Configuring load balancing as a service

Procedure

1. Add the network attachment definition.

   Example

   In the following example, a network attachment definition is added to a definition file named, octavia-net-attach-def.yaml.

   Important

   The IP addresses and CIDRs defined in the network attachment definition are used only on a private network and VLAN. The values shown in this example are only for demonstration purposes. Use values that are appropriate for your environment.

   cat >> octavia-net-attach-def.yaml << EOF_CAT
   apiVersion: k8s.cni.cncf.io/v1
   kind: NetworkAttachmentDefinition
   metadata:
     labels:
       osp/net: octavia
     name: octavia
     namespace: openstack
   spec:
     config: |
       {
         "cniVersion": "0.3.1",
         "name": "octavia",
         "type": "bridge",
         "bridge": "octbr",
         "ipam": {
           "type": "whereabouts",
           "range": "192.0.2.0/16",
           "range_start": "192.0.2.30",
           "range_end": "192.0.2.70",
           "routes": [
              {
                "dst": "192.0.2.0/16",
                "gw" : "192.0.2.150"
              }
            ]
         }
       }
   EOF_CAT
   oc apply -n openstack -f octavia-net-attach-def.yaml

Procedure

1. Generate a Base64, encoded password.

   Retain the encoded output to use in a later step.

   Example

   In this example, the password, my_password is encoded using the Base64 encoding scheme:

   $ echo -n my_password | base64

2. Create a Secret CR file on your workstation, for example, octavia-ca-passphrase.yaml.

3. Add the following configuration to octavia-ca-passphrase.yaml:

   apiVersion: v1
   data:
     server-ca-passphrase: <Base64_password>
   kind: Secret
   metadata:
     name: octavia-ca-passphrase
     namespace: openstack
   type: Opaque

   • Replace the <Base64_password> with the Base64-encoded password that you created earlier.

4. Create the Secret CR in the cluster:

   $ oc create -f octavia-ca-passphrase.yaml

Verification

1. Confirm that the Load-balancing service (octavia) pods are running:

   $ oc get pods | grep octavia

   Sample output

   You should see output similar to the following. The number of entries and their suffixes will vary depending on the details of your environment:

   octavia-api-5cf9bc78f7-4lmds           2/2   Running     0       42h
   octavia-healthmanager-5g94j            1/1   Running     0       21h
   octavia-housekeeping-5gtw8             1/1   Running     0       21h
   octavia-image-upload-78b4b6c47c-xzdtl  1/1   Running     0       35h
   octavia-worker-pq55m                   1/1   Running     0       21h

2. Access the remote shell for the OpenStackClient pod from your workstation:

   $ oc rsh -n openstack openstackclient

3. Confirm that the networks octavia-provider-net and lb-mgmt-net are present:

   $ openstack network list -f yaml

   Sample output

   - ID: 2e4fc309-546b-4ac8-9eae-aa8d70a27a9b
     Name: octavia-provider-net
     Subnets:
     - eea45073-6e56-47fd-9153-12f7f49bc115
   - ID: 77881d3f-04b0-46cb-931f-d54003cce9f0
     Name: lb-mgmt-net
     Subnets:
     - e4ab96af-8077-4971-baa4-e0d40a16f55a

   The network, octavia-provider-net, is the external provider network, and is limited to the RHOSO control plane. The lb-mgmt-net network connects the Load-balancing service to amphora instances.

4. Exit the openstackclient pod:

   $ exit

1. GENEVE tunnel connection.
2. Patch ports.
3. The Octavia Operator implements NIC mappings by adding the octavia network attachment to the br-octavia bridge.
4. The project connection is configured through the ovn-controller NetworkAttachment property.

5. The provider network attachment is added using the NicMapping property.

   The NicMapping property instructs the OVN operator to configure a bridge mapping for the network attachment, allowing a provider network to be created that uses the attachment as the physical interface.

6. The octavia network attachment is also added to each type of octavia amphora controller pod: housekeeping, health manager, and worker, using the Networkattachment property for each.
7. The octavia network attachments are a bridge type attachment, configured with octbr as the bridge name.

8. The NodeNetworkConfigurationPolicy defines a VLAN interface similar to what is used for the internal API, storage networks, and so on.

   The policy also initially creates the octbr bridge and adds the octavia VLAN interface to it. These actions enable connections across the OpenShift nodes and isolates the network traffic from other VLAN and non-VLAN networks.

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Run the openstack loadbalancer healthmonitor create command, using argument values that are appropriate for your site.

   • All health monitor types require the following configurable arguments:

     <pool>

     Name or ID of the pool of back-end member servers to be monitored.

     --type

     The type of health monitor. One of HTTP, HTTPS, PING, SCTP, TCP, TLS-HELLO, or UDP-CONNECT.

     --delay

     Number of seconds to wait between health checks.

     --timeout

     Number of seconds to wait for any given health check to complete. timeout must always be smaller than delay.

     --max-retries

     Number of health checks a back-end server must fail before it is considered down. Also, the number of health checks that a failed back-end server must pass to be considered up again.

   • In addition, HTTP health monitor types also require the following arguments, which are set by default:

     --url-path

     Path part of the URL that should be retrieved from the back-end server. By default this is /.

     --http-method

     HTTP method that is used to retrieve the url_path. By default this is GET.

     --expected-codes

     List of HTTP status codes that indicate an OK health check. By default this is 200.

     Example

     $ openstack loadbalancer healthmonitor create --name my-health-monitor --delay 10 --max-retries 4 --timeout 5 --type TCP lb-pool-1

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Modify your health monitor (my-health-monitor).

   In this example, a user is changing the time in seconds that the health monitor waits between sending probes to members.

   Example

   $ openstack loadbalancer healthmonitor set my_health_monitor --delay 600

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Delete the health monitor (my-health-monitor).

   Example

   $ openstack loadbalancer healthmonitor delete my-health-monitor

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a load balancer (lb1) on a public subnet (public_subnet).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id public_subnet --wait

3. Create a listener (listener1) on a port (80).

   Example

   $ openstack loadbalancer listener create --name listener1 \
   --protocol HTTP --protocol-port 80 lb1

4. Verify the state of the listener.

   Example

   $ openstack loadbalancer listener show listener1

   Before going to the next step, ensure that the status is ACTIVE.

5. Create the listener default pool (pool1).

   Example

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP

6. Create a health monitor (healthmon1) of type (HTTP) on the pool (pool1) that connects to the back-end servers and tests the path (/).

   Health checks are recommended but not required. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / pool1

7. Add load balancer members (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the default pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 80 pool1
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 80 pool1

Verification

1. View and verify the load balancer (lb1) settings:

   Example

   $ openstack loadbalancer show lb1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2024-01-15T11:12:13                  |
   | vip_address         | 198.51.100.12                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

2. When a health monitor is present and functioning properly, you can check the status of each member.

   A working member (member1) has an ONLINE value for its operating_status.

   Example

   $ openstack loadbalancer member show pool1 member1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.2.10                           |
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:16:23                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 80                                   |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2024-01-15T11:20:45                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a load balancer (lb1) on a private subnet (private_subnet).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id private_subnet --wait

3. In the output from the previous step, record the value of load_balancer_vip_port_id, because you must provide it in a later step.

4. Create a listener (listener1) on a port (80).

   Example

   $ openstack loadbalancer listener create --name listener1 \
   --protocol HTTP --protocol-port 80 lb1

5. Create the listener default pool (pool1).

   Example

   The command in this example creates an HTTP pool that uses a private subnet containing back-end servers that host non-secure HTTP applications on TCP port 80:

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP

6. Create a health monitor (healthmon1) of type (HTTP) on the pool (pool1) that connects to the back-end servers and tests the path (/).

