Migrating services from an NLB load balancer with VMs as targets to an L7 ALB load balancer using Terraform

To migrate a service from a network load balancer to an L7 load balancer using Terraform:

1. See recommendations for service migration.
2. Create your infrastructure. At this step, you will connect your Smart Web Security profile to a virtual host of the L7 load balancer.
3. Test the L7 load balancer.
4. Migrate the user load from the network load balancer to the L7 load balancer.

Service migration recommendationsService migration recommendations

1. In addition to DDoS protection at OSI L7 using Yandex Smart Web Security, we recommend enabling DDoS protection at L3-L4. To do this, reserve a public static IP address with DDoS protection in advance and use this address for the L7 load balancer's listener.

   If the network load balancer's listener already uses a public IP address with DDoS protection, you can save it and use it for the L7 load balancer.

   If the network load balancer's listener uses a public IP address without DDoS protection, DDoS protection at L3-L4 when migrating to an L7 load balancer can only be achieved by changing the public IP for your service.

   When using L3-L4 DDoS protection, configure a trigger threshold for the L3-L4 protection mechanisms aligned with the amount of legitimate traffic to the protected resource. To set up this threshold, contact support.

   Also, set the MTU value to 1450 for the targets downstream of the load balancer. For more information, see Setting up MTU when enabling DDoS protection.

2. We recommend performing migration during the hours when the user load is at its lowest. If you plan to keep your public IP address, bear in mind that migration involves moving this IP address from the load balancer to the L7 load balancer. Your service will be unavailable during this period. Under normal conditions, this may last for several minutes.

3. When using an L7 load balancer, requests to backends come with the source IP address from the range of internal IP addresses of the subnets specified when creating the L7 load balancer. The original IP address of the request source (user) is specified in the X-Forwarded-For header. If you want to log public IP addresses of users on the web server, reconfigure it.

4. See the autoscaling and resource units in the L7 load balancer.

Create an infrastructureCreate an infrastructure

1. If you do not have Terraform yet, install it.

2. Get the authentication credentials. You can add them to environment variables or specify them later in the provider configuration file.

3. Configure and initialize a provider. There is no need to create a provider configuration file manually, you can download it.

4. Place the configuration file in a separate working directory and specify the parameter values. If you did not add the authentication credentials to environment variables, specify them in the configuration file.

5. Download a configuration file to the same working directory based on the protocol you are using:

   • HTTP: alb-vm-http.tf configuration file.
   • HTTPS: alb-vm-https.tf configuration file.

   These files describe:

   • Subnets for the L7 load balancer.
   • Security group for the L7 load balancer.
   • Static address for the L7 load balancer.
   • Importing a TLS certificate to Certificate Manager (if HTTPS is used).
   • Smart Web Security profile.
   • Target group, backend group, and HTTP router for the L7 load balancer.
   • L7-balancer.

6. In the configuration file, set the following user-defined properties:

   1. Specify the values for the variables:

      • domain_name: Your service domain name.
      • network_id: ID of the network containing the VMs from the network load balancer's target group.
      • certificate (for HTTPS): Path to the self-signed custom certificate.
      • private_key (for HTTPS): Path to the private key file.

   2. For the yandex_alb_target_group resource, add as many target blocks as there are VMs in your network load balancer's target group.

      resource "yandex_alb_target_group" "alb-target-group" {
        ...
        target {
          subnet_id    = "<subnet_ID>"
          ip_address   = "<VM_1_internal_IP_address>"
        }
        target {
          subnet_id    = "<subnet_ID>"
          ip_address   = "<VM_2_internal_IP_address>"
        }
        ...
        target {
          subnet_id    = "<subnet_ID>"
          ip_address   = "<VM_N_internal_IP_address>"
        }
      }
      

      Where:

      • subnet_id: ID of the subnet hosting the VM.
      • ip_address: Internal IP address of the VM, specified in the target group of your network load balancer.

   3. If your service requires requests to be processed within a single user session by the same backend resource, enable session affinity for the backend group: uncomment this section for the yandex_alb_backend_group resource:

      session_affinity {
        connection {
          source_ip = true
        }
      }
      

7. Make sure the Terraform configuration files are correct using this command:

   terraform validate
   

   If there are any errors in the configuration files, Terraform will point them out.

8. Create the required infrastructure:

   1. Run the command to view planned changes:

      terraform plan
      

      If the resource configuration descriptions are correct, the terminal will display a list of the resources to modify and their parameters. This is a test step. No resources are updated.

   2. If you are happy with the planned changes, apply them:

      1. Run the command:

         terraform apply
         

      2. Confirm the update of resources.

      3. Wait for the operation to complete.

   All the required resources will be created in the specified folder. You can check resource availability and their settings in the management console.

