Migrating services from an NLB with an instance group as a target to an L7 ALB using Terraform

To migrate a service from a network load balancer to an L7 load balancer:

1. See the service migration recommendations.
2. Create your infrastructure. At this step, you will associate the Smart Web Security profile with a virtual host of the L7 load balancer.
3. Test the L7 load balancer.
4. Migrate user traffic from the network load balancer to the L7 load balancer.

Service migration recommendationsService migration recommendations

1. Optionally, enable L3-L4 DDoS protection (the OSI model). It will enhance the L7 protection provided by Yandex Smart Web Security after migration.

   To enable L3-L4 protection:

   1. Before the migration, reserve a public static IP address with DDoS protection and use this address for the L7 load balancer's listener. If you already have a protected public IP address for the load balancer, you can keep this address during migration. Otherwise, you will have to change the IP address to a protected one.

   2. Configure a trigger threshold for the protection mechanisms, consistent with the amount of legitimate traffic to the protected resource. To set up this threshold, contact support.

   3. Set the MTU value to 1450 for the targets downstream of the load balancer. For more information, see MTU and TCP MSS.

2. Perform migration during the hours when the user load is at its lowest. Your service will be unavailable during the migration while updating the instance group’s integration with the target group and moving the network load balancer’s public IP address to the L7 load balancer. The downtime depends on the number of VMs in the group, deployment policy settings and usually takes from several minutes to tens of minutes.

3. When using an L7 load balancer, requests to backends come with the source IP address from the range of internal IP addresses of the subnets specified when creating the L7 load balancer. The original IP address of the request source (user) is specified in the X-Forwarded-For header. If you want to log public IP addresses of users on the web server, reconfigure it.

4. Before the migration, define the minimum number of resource units for the autoscaling settings in the L7 load balancer:

   Select the number of resource units based on the analysis of your service load expressed in:

   • Number of requests per second (RPS).
   • Number of concurrent active connections.
   • Number of new connections per second.
   • Traffic processed per second.

Create your infrastructureCreate your infrastructure

1. If you do not have Terraform yet, install it.

2. Get the authentication credentials. You can add them to environment variables or specify them later in the provider configuration file.

3. Configure and initialize a provider. There is no need to create a provider configuration file manually, you can download it.

4. Place the configuration file in a separate working directory and specify the parameter values. If you did not add the authentication credentials to environment variables, specify them in the configuration file.

5. Download the configuration file to the same working directory based on the protocol you are using:

   • HTTP: alb-vm-http.tf configuration file
   • HTTPS: alb-vm-https.tf configuration file

   These files describe:

   • Subnets for the L7 load balancer.
   • Security group for the L7 load balancer.
   • Static address for the L7 load balancer.
   • Importing a TLS certificate to Certificate Manager (if using HTTPS).
   • Smart Web Security profile.
   • Target group, backend group, and HTTP router for the L7 load balancer.
   • L7 load balancer.

6. In the configuration file, set the following custom properties:

   1. Specify the values for the following variables:

      • domain_name: Your service domain name.
      • network_id: ID of the network containing the VMs from the network load balancer's target group.
      • certificate (for HTTPS): Path to the self-signed custom certificate.
      • private_key (for HTTPS): Path to the private key file.

   2. For the yandex_alb_target_group resource, add as many target sections as there are virtual machines in your network load balancer's target group.

      resource "yandex_alb_target_group" "alb-target-group" {
        ...
        target {
          subnet_id    = "<subnet_ID>"
          ip_address   = "<VM_1_internal_IP_address>"
        }
        target {
          subnet_id    = "<subnet_ID>"
          ip_address   = "<VM_2_internal_IP_address>"
        }
        ...
        target {
          subnet_id    = "<subnet_ID>"
          ip_address   = "<VM_N_internal_IP_address>"
        }
      }
      

      Where:

      • subnet_id: ID of the subnet hosting the VM.
      • ip_address: Internal IP address of the VM specified in your network load balancer’s target group.

   3. If your service needs one and the same backend resource processing requests within a single user session, enable session affinity for the backend group by uncommenting this section for the yandex_alb_backend_group resource.

      session_affinity {
        connection {
          source_ip = true
        }
      }
      

7. Validate your Terraform configuration files using this command:

   terraform validate
   

   Terraform will display any configuration errors detected in your files.

8. Create the required infrastructure:

   1. Run this command to view the planned changes:

      terraform plan
      

      If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

   2. If everything looks correct, apply the changes:

      1. Run this command:

         terraform apply
         

      2. Confirm updating the resources.

      3. Wait for the operation to complete.

   All the required resources will be created in the specified folder. You can check resource availability and their settings in the management console.

9. In the management console, select the folder where you created the L7 load balancer.

10. Select Application Load Balancer.

11. Wait until the L7 load balancer goes Active.

12. Specify the autoscaling settings in the L7 load balancer:

    1. In the management console, click the load balancer's name.
    2. Click and select Edit.
    3. Under Autoscaling settings, set the resource unit limit.
    4. Click Save.

Test the L7 load balancerTest the L7 load balancer

1. In the management console, navigate to the new L7 load balancer and select Health checks on the left. Make sure you get HEALTHY for all the L7 load balancer's health checks.

2. Run a test request to the service through the L7 load balancer, for example, using one of these methods:

   • Add this record to the hosts file on your workstation: <L7_load_balancer_public_IP_address> <service_domain_name>. Delete the record after the test.