   Health checks are recommended but not required. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / pool1

7. Add load balancer members (192.0.2.10 and 192.0.2.11) on the private subnet to the default pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 80 pool1
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 80 pool1

8. Create a floating IP address on the shared external subnet (public).

   Example

   $ openstack floating ip create public

9. In the output from step 8, record the value of floating_ip_address, because you must provide it in a later step.

10. Associate this floating IP (203.0.113.0) with the load balancer vip_port_id (69a85edd-5b1c-458f-96f2-b4552b15b8e6).

    Example

    $ openstack floating ip set --port 69a85edd-5b1c-458f-96f2-b4552b15b8e6 203.0.113.0

Verification

1. Verify HTTP traffic flows across the load balancer by using the floating IP (203.0.113.0).

   Example

   $ curl -v http://203.0.113.0 --insecure

   Sample output

   * About to connect() to 203.0.113.0 port 80 (#0)
   *   Trying 203.0.113.0...
   * Connected to 203.0.113.0 (203.0.113.0) port 80 (#0)
   > GET / HTTP/1.1
   > User-Agent: curl/7.29.0
   > Host: 203.0.113.0
   > Accept: */*
   >
   < HTTP/1.1 200 OK
   < Content-Length: 30
   <
   * Connection #0 to host 203.0.113.0 left intact

2. When a health monitor is present and functioning properly, you can check the status of each member.

   A working member (member1) has an ONLINE value for its operating_status.

   Example

   $ openstack loadbalancer member show pool1 member1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.02.10                          |
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:23                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 80                                   |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2024-01-15T11:28:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a load balancer (lb1) on a public subnet (public_subnet).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id public_subnet --wait

3. Create a listener (listener1) on a port (80).

   Example

   $ openstack loadbalancer listener create --name listener1 \
   --protocol HTTP --protocol-port 80 lb1

4. Create the listener default pool (pool1) that defines session persistence on a cookie (PHPSESSIONID).

   Example

   The command in this example creates an HTTP pool that uses a private subnet containing back-end servers that host non-secure HTTP applications on TCP port 80:

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP \
   --session-persistence type=APP_COOKIE,cookie_name=PHPSESSIONID

5. Create a health monitor (healthmon1) of type (HTTP) on the pool (pool1) that connects to the back-end servers and tests the path (/).

   Health checks are recommended but not required. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / pool1

6. Add load balancer members (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the default pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 80 pool1
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 80 pool1

Verification

1. View and verify the load balancer (lb1) settings:

   Example

   $ openstack loadbalancer show lb1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:58                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2024-01-15T11:28:42                  |
   | vip_address         | 198.51.100.22                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

2. When a health monitor is present and functioning properly, you can check the status of each member.

   A working member (member1) has an ONLINE value for its operating_status.

   Example

   $ openstack loadbalancer member show pool1 member1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.02.10                          |
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:23                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 80                                   |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2024-01-15T11:28:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a load balancer (lb1) on a public subnet (public_subnet).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id public_subnet --wait

3. Create a listener (listener1) on a port (443).

   Example

   $ openstack loadbalancer listener create --name listener1 \
   --protocol HTTPS --protocol-port 443 lb1

4. Create the listener default pool (pool1).

   Example

   The command in this example creates an HTTPS pool that uses a private subnet containing back-end servers that host HTTPS applications configured with a TLS-encrypted web application on TCP port 443:

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 \
   --protocol HTTPS

5. Create a health monitor (healthmon1) on the pool (pool1) of type (TLS-HELLO) that connects to the back-end servers and tests the path (/).

   Health checks are recommended but not required. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type TLS-HELLO \
   --url-path / pool1

6. Add load balancer members (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the default pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 443 pool1
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 443 pool1

Verification

1. View and verify the load balancer (lb1) settings.

   Example

   $ openstack loadbalancer show lb1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2024-01-15T11:12:42                  |
   | vip_address         | 198.51.100.11                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

2. When a health monitor is present and functioning properly, you can check the status of each member.

   Example

   A working member (member1) has an ONLINE value for its operating_status.

   $ openstack loadbalancer member show pool1 member1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.2.10                           |
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 443                                  |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2024-01-15T11:12:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

Procedure

1. Combine the key (server.key), certificate (server.crt), and intermediate certificate chain (ca-chain.crt) into a single PKCS12 file (server.p12).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openssl pkcs12 -export -inkey server.key -in server.crt \
   -certfile ca-chain.crt -passout pass: -out server.p12

   Note

   The following procedure does not work if you password protect the PKCS12 file.

2. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

3. Use the Key Manager service to create a secret resource (tls_secret1) for the PKCS12 file.

   Example

   $ openstack secret store --name='tls_secret1' \
   -t 'application/octet-stream' -e 'base64' \
   --payload="$(base64 < server.p12)"

4. Create a load balancer (lb1) on the public subnet (public_subnet).

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id public_subnet --wait

5. Create a TERMINATED_HTTPS listener (listener1), and reference the secret resource as the default TLS container for the listener.

   Example

   $ openstack loadbalancer listener create --protocol-port 443 \
   --protocol TERMINATED_HTTPS \
   --default-tls-container=\
   $(openstack secret list | awk '/ tls_secret1 / {print $2}') lb1

6. Create a pool (pool1) and make it the default pool for the listener.

   Example

   The command in this example creates an HTTP pool that uses a private subnet containing back-end servers that host non-secure HTTP applications on TCP port 80:

   $ openstack loadbalancer pool create --name pool1 --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP

7. Create a health monitor (healthmon1) of type (HTTP) on the pool (pool1) that connects to the back-end servers and tests the path (/).

   Health checks are recommended but not required. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / pool1

8. Add the non-secure HTTP back-end servers (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 443 pool1
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 443 pool1

Verification

1. View and verify the load balancer (lb1) settings.

   Example

   $ openstack loadbalancer show lb1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2024-01-15T11:12:42                  |
   | vip_address         | 198.51.100.11                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

2. When a health monitor is present and functioning properly, you can check the status of each member.

   Example

   $ openstack loadbalancer member show pool1 member1

   A working member (member1) has an ONLINE value for its operating_status:

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.2.10                           |
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 80                                   |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2024-01-15T11:12:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

Procedure

1. For each of the TLS certificates in the SNI list, combine the key (server.key), certificate (server.crt), and intermediate certificate chain (ca-chain.crt) into a single PKCS12 file (server.p12).

   In this example, you create two PKCS12 files (server.p12 and server2.p12) one for each certificate (www.example.com and www2.example.com).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openssl pkcs12 -export -inkey server.key -in server.crt \
   -certfile ca-chain.crt -passout pass: -out server.p12
   
   $ openssl pkcs12 -export -inkey server2.key -in server2.crt \
   -certfile ca-chain2.crt -passout pass: -out server2.p12

2. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

3. Use the Key Manager service to create secret resources (tls_secret1 and tls_secret2) for the PKCS12 file.

   Example

   $ openstack secret store --name='tls_secret1' \
   -t 'application/octet-stream' -e 'base64' \
   --payload="$(base64 < server.p12)"
   
   $ openstack secret store --name='tls_secret2' \
   -t 'application/octet-stream' -e 'base64' \
   --payload="$(base64 < server2.p12)"

4. Create a load balancer (lb1) on the public subnet (public_subnet).

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id public_subnet --wait

5. Create a TERMINATED_HTTPS listener (listener1), and use SNI to reference both the secret resources.

   (Reference tls_secret1 as the default TLS container for the listener.)

   Example

   $ openstack loadbalancer listener create  --name listener1 \
   --protocol-port 443 --protocol TERMINATED_HTTPS \
   --default-tls-container=\
   $(openstack secret list | awk '/ tls_secret1 / {print $2}') \
   --sni-container-refs \
   $(openstack secret list | awk '/ tls_secret1 / {print $2}') \
   $(openstack secret list | awk '/ tls_secret2 / {print $2}') -- lb1

6. Create a pool (pool1) and make it the default pool for the listener.

   Example

   The command in this example creates an HTTP pool that uses a private subnet containing back-end servers that host non-secure HTTP applications on TCP port 80:

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP

7. Create a health monitor (healthmon1) of type (HTTP) on the pool (pool1) that connects to the back-end servers and tests the path (/).

   Health checks are recommended but not required. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / pool1

8. Add the non-secure HTTP back-end servers (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 443 pool1
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 443 pool1

Verification

1. View and verify the load balancer (lb1) settings.

   Example

   $ openstack loadbalancer show lb1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2024-01-15T11:12:42                  |
   | vip_address         | 198.51.100.11                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

2. When a health monitor is present and functioning properly, you can check the status of each member.

   Example

   $ openstack loadbalancer member show pool1 member1

   Sample output

   A working member (member1) has an ONLINE value for its operating_status:

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.2.10                           |
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 80                                   |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2024-01-15T11:12:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

Procedure

1. Combine the key (server.key), certificate (server.crt), and intermediate certificate chain (ca-chain.crt) into a single PKCS12 file (server.p12).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Important

   When you create the PKCS12 file, do not password protect the file.