9. Specify autoscaling settings in the L7 load balancer:

   1. In the management console, select the folder where you created the L7 load balancer.
   2. Select Application Load Balancer.
   3. Click the name of the load balancer in question.
   4. Click and select Edit.
   5. Under Autoscaling settings, set a limit on the number of resource units.

Test the L7 load balancerTest the L7 load balancer

1. Wait until the L7 load balancer goes Active.

2. Go to the new L7 load balancer and select Health checks on the left. Make sure you get HEALTHY for all the L7 load balancer's health checks.

3. Run a test request to the service through the L7 load balancer, for example, using one of these methods:

   • Add this record to the hosts file on your workstation: <L7_load_balancer_public_IP_address> <service_domain_name>. Delete the record after the test.

   • Execute the request using cURL depending on the protocol type:

     curl http://<service_domain_name> \
         --resolve <service_domain_name>:<service_port>:<public_IP_address_of_L7_load_balancer>
     

     curl https://<service_domain_name> \
         --resolve <service_domain_name>:<service_port>:<public_IP_address_of_L7_load_balancer>
     

Migrate the user load from the network load balancer to the L7 load balancerMigrate the user load from the network load balancer to the L7 load balancer

Select one of the migration options:

• Keep the public IP address for your service.
• Do not keep public IP address for your service.

Keep the public IP address for your serviceKeep the public IP address for your service

1. If your external network load balancer uses a dynamic public IP address, convert it to static.

2. Delete the listener in the network load balancer to release the static public IP address. This will make your service unavailable through the network load balancer.

3. In the L7 load balancer, assign to the listener the public IP address previously used by the network load balancer:

   1. Open the configuration file you used to create the L7 load balancer (alb-vm-http.tf or alb-vm-https.tf).

   2. In the load balancer description, change the address parameter value under listener.endpoint.address.external_ipv4_address:

      resource "yandex_alb_load_balancer" "<load_balancer_name>" {
        ...
        listener {
          ...
          endpoint {
            address {
              external_ipv4_address {
                address = <service_public_IP_address>
              }
            }
            ports = [ <service_port> ]
          }
        }
      }
      

      Where address is the public IP address previously used by the network load balancer.

   3. Apply the changes:

      1. In the terminal, change to the folder where you edited the configuration file.

      2. Make sure the configuration file is correct using the command:

         terraform validate
         

         If the configuration is correct, the following message is returned:

         Success! The configuration is valid.
         

      3. Run the command:

         terraform plan
         

         The terminal will display a list of resources with parameters. No changes are made at this step. If the configuration contains errors, Terraform will point them out.

      4. Apply the configuration changes:

         terraform apply
         

      5. Confirm the changes: type yes in the terminal and press Enter.

4. After the IP addresses changes, your service will again be available through the L7 load balancer. Monitor the L7 load balancer's user load from the load balancer statistics charts.

5. Delete the now free static public IP address you selected when creating the L7 load balancer:

   1. Open the configuration file you used to create the L7 load balancer (alb-vm-http.tf or alb-vm-https.tf).

   2. Delete the yandex_vpc_address resource description from the file:

      resource "yandex_vpc_address" "static-address" {
        description = "Static public IP address for the Application Load Balancer"
        name        = "alb-static-address"
        external_ipv4_address {
          zone_id                  = "ru-central1-a"
          ddos_protection_provider = "qrator"
        }
      }
      

   3. Apply the changes:

      1. In the terminal, change to the folder where you edited the configuration file.

      2. Make sure the configuration file is correct using the command:

         terraform validate
         

         If the configuration is correct, the following message is returned:

         Success! The configuration is valid.
         

      3. Run the command:

         terraform plan
         

         The terminal will display a list of resources with parameters. No changes are made at this step. If the configuration contains errors, Terraform will point them out.

      4. Apply the configuration changes:

         terraform apply
         

      5. Confirm the changes: type yes in the terminal and press Enter.

6. (Optional) Delete the network load balancer after migrating the user load to the L7 load balancer.

Do not keep the public IP address for your serviceDo not keep the public IP address for your service

1. To migrate the user load from a network load balancer to an L7 load balancer, in the DNS service of your domain's public zone, change the A record value for the service domain name to the public IP address of the L7 load balancer. If the public domain zone was created in Yandex Cloud DNS, change the record using this guide.

   Note

   The propagation of DNS record updates depends on the time-to-live (TTL) value and the number of links in the DNS request chain. This process can take a long time.

2. As the DNS record updates propagate, follow the increase of requests to the L7 load balancer from the load balancer statistics charts.

3. Follow the decrease of the network load balancer load using the processed_bytes and processed_packets load balancer metrics. You can create a dashboard to visualize these metrics. The absence of load on the network load balancer for a prolonged period of time indicates that the user load has been transferred to the L7 load balancer.

4. (Optional) Delete the network load balancer after migrating the user load to the L7 load balancer.