   • Execute the request using cURL depending on the protocol type:

     curl http://<service_domain_name> \
         --resolve <service_domain_name>:<service_port>:<public_IP_address_of_L7_load_balancer>
     

     curl https://<service_domain_name> \
         --resolve <service_domain_name>:<service_port>:<public_IP_address_of_L7_load_balancer>
     

Migrate user traffic from the network load balancer to the L7 load balancerMigrate user traffic from the network load balancer to the L7 load balancer

If the network load balancer’s listener uses a public IP address without DDoS protection, save the current health check settings for the network load balancer’s target group before proceeding to the next step of the migration. You will need these settings to add a new target group to the load balancer.

To migrate traffic:

1. Update the target group integration for the instance group:

   1. In the management console, select the folder containing your instance group.
   2. Select Compute Cloud.
   3. In the left-hand panel, select Instance groups.
   4. Select the group to update.
   5. In the top-right corner of the page, click Edit.
   6. Under Integration with Application Load Balancer, enable Create target group.
   7. Specify the name of the L7 load balancer’s target group and, optionally, the other target group settings.
   8. Click Save.

   Updating an instance group involves the following stages:

   • The system recreates the instances in the group.
   • The system removes targets from the network load balancer’s target group, and the remaining targets take over user traffic. The service becomes partially unavailable to users through the network load balancer during this period.
   • Once the target group is empty, it is deleted. The service becomes unavailable through the network load balancer.

   You can proceed to the next step without waiting for the instance group update to complete.

2. Update the target group for the backend in the L7 load balancer’s backend group. Specify only the target group you created in the previous step.

   The system will automatically add the VMs from the instance group to the L7 load balancer’s target group.

3. Select one of the following options to further migrate user traffic from the network load balancer to the L7 load balancer based on whether your NLB listener's public IP address is DDoS-protected:

   • Your network load balancer listener uses a DDoS-protected public IP address. During migration, your service will keep its public IP address.
   • Your network load balancer listener uses a public IP address without DDoS protection. During migration, your service will get a new public IP address.

Your network load balancer listener uses a DDoS-protected public IP addressYour network load balancer listener uses a DDoS-protected public IP address

1. Delete the listener in the network load balancer to release the static public IP address.

2. In the L7 load balancer, assign to the listener the public IP address previously used by the network load balancer:

   1. Open the configuration file you used to create the L7 load balancer (alb-vm-http.tf or alb-vm-https.tf).

   2. In the load balancer description, update the address parameter under listener.endpoint.address.external_ipv4_address:

      resource "yandex_alb_load_balancer" "<load_balancer_name>" {
        ...
        listener {
          ...
          endpoint {
            address {
              external_ipv4_address {
                address = <service_public_IP_address>
              }
            }
            ports = [ <service_port> ]
          }
        }
      }
      

      Where address is the public IP address the network load balancer used previously.

   3. Apply the changes:

      1. In the terminal, go to the directory where you edited the configuration file.

      2. Make sure the configuration file is correct using this command:

         terraform validate
         

         If the configuration is correct, you will get this message:

         Success! The configuration is valid.
         

      3. Run this command:

         terraform plan
         

         You will see a detailed list of resources. No changes will be made at this step. If the configuration contains any errors, Terraform will show them.

      4. Apply the changes:

         terraform apply
         

      5. Type yes and press Enter to confirm the changes.

3. After the IP address changes, your service will again be available through the L7 load balancer. Monitor the L7 load balancer's user traffic on the load balancer statistics charts.

4. Delete the now free static public IP address you selected when creating the L7 load balancer.

   1. Open the configuration file you used to create the L7 load balancer (alb-vm-http.tf or alb-vm-https.tf).

   2. Delete the yandex_vpc_address resource description from the file:

      resource "yandex_vpc_address" "static-address" {
        description = "Static public IP address for the Application Load Balancer"
        name        = "alb-static-address"
        external_ipv4_address {
          zone_id                  = "ru-central1-a"
          ddos_protection_provider = "qrator"
        }
      }
      

   3. Apply the changes:

      1. In the terminal, go to the directory where you edited the configuration file.

      2. Make sure the configuration file is correct using this command:

         terraform validate
         

         If the configuration is correct, you will get this message:

         Success! The configuration is valid.
         

      3. Run this command:

         terraform plan
         

         You will see a detailed list of resources. No changes will be made at this step. If the configuration contains any errors, Terraform will show them.

      4. Apply the changes:

         terraform apply
         

      5. Type yes and press Enter to confirm the changes.

5. Optionally, delete the network load balancer after migrating user traffic to the L7 load balancer.

Your network load balancer listener uses a public IP address without DDoS protectionYour network load balancer listener uses a public IP address without DDoS protection

1. Monitor the status of your network load balancer’s targets. Wait until the targets are automatically deleted from the target group.

2. Create a target group for the network load balancer. Add the VMs recreated when updating the instance group.

3. In the network load balancer, attach the target group created in the previous step. When attaching the target group, configure the same health checks as in the original target group.

4. Wait until the health checks for the VMs in the network load balancer’s target group return Healthy. This will make your service once again available through the network load balancer.

5. To migrate user traffic from a network load balancer to an L7 load balancer, in your domain's public zone DNS service, change the A record for the service domain name to the L7 load balancer's public IP address. If the public domain zone was created in Yandex Cloud DNS, update the record using this guide.

   Note

   The migration may take a while because the propagation of DNS record's updates depends on its time-to-live (TTL) and the number of links in the DNS request chain.

6. As the DNS record updates propagate, monitor the increase in requests to the L7 load balancer on the load balancer statistics charts.

7. Monitor the decrease in traffic on the network load balancer using the processed_bytes and processed_packets load balancer metrics. You can create a dashboard to visualize these metrics. If there is no load on the network load balancer for a long time, the migration to the L7 load balancer is complete.

8. Optionally, delete the network load balancer after migrating user traffic to the L7 load balancer.