   Example

   In this example, the PKCS12 file is created without a password:

   $ openssl pkcs12 -export -inkey server.key -in server.crt \
   -certfile ca-chain.crt -passout pass: -out server.p12

2. Use the Key Manager service to create a secret resource (tls_secret1) for the PKCS12 file.

   Example

   $ openstack secret store --name='tls_secret1' \
   -t 'application/octet-stream' -e 'base64' \
   --payload="$(base64 < server.p12)"

3. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

4. Create a load balancer (lb1) on the public subnet (public_subnet).

   Example

   $ openstack loadbalancer create --name lb1 --vip-subnet-id \
   public_subnet --wait

5. Create a TERMINATED_HTTPS listener (listener1) and do the following:

   • reference the secret resource (tls_secret1) as the default TLS container for the listener.
   • set the ALPN protocol (h2).

   • set the fallback protocol if the client does not support HTTP/2 (http/1.1).

     Example

     $ openstack loadbalancer listener create --name listener1 \
     --protocol-port 443 --protocol TERMINATED_HTTPS --alpn-protocol h2 \
     --alpn-protocol http/1.1 --default-tls-container=\
     $(openstack secret list | awk '/ tls_secret1 / {print $2}') lb1

6. Create a pool (pool1) and make it the default pool for the listener.

   Example

   The command in this example creates an HTTP pool containing back-end servers that host HTTP applications configured with a web application on TCP port 80:

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP

7. Create a health monitor (healthmon1) of type (TCP) on the pool (pool1) that connects to the back-end servers.

   Health checks are recommended but not required. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15  --max-retries 4 --timeout 10 --type TCP pool1

8. Add the HTTP back-end servers (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 80 pool1
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 80 pool1

Verification

1. View and verify the load balancer (lb1) settings.

   Example

   $ openstack loadbalancer status show lb1

   Sample output

   {
       "loadbalancer": {
           "id": "936dad29-4c3f-4f24-84a8-c0e6f10ed810",
           "name": "lb1",
           "operating_status": "ONLINE",
           "provisioning_status": "ACTIVE",
           "listeners": [
               {
                   "id": "708b82c6-8a6b-4ec1-ae53-e619769821d4",
                   "name": "listener1",
                   "operating_status": "ONLINE",
                   "provisioning_status": "ACTIVE",
                   "pools": [
                       {
                           "id": "5ad7c678-23af-4422-8edb-ac3880bd888b",
                           "name": "pool1",
                           "provisioning_status": "ACTIVE",
                           "operating_status": "ONLINE",
                           "health_monitor": {
                               "id": "4ad786ef-6661-4e31-a325-eca07b2b3dd1",
                               "name": "healthmon1",
                               "type": "TCP",
                               "provisioning_status": "ACTIVE",
                               "operating_status": "ONLINE"
                           },
                           "members": [
                               {
                                   "id": "facca0d3-61a7-4b46-85e8-da6994883647",
                                   "name": "member1",
                                   "operating_status": "ONLINE",
                                   "provisioning_status": "ACTIVE",
                                   "address": "192.0.2.10",
                                   "protocol_port": 80
                               },
                               {
                                   "id": "2b0d9e0b-8e0c-48b8-aa57-90b2fde2eae2",
                                   "name": "member2",
                                   "operating_status": "ONLINE",
                                   "provisioning_status": "ACTIVE",
                                   "address": "192.0.2.11",
                                   "protocol_port": 80
                               }
   ...

2. When a health monitor is present and functioning properly, you can check the status of each member.

   Example

   $ openstack loadbalancer member show pool1 member1

   Sample output

   A working member (member1) has an ONLINE value for its operating_status:

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.2.10                           |
   | admin_state_up      | True                                 |
   | created_at          | 2024-08-16T20:08:01                  |
   | id                  | facca0d3-61a7-4b46-85e8-da6994883647 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | 9b29c91f67314bd09eda9018616851cf     |
   | protocol_port       | 80                                   |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 3b459c95-64d2-4cfa-b348-01aacc4b3fa9 |
   | updated_at          | 2024-08-16T20:25:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   | tags                |                                      |
   +---------------------+--------------------------------------+

Procedure

1. Combine the key (server.key), certificate (server.crt), and intermediate certificate chain (ca-chain.crt) into a single PKCS12 file (server.p12).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openssl pkcs12 -export -inkey server.key -in server.crt \
   -certfile ca-chain.crt -passout pass: -out server.p12

2. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

3. Use the Key Manager service to create a secret resource (tls_secret1) for the PKCS12 file.

   Example

   $ openstack secret store --name='tls_secret1' \
   -t 'application/octet-stream' -e 'base64' \
   --payload="$(base64 < server.p12)"

4. Create a load balancer (lb1) on the public subnet (public_subnet).

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id external_subnet --wait

5. Create a TERMINATED_HTTPS listener (listener1), and reference the secret resource as the default TLS container for the listener.

   Example

   $ openstack loadbalancer listener create --name listener1 \
   --protocol-port 443 --protocol TERMINATED_HTTPS \
   --default-tls-container=\
   $(openstack secret list | awk '/ tls_secret1 / {print $2}') lb1

6. Create a pool (pool1) and make it the default pool for the listener.

   Example

   The command in this example creates an HTTP pool that uses a private subnet containing back-end servers that host non-secure HTTP applications on TCP port 80:

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP

7. Create a health monitor (healthmon1) of type (HTTP) on the pool (pool1) that connects to the back-end servers and tests the path (/).

   Health checks are recommended but not required. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / pool1

8. Add the non-secure HTTP back-end servers (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 443 pool1
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 443 pool1

9. Create a non-secure, HTTP listener (listener2), and make its default pool, the same as the secure listener.

   Example

   $ openstack loadbalancer listener create --name listener2 \
   --protocol-port 80 --protocol HTTP --default-pool pool1 lb1

Verification

1. View and verify the load balancer (lb1) settings.

   Example

   $ openstack loadbalancer show lb1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2024-01-15T11:12:42                  |
   | vip_address         | 198.51.100.11                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

2. When a health monitor is present and functioning properly, you can check the status of each member.

   Example

   $ openstack loadbalancer member show pool1 member1

   Sample output

   A working member (member1) has an ONLINE value for its operating_status:

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.2.10                           |
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 80                                   |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2024-01-15T11:12:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a load balancer (lb1) on the public subnet (public_subnet).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id public_subnet --wait

3. Create a TCP listener (listener1) on the specified port (23456) for which the custom application is configured.

   Example

   $ openstack loadbalancer listener create --name listener1 \
   --protocol TCP --protocol-port 23456 lb1

4. Create a pool (pool1) and make it the default pool for the listener.

   Example

   In this example, a pool is created that uses a private subnet containing back-end servers that host a custom application on a specific TCP port:

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 \
   --protocol TCP

5. Create a health monitor (healthmon1) on the pool (pool1) that connects to the back-end servers and probes the TCP service port.

   Example

   Health checks are recommended but not required. If no health monitor is defined, the member server is assumed to be ONLINE.

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type TCP pool1

6. Add the back-end servers (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 443 pool1
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 443 pool1

Verification

1. View and verify the load balancer (lb1) settings.

   Example

   $ openstack loadbalancer show lb1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2024-01-15T11:12:42                  |
   | vip_address         | 198.51.100.11                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

2. When a health monitor is present and functioning properly, you can check the status of each member. Use the following command to obtain a member ID:

   Example

   $ openstack loadbalancer member list pool1

   A working member (member1) has an ONLINE value for its operating_status.

   Example

   $ openstack loadbalancer member show pool1 member1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.2.10                           |
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 80                                   |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2024-01-15T11:12:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a load balancer (lb1) on a private subnet (private_subnet).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id private_subnet --wait

3. Create a listener (listener1) on a port (1234).

   Example

   $ openstack loadbalancer listener create --name listener1 \
   --protocol UDP --protocol-port 1234 lb1

4. Create the listener default pool (pool1).

   Example

   The command in this example creates a pool that uses a private subnet containing back-end servers that host one or more applications configured to use UDP ports:

   $ openstack loadbalancer pool create --name pool1 \
   --lb-algorithm ROUND_ROBIN --listener listener1 --protocol UDP

5. Create a health monitor (healthmon1) on the pool (pool1) that connects to the back-end servers by using UDP (UDP-CONNECT).

