IPs directly if you can avoid it, yes.

(disclaimer: we evaluated NLB during their beta, so some of this information might be slightly outdated / inaccurate)

Re: AWS Network Load Balancer

#83

Post by bashtoni »

inertial wrote: post #52

Feature request : Please allow weighted load balancing i.e. ability to distribute traffic in a user specified ratio (weights) to different sized instances.

Better: distribute to the instance with the lowest % CPU by default, ala the Google Cloud NLB.

Re: AWS Network Load Balancer

#85

Post by EwanToo »

mdouglass wrote: post #45
nonane wrote: post #35

Earlier quoted context omitted.

I don't think they can add TLS termination because of the way it's implemented. NLB runs on Layer 4 - the transport layer where TCP/UDP run on. TLS technically runs on top of the transport layer.

That’s kind of the answer I was expecting, just hoping it wasn’t the case. From the marketing material they really want you to move, but not having a solution to offload tls makes it impossible for us. And it worries me to see the CLB getting effectively deprecated with it an alternative

I'm hopeful AWS will follow this up with ACM supporting SSL certs on instances, so you can run a LetsEncrypt equivalent on each instance, providing TLS end to end encryption

Re: AWS Network Load Balancer

#86

Post by jon-wood »

deafcalculus wrote: post #68

How does failover across zones work? The blog post says there's one static ip per zone. I suppose www.mydomain should have multiple A records each pointing to an elastic ip in a zone. What happens when one zone entirely fails? Does it need a DNS change at this point? Or does the NLB have a different IP with which it can do BGP failover?

I assume they intend for you to use Route53 on top of this. You could use a combination of geolocation routing and failovers to set it up so that by default people are routed to their nearest region, but if that region is currently offline send them somewhere else instead.

Re: AWS Network Load Balancer

#87

Post by deafcalculus »

krallin wrote: post #81
deafcalculus wrote: post #68

How does failover across zones work? The blog post says there's one static ip per zone. I suppose www.mydomain should have multiple A records each pointing to an elastic ip in a zone. What happens when one zone entirely fails? Does it need a DNS change at this point? Or does the NLB have a different IP with which it can do BGP failover?

AWS provides you with a number of DNS records for each NLB: - One record per zone (which maps to the EIP for that zone) - A top-level record that includes all active zones (these are all zones you have registered targets in, IIRC) The latter record is health checked, so if an AZ goes down, it'll stop advertising it automatically (there will be latency of course, so you'll have some clients connecting to a dead IP, bu…

Won't DNS failover be painfully slow? Some clients ignore small TTL values. I've seen DNS updates taking several hours to propagate.

I thought one of the advantages of multiple zones is that zonal failover can happen with "zero" downtime (this seems to be the case with Amazon RDS).

Re: AWS Network Load Balancer

#88

Post by 9point6 »

paulddraper wrote: post #41

Static IP, source IP, and zonality are game changing. Unfortunately, it lacks a very significant existing feature of ELB: SSL/TLS termination. It's very convient to manage the certs in AWS without having to deploy them to dedicated EC2 instances.

It won't ever be possible to do this as the NLB runs a few network layers below where TLS runs

Re: AWS Network Load Balancer

#89

Post by GeneticGenesis »

newhere420 wrote: post #79
GeneticGenesis wrote: post #78

No chance that I'll jump into another new load balancer product from Amazon any time soon. ALB has significant deficiencies that AWS don't warn you about, and you only find then at tens of thousands of RPS. Still waiting on that fix, AWS.

If they won't warn us, could you please warn us? - Fellow ALB user.

Sure. Whenever a "config change" (Note: this includes adding or removing targets to a target group, EG Autoscaling) happens on an ALB, the ALB drops all active connections, and re-establishes them at once, at high load, this obviously causes significant load spikes on any underlying service.

You can see this happening by looking at the "Active Connection Count" graphs from your ALB, and adding or removing an instance from an ASG.

At 30+GBPS and over 20kRPS, removing one instance can cause absolute chaos.

Re: AWS Network Load Balancer

#90

Post by omribahumi »

Thaxll wrote: post #28
tyingq wrote: post #22

Earlier quoted context omitted.

Happy to be educated. There's some easy way to alter the destination IP that way?

Like mention above IPVS: http://www.linuxvirtualserver.org/VS-IPTunneling.html This is heavily used by Facebook for their loadblancer on their racks.

There was a talk about this in SREcon Europe 2015: https://www.usenix.org/conference/srecon15europe/program/pre...
Post reply on HN