   Health checks are recommended but not required. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 5 --max-retries 2 --timeout 3 --type UDP-CONNECT pool1

6. Add the back-end servers (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the default pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 1234 pool1
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 1234 pool1

Verification

1. View and verify the load balancer (lb1) settings.

   Example

   $ openstack loadbalancer show lb1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2024-01-15T11:12:42                  |
   | vip_address         | 198.51.100.11                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

2. When a health monitor is present and functioning properly, you can check the status of each member.

   Example

   $ openstack loadbalancer member show pool1 member1

   A working member (member1) has an ONLINE value for its operating_status.

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | address             | 192.0.2.10                           |
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | id                  | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   | name                | member1                              |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol_port       | 1234                                 |
   | provisioning_status | ACTIVE                               |
   | subnet_id           | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   | updated_at          | 2024-01-15T11:12:42                  |
   | weight              | 1                                    |
   | monitor_port        | None                                 |
   | monitor_address     | None                                 |
   | backup              | False                                |
   +---------------------+--------------------------------------+

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a network bandwidth QoS policy (qos_policy_bandwidth) with a maximum 1024 kbps and a maximum burst rate of 1024 kb.

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack network qos policy create qos_policy_bandwidth
   
   $ openstack network qos rule create --type bandwidth-limit --max-kbps 1024 --max-burst-kbits 1024 qos-policy-bandwidth

3. Create a load balancer (lb1) on the public subnet (public_subnet) by using a QoS policy (qos-policy-bandwidth).

   Example

   $ openstack loadbalancer create --name lb1 \
   --vip-subnet-id public_subnet \
   --vip-qos-policy-id qos-policy-bandwidth --wait

4. Create a listener (listener1) on a port (80).

   Example

   $ openstack loadbalancer listener create --name listener1 \
   --protocol HTTP --protocol-port 80 lb1

5. Create the listener default pool (pool1).

   Example

   The command in this example creates an HTTP pool that uses a private subnet containing back-end servers that host an HTTP application on TCP port 80:

   $ openstack loadbalancer pool create --name pool1 --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP

6. Create a health monitor (healthmon1) on the pool that connects to the back-end servers and tests the path (/).

   Health checks are recommended but not required. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / \
   pool1

7. Add load balancer members (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the default pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 443 pool1
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 443 pool1

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a load balancer (lb1) on the public subnet (public_subnet).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer create --name lb1 --vip-subnet-id public_subnet --wait

3. Create a listener (listener1) with the allowed CIDRs (192.0.2.0/24 and 198.51.100.0/24).

   Example

   $ openstack loadbalancer listener create --name listener1 --protocol TCP --protocol-port 80 --allowed-cidr 192.0.2.0/24 --allowed-cidr 198.51.100.0/24 lb1

4. Create the listener default pool (pool1).

   Example

   In this example, a pool is created that uses a private subnet containing back-end servers that are configured with a custom application on TCP port 80:

   $ openstack loadbalancer pool create --name pool1 --lb-algorithm ROUND_ROBIN --listener listener1 --protocol TCP

5. Create a health monitor on the pool that connects to the back-end servers and tests the path (/).

   Health checks are recommended but not required. If no health monitor is defined, the member server is assumed to be ONLINE.

   Example

   $ openstack loadbalancer healthmonitor create --name healthmon1 \
   --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / pool1

6. Add load balancer members (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the default pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --subnet-id private_subnet --address 192.0.2.10 --protocol-port 80 pool1
   
   $ openstack loadbalancer member create --subnet-id private_subnet --address 192.0.2.11 --protocol-port 80 pool1

Verification

1. View and verify the listener (listener1) settings.

   Example

   $ openstack loadbalancer listener show listener1

   Sample output

   +-----------------------------+--------------------------------------+
   | Field                       | Value                                |
   +-----------------------------+--------------------------------------+
   | admin_state_up              | True                                 |
   | connection_limit            | -1                                   |
   | created_at                  | 2024-01-15T11:11:09                  |
   | default_pool_id             | None                                 |
   | default_tls_container_ref   | None                                 |
   | description                 |                                      |
   | id                          | d26ba156-03c3-4051-86e8-f8997a202d8e |
   | insert_headers              | None                                 |
   | l7policies                  |                                      |
   | loadbalancers               | 2281487a-54b9-4c2a-8d95-37262ec679d6 |
   | name                        | listener1                            |
   | operating_status            | ONLINE                               |
   | project_id                  | 308ca9f600064f2a8b3be2d57227ef8f     |
   | protocol                    | TCP                                  |
   | protocol_port               | 80                                   |
   | provisioning_status         | ACTIVE                               |
   | sni_container_refs          | []                                   |
   | timeout_client_data         | 50000                                |
   | timeout_member_connect      | 5000                                 |
   | timeout_member_data         | 50000                                |
   | timeout_tcp_inspect         | 0                                    |
   | updated_at                  | 2024-01-15T11:12:42                  |
   | client_ca_tls_container_ref | None                                 |
   | client_authentication       | NONE                                 |
   | client_crl_container_ref    | None                                 |
   | allowed_cidrs               | 192.0.2.0/24                         |
   |                             | 198.51.100.0/24                      |
   +-----------------------------+--------------------------------------+

   In this example the parameter, allowed_cidrs, is set to allow traffic only from 192.0.2.0/24 and 198.51.100.0/24.

2. To verify that the load balancer is secure, ensure that a request to the listener from a client whose CIDR is not in the allowed_cidrs list; the request does not succeed.

   Sample output

   curl: (7) Failed to connect to 203.0.113.226 port 80: Connection timed out
   curl: (7) Failed to connect to 203.0.113.226 port 80: Connection timed out
   curl: (7) Failed to connect to 203.0.113.226 port 80: Connection timed out
   curl: (7) Failed to connect to 203.0.113.226 port 80: Connection timed out

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a load balancer (lb1) on the private subnet (private_subnet) using the --provider ovn argument.

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer create --name lb1 --provider ovn \
   --vip-subnet-id private_subnet --wait

3. Create a listener (listener1) that uses the protocol (tcp) on the specified port (80) for which the custom application is configured.

   Note

   The OVN provider only supports Layer 4 TCP and UDP network traffic.

   Example

   $ openstack loadbalancer listener create --name listener1 \
   --protocol tcp --protocol-port 80 lb1

4. Create the listener default pool (pool1).

   Note

   The only supported load-balancing algorithm for OVN is SOURCE_IP_PORT.

   Example

   The command in this example creates an HTTP pool that uses a private subnet containing back-end servers that host a custom application on a specific TCP port:

   $ openstack loadbalancer pool create --name pool1 --lb-algorithm \
   SOURCE_IP_PORT --listener listener1 --protocol tcp

   Important

   OVN does not support the health monitor feature for load-balancing.

5. Add the back-end servers (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the pool.

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 80 pool1
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 80 pool1

Verification

1. View and verify the load balancer (lb1) settings.

   Example

   $ openstack loadbalancer show lb1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2024-01-15T11:11:09                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | ovn                                  |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2024-01-15T11:12:42                  |
   | vip_address         | 198.51.100.11                        |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

2. Run the openstack loadbalancer listener show command to view the listener details.

   Example

   $ openstack loadbalancer listener show listener1

   Sample output

   +-----------------------------+--------------------------------------+
   | Field                       | Value                                |
   +-----------------------------+--------------------------------------+
   | admin_state_up              | True                                 |
   | connection_limit            | -1                                   |
   | created_at                  | 2024-01-15T11:13:52                  |
   | default_pool_id             | a5034e7a-7ddf-416f-9c42-866863def1f2 |
   | default_tls_container_ref   | None                                 |
   | description                 |                                      |
   | id                          | a101caba-5573-4153-ade9-4ea63153b164 |
   | insert_headers              | None                                 |
   | l7policies                  |                                      |
   | loadbalancers               | 653b8d79-e8a4-4ddc-81b4-e3e6b42a2fe3 |
   | name                        | listener1                            |
   | operating_status            | ONLINE                               |
   | project_id                  | 7982a874623944d2a1b54fac9fe46f0b     |
   | protocol                    | TCP                                  |
   | protocol_port               | 64015                                |
   | provisioning_status         | ACTIVE                               |
   | sni_container_refs          | []                                   |
   | timeout_client_data         | 50000                                |
   | timeout_member_connect      | 5000                                 |
   | timeout_member_data         | 50000                                |
   | timeout_tcp_inspect         | 0                                    |
   | updated_at                  | 2024-01-15T11:15:17                  |
   | client_ca_tls_container_ref | None                                 |
   | client_authentication       | NONE                                 |
   | client_crl_container_ref    | None                                 |
   | allowed_cidrs               | None                                 |
   +-----------------------------+--------------------------------------+

3. Run the openstack loadbalancer pool show command to view the pool (pool1) and load-balancer members.

   Example

   $ openstack loadbalancer pool show pool1

   Sample output

   +----------------------+--------------------------------------+
   | Field                | Value                                |
   +----------------------+--------------------------------------+
   | admin_state_up       | True                                 |
   | created_at           | 2024-01-15T11:17:34                  |
   | description          |                                      |
   | healthmonitor_id     |                                      |
   | id                   | a5034e7a-7ddf-416f-9c42-866863def1f2 |
   | lb_algorithm         | SOURCE_IP_PORT                       |
   | listeners            | a101caba-5573-4153-ade9-4ea63153b164 |
   | loadbalancers        | 653b8d79-e8a4-4ddc-81b4-e3e6b42a2fe3 |
   | members              | 90d69170-2f73-4bfd-ad31-896191088f59 |
   | name                 | pool1                                |
   | operating_status     | ONLINE                               |
   | project_id           | 7982a874623944d2a1b54fac9fe46f0b     |
   | protocol             | TCP                                  |
   | provisioning_status  | ACTIVE                               |
   | session_persistence  | None                                 |
   | updated_at           | 2024-01-15T11:18:59                  |
   | tls_container_ref    | None                                 |
   | ca_tls_container_ref | None                                 |
   | crl_container_ref    | None                                 |
   | tls_enabled          | False                                |
   +----------------------+--------------------------------------+

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create an HTTP listener (http_listener) on a load balancer (lb1) port (80).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer listener create --name http_listener \
   --protocol HTTP --protocol-port 80 lb1

3. Create an L7 policy (policy1) on the listener (http_listener). The policy must contain the action (REDIRECT_TO_URL) and point to the URL (https://www.example.com/).

   Example

   $ openstack loadbalancer l7policy create --name policy1 \
   --action REDIRECT_PREFIX --redirect-prefix https://www.example.com/ \
   http_listener

4. Add an L7 rule that matches all requests to a policy (policy1).

   Example

   $ openstack loadbalancer l7rule create --compare-type STARTS_WITH \
   --type PATH --value / policy1

Verification

1. Run the openstack loadbalancer l7policy list command and verify that the policy, policy1, exists.

2. Run the openstack loadbalancer l7rule list <l7policy> command and verify that a rule with a compare_type of STARTS_WITH exists.

   Example

   $ openstack loadbalancer l7rule list policy1

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a second pool (static_pool) on a load balancer (lb1).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer pool create --name static_pool \
   --lb-algorithm ROUND_ROBIN --loadbalancer lb1 --protocol HTTP

3. Add load balancer members (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the pool (static_pool):

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 80 static_pool
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 80 static_pool

4. Create an L7 policy (policy1) on the listener (listener1). The policy must contain the action (REDIRECT_TO_POOL) and point to the pool (static_pool).

   Example

   $ openstack loadbalancer l7policy create --name policy1 \
   --action REDIRECT_TO_POOL --redirect-pool static_pool listener1

5. Add an L7 rule that looks for /js at the start of the request path to the policy.

   Example

   $ openstack loadbalancer l7rule create --compare-type STARTS_WITH \
   --type PATH --value /js policy1

6. Create an L7 policy (policy2) with an action (REDIRECT_TO_POOL) and add the listener (listener1) pointed at the pool.

   Example

   $ openstack loadbalancer l7policy create --name policy2 \
   --action REDIRECT_TO_POOL --redirect-pool static_pool listener1

7. Add an L7 rule that looks for /images at the start of the request path to the policy.

   Example

   $ openstack loadbalancer l7rule create --compare-type STARTS_WITH \
   --type PATH --value /images policy2

Verification

1. Run the openstack loadbalancer l7policy list command and verify that the policies, policy1 and policy2, exist.

2. Run the openstack loadbalancer l7rule list <l7policy> command and verify that a rule with a compare_type of STARTS_WITH exists for each respective policy.

   Example

   $ openstack loadbalancer l7rule list policy1
   
   $ openstack loadbalancer l7rule list policy2

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a second pool (pool2) on the load balancer (lb1).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer pool create --name pool2 \
   --lb-algorithm ROUND_ROBIN --loadbalancer lb1 --protocol HTTP

3. Create an L7 policy (policy1) on the listener (listener1). The policy must contain the action (REDIRECT_TO_POOL) and point to the pool (pool2).

   Example

   $ openstack loadbalancer l7policy create --name policy1 \
   --action REDIRECT_TO_POOL --redirect-pool pool2 listener1

4. Add an L7 rule to the policy that sends any requests using the HTTP/1.1 hostname, www2.example.com, to the second pool (pool2).

   Example

   $ openstack loadbalancer l7rule create --compare-type EQUAL_TO \
   --type HOST_NAME --value www2.example.com policy1

Verification

1. Run the openstack loadbalancer l7policy list command and verify that the policy, policy1, exists.

2. Run the openstack loadbalancer l7rule list <l7policy> command and verify that a rule with a compare_type of EQUAL_TO exists for the policy.

   Example

   $ openstack loadbalancer l7rule list policy1

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a second pool (pool2) on the load balancer (lb1).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer pool create --name pool2 \
   --lb-algorithm ROUND_ROBIN --loadbalancer lb1 --protocol HTTP

3. Create an L7 policy (policy1) on the listener (listener1). The policy must contain the action (REDIRECT_TO_POOL) and point to the pool (pool2).

   Example

   $ openstack loadbalancer l7policy create --name policy1 \
   --action REDIRECT_TO_POOL --redirect-pool pool2 listener1

4. Add an L7 rule to the policy that sends any requests that use an HTTP/1.1 hostname (www2.example.com) to the second pool (pool2).

   Example

   $ openstack loadbalancer l7rule create --compare-type ENDS_WITH \
   --type HOST_NAME --value .example.com policy1

Verification

1. Run the openstack loadbalancer l7policy list command and verify that the policy, policy1, exists.

2. Run the openstack loadbalancer l7rule list <l7policy> command and verify that a rule with a compare_type of EQUAL_TO exists for the policy.

   Example

   $ openstack loadbalancer l7rule list policy1

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a second pool (login_pool) on the load balancer (lb1).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer pool create --name login_pool \
   --lb-algorithm ROUND_ROBIN --loadbalancer lb1 --protocol HTTP

3. Add a member, the secure authentication server (192.0.2.10) on the authenticating subnet (secure_subnet), to the second pool.

   Example

   In this example, the back-end server, 192.0.2.10, is named member1:

   $ openstack loadbalancer member create --name member1 \
   --address 192.0.2.10 --protocol-port 80 --subnet-id secure_subnet \
   login_pool

4. Create an L7 policy (policy1) on the listener (listener1). The policy must contain the action (REDIRECT_TO_POOL) and point to the second pool (login_pool).

   Example

   $ openstack loadbalancer l7policy create --name policy1 \
   --action REDIRECT_TO_POOL --redirect-pool login_pool listener1

5. Add an L7 rule to the policy (policy1) that searches for the browser cookie (auth_token) with any value, and matches if the cookie is NOT present.

   Example

   $ openstack loadbalancer l7rule create --compare-type REGEX \
   --key auth_token --type COOKIE --value '.*' --invert policy1

Verification

1. Run the openstack loadbalancer l7policy list command and verify that the policy, policy1, exists.

2. Run the openstack loadbalancer l7rule list <l7policy> command and verify that a rule with a compare_type of REGEX exists.

   Example

   $ openstack loadbalancer l7rule list policy1

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a second pool (login_pool) on the load balancer (lb1).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer pool create --name login_pool \
   --lb-algorithm ROUND_ROBIN --loadbalancer lb1 --protocol HTTP

3. Add a member, the secure authentication server (192.0.2.10) on the authenticating subnet (secure_subnet), to the second pool.

   Example

   In this example, the back-end server, 192.0.2.10, is named member1:

   $ openstack loadbalancer member create --name member1 \
   --address 192.0.2.10 --protocol-port 80 --subnet-id secure_subnet \
   login_pool

4. Create an L7 policy (policy1) on the listener (listener1). The policy must contain the action (REDIRECT_TO_POOL) and point to the second pool (login_pool).

   Example

   $ openstack loadbalancer l7policy create --action REDIRECT_TO_POOL \
   --redirect-pool login_pool --name policy1 listener1

5. Add an L7 rule to the policy (policy1) that searches for the browser cookie (auth_token) with any value, and matches if the cookie is NOT present.

   Example

   $ openstack loadbalancer l7rule create --compare-type REGEX \
   --key auth_token --type COOKIE --value '.*' --invert policy1

6. Create a second L7 policy (policy2) on the listener (listener1). The policy must contain the action (REDIRECT_TO_POOL) and point to the second pool (login_pool).

   Example

   $ openstack loadbalancer l7policy create --action REDIRECT_TO_POOL \
   --redirect-pool login_pool --name policy2 listener1

7. Add an L7 rule to the second policy (policy2) that searches for the browser cookie (auth_token) and matches if the cookie value equals the string INVALID.

   Example

   $ openstack loadbalancer l7rule create --compare-type EQUAL_TO \
   --key auth_token --type COOKIE --value INVALID policy2

Verification

1. Run the openstack loadbalancer l7policy list command and verify that the policies, policy1 and policy2, exist.

2. Run the openstack loadbalancer l7rule list <l7policy> command and verify that a rule with a compare_type of REGEX exists for policy1 and a rule with a compare_type of EQUAL_TO exists for policy2.

   Example

   $ openstack loadbalancer l7rule list policy1
   
   $ openstack loadbalancer l7rule list policy2

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a second pool (api_pool) on the load balancer (lb1).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer pool create --name api_pool \
   --lb-algorithm ROUND_ROBIN --loadbalancer lb1 --protocol HTTP

3. Add load balancer members (192.0.2.10 and 192.0.2.11) on the private subnet (private_subnet) to the pool (static_pool):

   Example

   In this example, the back-end servers, 192.0.2.10 and 192.0.2.11, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 --subnet-id \
   private_subnet --address 192.0.2.10 --protocol-port 80 static_pool
   
   $ openstack loadbalancer member create --name member2 --subnet-id \
   private_subnet --address 192.0.2.11 --protocol-port 80 static_pool

4. Create an L7 policy (policy1) on the listener (listener1). The policy must contain the action (REDIRECT_TO_POOL) and point to the pool (api_pool).

   Example

   $ openstack loadbalancer l7policy create --action REDIRECT_TO_POOL \
   --redirect-pool api_pool --name policy1 listener1

5. Add an L7 rule to the policy that matches the hostname api.example.com.

   Example

   $ openstack loadbalancer l7rule create --compare-type EQUAL_TO \
   --type HOST_NAME --value api.example.com policy1

6. Add a second L7 rule to the policy that matches /api at the start of the request path.

   This rule is logically ANDed with the first rule.

   Example

   $ openstack loadbalancer l7rule create --compare-type STARTS_WITH \
   --type PATH --value /api policy1

Verification

1. Run the openstack loadbalancer l7policy list command and verify that the policy, policy1, exists.

2. Run the openstack loadbalancer l7rule list <l7policy> command and verify that rules with a compare_type of EQUAL_TO and STARTS_WITH, respectively, both exist for policy1.

   Example

   $ openstack loadbalancer l7rule list policy1
   
   $ openstack loadbalancer l7rule list policy2

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Create a third pool (pool_B) on a load balancer (lb1).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer pool create --name pool_B \
   --lb-algorithm ROUND_ROBIN --loadbalancer lb1 --protocol HTTP

3. Add load balancer members (192.0.2.50 and 192.0.2.51) on the private subnet (private_subnet) to the pool (pool_B):

   Example

   In this example, the back-end servers, 192.0.2.50 and 192.0.2.51, are named member1 and member2, respectively:

   $ openstack loadbalancer member create --name member1 \
   --address 192.0.2.50 --protocol-port 80 \
   --subnet-id private_subnet pool_B
   
   $ openstack loadbalancer member create --name member2 \
   --address 192.0.2.51 --protocol-port 80 \
   --subnet-id private_subnet pool_B

4. Create a fourth pool (static_pool_B) on a load balancer (lb1).

   Example

   $ openstack loadbalancer pool create --name static_pool_B \
   --lb-algorithm ROUND_ROBIN --loadbalancer lb1 --protocol HTTP

5. Add load balancer members (192.0.2.100 and 192.0.2.101) on the private subnet (private_subnet) to the pool (static_pool_B):

   Example

   $ openstack loadbalancer member create --name member3 \
   --address 192.0.2.100 --protocol-port 80 \
   --subnet-id private_subnet static_pool_B
   
   $ openstack loadbalancer member create --name member4 \
   --address 192.0.2.101 --protocol-port 80 \
   --subnet-id private_subnet static_pool_B

6. Create an L7 policy (policy2) on the listener (listener1). The policy must contain the action (REDIRECT_TO_POOL) and point to the pool (static_pool_B). Insert the policy at position 1.

   Example

   $ openstack loadbalancer l7policy create --action REDIRECT_TO_POOL \
   --redirect-pool static_pool_B --name policy2 --position 1 listener1

7. Add an L7 rule to the policy (policy2) that uses a regular expression to match either /js or /images at the start of the request path.

   Example

   $ openstack loadbalancer l7rule create --compare-type REGEX \
   --type PATH --value '^/(js|images)' policy2

8. Add a second L7 rule to the policy (policy2) that matches the cookie (site_version) to the exact string (B).

   Example

   $ openstack loadbalancer l7rule create --compare-type EQUAL_TO \
   --key site_version --type COOKIE --value B policy2

9. Create an L7 policy (policy3) on the listener (listener1). The policy must contain the action (REDIRECT_TO_POOL) and point to the pool (pool_B). Insert the policy at position 2.

   Example

   $ openstack loadbalancer l7policy create --action REDIRECT_TO_POOL \
   --redirect-pool pool_B --name policy3 --position 2 listener1

10. Add an L7 rule to the policy (policy3) that matches the cookie (site_version) to the exact string (B).

    Example

    $ openstack loadbalancer l7rule create --compare-type EQUAL_TO \
    --key site_version --type COOKIE --value B policy3

    Note

    It is important to assign L7 policies with the most specific rules to a lower position, because the first policy whose rules all evaluate to True is the policy whose action is followed. In this procedure, policy2 needs to be evaluated before policy3 to avoid requests being sent to the incorrect pool.

Verification

1. Run the openstack loadbalancer l7policy list command and verify that the policies, policy2 and policy3, exist.

2. Run the openstack loadbalancer l7rule list <l7policy> command and verify that a rule with a compare_type of STARTS_WITH exists for each respective policy.

   Example

   $ openstack loadbalancer l7rule list policy2
   
   $ openstack loadbalancer l7rule list policy3

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Add a tag to a load-balancing object when you create it by using the --tag <tag> option with the appropriate create command for the object:

   • openstack loadbalancer create --tag <tag> …​
   • openstack loadbalancer listener create --tag <tag> …​
   • openstack loadbalancer pool create --tag <tag> …​
   • openstack loadbalancer member create --tag <tag> …​
   • openstack loadbalancer healthmonitor create --tag <tag> …​
   • openstack loadbalancer l7policy create --tag <tag> …​

   • openstack loadbalancer l7rule create --tag <tag> …​

     Note

     A tag can be any valid unicode string with a maximum length of 255 characters.

     Example - creating and tagging a load balancer

     In this example a load balancer, lb1, is created with two tags, Finance and Sales:

     $ openstack loadbalancer create --name lb1 \
     --vip-subnet-id public_subnet --tag Finance --tag Sales

     Note

     Load-balancing service objects can have one or more tags. Repeat the --tag <tag> option for each additional tag that you want to add.

     Example - creating and tagging a listener

     In this example a listener, listener1, is created with a tag, Sales:

     $ openstack loadbalancer listener create --name listener1 --protocol HTTP --protocol-port 80 --tag Sales lb1

     Example - creating and tagging a pool

     In this example a pool, pool1, is created with a tag, Sales:

     $ openstack loadbalancer pool create --name pool1 \
     --lb-algorithm ROUND_ROBIN --listener listener1 \
     --protocol HTTP --tag Sales

     Example - creating a member in a pool and tagging it

     In this example a member, 192.0.2.10, is created in pool1 with a tag, Sales:

     $ openstack loadbalancer member create --name member1 \
     --subnet-id private_subnet --address 192.0.2.10 --protocol-port 80 \
     --tag Sales pool1

     Example - creating and tagging a health monitor

     In this example a health monitor, healthmon1, is created with a tag, Sales:

     $ openstack loadbalancer healthmonitor create --name healthmon1 \
     --delay 15 --max-retries 4 --timeout 10 --type HTTP --url-path / \
     --tag Sales pool1

     Example - creating and tagging an L7 policy

     In this example an L7 policy, policy1, is created with a tag, Sales:

     $ openstack loadbalancer l7policy create --action REDIRECT_PREFIX \
     --redirect-prefix https://www.example.com/ \
     --name policy1 http_listener --tag Sales

     Example - creating and tagging an L7 rule

     In this example an L7 rule, rule1, is created with a tag, Sales:

     $ openstack loadbalancer l7rule create --compare-type STARTS_WITH \
     --type PATH --value / --tag Sales policy1

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Do one of the following:

   • Add a tag to a pre-existing load-balancing object by using the --tag <tag> option with the appropriate set command for the object:

     • openstack loadbalancer set --tag <tag> <load_balancer_name_or_ID>
     • openstack loadbalancer listener set --tag <tag> <listener_name_or_ID>
     • openstack loadbalancer pool set --tag <tag> <pool_name_or_ID>
     • openstack loadbalancer member set --tag <tag> <pool_name_or_ID> <member_name_or_ID>
     • openstack loadbalancer healthmonitor set --tag <tag> <healthmon_name_or_ID>
     • openstack loadbalancer l7policy set --tag <tag> <l7policy_name_or_ID>

     • openstack loadbalancer l7rule set --tag <tag> <l7policy_name_or_ID> <l7rule_ID>

       Note

       A tag can be any valid unicode string with a maximum length of 255 characters.

       Example

       In this example the tags, Finance and Sales, are added to the load balancer, lb1:

       $ openstack loadbalancer set --tag Finance --tag Sales lb1

       Note

       Load-balancing service objects can have one or more tags. Repeat the --tag <tag> option for each additional tag that you want to add.

   • Remove a tag from a pre-existing load-balancing object by using the --tag <tag> option with the appropriate unset command for the object:

     • openstack loadbalancer unset --tag <tag> <load_balancer_name_or_ID>
     • openstack loadbalancer listener unset --tag <tag> <listener_name_or_ID>
     • openstack loadbalancer pool unset --tag <tag> <pool_name_or_ID>
     • openstack loadbalancer member unset --tag <tag> <pool_name_or_ID> <member_name_or_ID>
     • openstack loadbalancer healthmonitor unset --tag <tag> <healthmon_name_or_ID>
     • openstack loadbalancer l7policy unset --tag <tag> <policy_name_or_ID>

     • openstack loadbalancer l7rule unset --tag <tag> <policy_name_or_ID> <l7rule_ID>

       Example

       In this example, the tag, Sales, is removed from the load balancer, lb1:

       $ openstack loadbalancer unset --tag Sales lb1

   • Remove all tags from a pre-existing load-balancing object by using the --no-tag option with the appropriate set command for the object:

     • openstack loadbalancer set --no-tag <load_balancer_name_or_ID>
     • openstack loadbalancer listener set --no-tag <listener_name_or_ID>
     • openstack loadbalancer pool set --no-tag <pool_name_or_ID>
     • openstack loadbalancer member set --no-tag <pool_name_or_ID> <member_name_or_ID>
     • openstack loadbalancer healthmonitor set --no-tag <healthmon_name_or_ID>
     • openstack loadbalancer l7policy set --no-tag <l7policy_name_or_ID>

     • openstack loadbalancer l7rule set --no-tag <l7policy_name_or_ID> <l7rule_ID>

       Example

       In this example, all tags are removed from the load balancer, lb1:

       $ openstack loadbalancer set --no-tag lb1

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Filter the objects that you want to list by running the appropriate loadbalancer list command for the objects with one of the tag options:

   Table 9.1. Tag options for filtering objects

   In my list, I want to…​	Examples
   include objects that match all specified tags.	$ openstack loadbalancer list --tags Sales,Finance $ openstack loadbalancer listener list --tags Sales,Finance $ openstack loadbalancer l7pool list --tags Sales,Finance $ openstack loadbalancer member list --tags Sales,Finance pool1 $ openstack loadbalancer healthmonitor list --tags Sales,Finance $ openstack loadbalancer l7policy list --tags Sales,Finance $ openstack loadbalancer l7rule list --tags Sales,Finance policy1
   include objects that match one or more specified tags.	$ openstack loadbalancer list --any-tags Sales,Finance $ openstack loadbalancer listener list --any-tags Sales,Finance $ openstack loadbalancer l7pool list --any-tags Sales,Finance $ openstack loadbalancer member list --any-tags Sales,Finance pool1 $ openstack loadbalancer healthmonitor list --any-tags Sales,Finance $ openstack loadbalancer l7policy list --any-tags Sales,Finance $ openstack loadbalancer l7rule list --any-tags Sales,Finance policy1
   exclude objects that match all specified tags.	$ openstack loadbalancer list --not-tags Sales,Finance $ openstack loadbalancer listener list --not-tags Sales,Finance $ openstack loadbalancer l7pool list --not-tags Sales,Finance $ openstack loadbalancer member list --not-tags Sales,Finance pool1 $ openstack loadbalancer healthmonitor list --not-tags Sales,Finance $ openstack loadbalancer l7policy list --not-tags Sales,Finance $ openstack loadbalancer l7rule list --not-tags Sales,Finance policy1
   exclude objects that match one or more specified tags.	$ openstack loadbalancer list --not-any-tags Sales,Finance $ openstack loadbalancer listener list --not-any-tags Sales,Finance $ openstack loadbalancer l7pool list --not-any-tags Sales,Finance $ openstack loadbalancer member list --not-any-tags Sales,Finance pool1 $ openstack loadbalancer healthmonitor list --not-any-tags Sales,Finance $ openstack loadbalancer l7policy list --not-any-tags Sales,Finance $ openstack loadbalancer l7rule list --not-any-tags Sales,Finance policy1

   Note

   When specifying more than one tag, separate the tags by using a comma.

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. Verify the load balancer (lb1) settings.

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer show lb1

   Sample output

   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2024-02-17T15:59:18                  |
   | description         |                                      |
   | flavor_id           | None                                 |
   | id                  | 265d0b71-c073-40f4-9718-8a182c6d53ca |
   | listeners           | 5aaa67da-350d-4125-9022-238e0f7b7f6f |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 48f6664c-b192-4763-846a-da568354da4a |
   | project_id          | 52376c9c5c2e434283266ae7cacd3a9c     |
   | provider            | amphora                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2024-02-17T16:01:21                  |
   | vip_address         | 192.0.2.177                          |
   | vip_network_id      | afeaf55e-7128-4dff-80e2-98f8d1f2f44c |
   | vip_port_id         | 94a12275-1505-4cdc-80c9-4432767a980f |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 06ffa90e-2b86-4fe3-9731-c7839b0be6de |
   +---------------------+--------------------------------------+

3. Using the loadbalancer ID (265d0b71-c073-40f4-9718-8a182c6d53ca) from the previous step, obtain the ID of the amphora associated with the load balancer (lb1).

   Example

   $ openstack loadbalancer amphora list | grep 265d0b71-c073-40f4-9718-8a182c6d53ca

   Sample output

   | 1afabefd-ba09-49e1-8c39-41770aa25070 | 265d0b71-c073-40f4-9718-8a182c6d53ca | ALLOCATED | STANDALONE | 198.51.100.7  | 192.0.2.177   |

4. Using the amphora ID (1afabefd-ba09-49e1-8c39-41770aa25070) from the previous step, view amphora information.

   Example

   $ openstack loadbalancer amphora show 1afabefd-ba09-49e1-8c39-41770aa25070

   Sample output

   +-----------------+--------------------------------------+
   | Field           | Value                                |
   +-----------------+--------------------------------------+
   | id              | 1afabefd-ba09-49e1-8c39-41770aa25070 |
   | loadbalancer_id | 265d0b71-c073-40f4-9718-8a182c6d53ca |
   | compute_id      | ba9fc1c4-8aee-47ad-b47f-98f12ea7b200 |
   | lb_network_ip   | 198.51.100.7                         |
   | vrrp_ip         | 192.0.2.36                           |
   | ha_ip           | 192.0.2.177                          |
   | vrrp_port_id    | 07dcd894-487a-48dc-b0ec-7324fe5d2082 |
   | ha_port_id      | 94a12275-1505-4cdc-80c9-4432767a980f |
   | cert_expiration | 2026-03-19T15:59:23                  |
   | cert_busy       | False                                |
   | role            | STANDALONE                           |
   | status          | ALLOCATED                            |
   | vrrp_interface  | None                                 |
   | vrrp_id         | 1                                    |
   | vrrp_priority   | None                                 |
   | cached_zone     | nova                                 |
   | created_at      | 2024-02-17T15:59:22                  |
   | updated_at      | 2024-02-17T16:00:50                  |
   | image_id        | 53001253-5005-4891-bb61-8784ae85e962 |
   | compute_flavor  | 65                                   |
   +-----------------+--------------------------------------+

5. View the listener (listener1) details.

   Example

   $ openstack loadbalancer listener show listener1

   Sample output

   +-----------------------------+--------------------------------------+
   | Field                       | Value                                |
   +-----------------------------+--------------------------------------+
   | admin_state_up              | True                                 |
   | connection_limit            | -1                                   |
   | created_at                  | 2024-02-17T16:00:59                  |
   | default_pool_id             | 48f6664c-b192-4763-846a-da568354da4a |
   | default_tls_container_ref   | None                                 |
   | description                 |                                      |
   | id                          | 5aaa67da-350d-4125-9022-238e0f7b7f6f |
   | insert_headers              | None                                 |
   | l7policies                  |                                      |
   | loadbalancers               | 265d0b71-c073-40f4-9718-8a182c6d53ca |
   | name                        | listener1                            |
   | operating_status            | ONLINE                               |
   | project_id                  | 52376c9c5c2e434283266ae7cacd3a9c     |
   | protocol                    | HTTP                                 |
   | protocol_port               | 80                                   |
   | provisioning_status         | ACTIVE                               |
   | sni_container_refs          | []                                   |
   | timeout_client_data         | 50000                                |
   | timeout_member_connect      | 5000                                 |
   | timeout_member_data         | 50000                                |
   | timeout_tcp_inspect         | 0                                    |
   | updated_at                  | 2024-02-17T16:01:21                  |
   | client_ca_tls_container_ref | None                                 |
   | client_authentication       | NONE                                 |
   | client_crl_container_ref    | None                                 |
   | allowed_cidrs               | None                                 |
   +-----------------------------+--------------------------------------+

6. View the pool (pool1) and load-balancer members.

   Example

   $ openstack loadbalancer pool show pool1

   Sample output

   +----------------------+--------------------------------------+
   | Field                | Value                                |
   +----------------------+--------------------------------------+
   | admin_state_up       | True                                 |
   | created_at           | 2024-02-17T16:01:08                  |
   | description          |                                      |
   | healthmonitor_id     | 4b24180f-74c7-47d2-b0a2-4783ada9a4f0 |
   | id                   | 48f6664c-b192-4763-846a-da568354da4a |
   | lb_algorithm         | ROUND_ROBIN                          |
   | listeners            | 5aaa67da-350d-4125-9022-238e0f7b7f6f |
   | loadbalancers        | 265d0b71-c073-40f4-9718-8a182c6d53ca |
   | members              | b92694bd-3407-461a-92f2-90fb2c4aedd1 |
   |                      | 4ccdd1cf-736d-4b31-b67c-81d5f49e528d |
   | name                 | pool1                                |
   | operating_status     | ONLINE                               |
   | project_id           | 52376c9c5c2e434283266ae7cacd3a9c     |
   | protocol             | HTTP                                 |
   | provisioning_status  | ACTIVE                               |
   | session_persistence  | None                                 |
   | updated_at           | 2024-02-17T16:05:21                  |
   | tls_container_ref    | None                                 |
   | ca_tls_container_ref | None                                 |
   | crl_container_ref    | None                                 |
   | tls_enabled          | False                                |
   +----------------------+--------------------------------------+

7. Verify HTTPS traffic flows across a load balancer whose listener is configured for HTTPS or TERMINATED_HTTPS protocols by connecting to the VIP address (192.0.2.177) of the load balancer.

   Tip

   Obtain the load-balancer VIP address by using the command, openstack loadbalancer show <load_balancer_name>.

   Note

   Security groups implemented for the load balancer VIP only allow data traffic for the required protocols and ports. For this reason you cannot ping load balancer VIPs, because ICMP traffic is blocked.

   Example

   $ curl -v https://192.0.2.177 --insecure

   Sample output

   * About to connect() to 192.0.2.177 port 443 (#0)
   *   Trying 192.0.2.177...
   * Connected to 192.0.2.177 (192.0.2.177) port 443 (#0)
   * Initializing NSS with certpath: sql:/etc/pki/nssdb
   * skipping SSL peer certificate verification
   * SSL connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
   * Server certificate:
   * 	subject: CN=www.example.com,O=Dis,L=Springfield,ST=Denial,C=US
   * 	start date: Jan 15 09:21:45 2024 GMT
   * 	expire date: Jan 15 09:21:45 2027 GMT
   * 	common name: www.example.com
   * 	issuer: CN=www.example.com,O=Dis,L=Springfield,ST=Denial,C=US
   > GET / HTTP/1.1
   > User-Agent: curl/7.29.0
   > Host: 192.0.2.177
   > Accept: */*
   >
   < HTTP/1.1 200 OK
   < Content-Length: 30
   <
   * Connection #0 to host 192.0.2.177 left intact

Procedure

1. Access the remote shell for the OpenStackClient pod from your workstation:

   $ oc rsh -n openstack openstackclient

2. Locate the ID of the amphora that you want to migrate. You need to provide the ID in a later step.

   $ openstack loadbalancer amphora list

3. To prevent the Compute scheduler service from scheduling any new amphorae to the Compute node being evacuated, disable the Compute node (compute-host-1).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack compute service set compute-host-1 nova-compute --disable

4. Fail over the amphora by using the amphora ID (ea17210a-1076-48ff-8a1f-ced49ccb5e53) that you obtained.

   Example

   $ openstack loadbalancer amphora failover ea17210a-1076-48ff-8a1f-ced49ccb5e53

5. Exit the openstackclient pod:

   $ exit

Procedure

1. Confirm that the system OS_CLOUD variable is set for your cloud:

   $ echo $OS_CLOUD
   my_cloud

   Reset the variable if necessary:

   $ export OS_CLOUD=my_other_cloud

   As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

2. View the stats for the listener (listener1).

   Note

   Values inside parentheses are sample values that are used in the example commands in this procedure. Substitute these sample values with values that are appropriate for your site.

   Example

   $ openstack loadbalancer listener stats show listener1

   Tip

   If you do not know the name of the listener, enter the command loadbalancer listener list.

   Sample output

   +--------------------+-------+
   | Field              | Value |
   +--------------------+-------+
   | active_connections | 0     |
   | bytes_in           | 0     |
   | bytes_out          | 0     |
   | request_errors     | 0     |
   | total_connections  | 0     |
   +--------------------+-------+