As Gateway is an ECS Server in the same intranet as the e-MapReduce Cluster in Alibaba Cloud. How I can use Gateway to achieve Load Balancing and Security Isolation in Alibaba Cloud ECS.
I appreciate any assistance with this.
Not quite get your question:
1, isolation, VPC/security group is isolation layer in Alibaba Cloud, not sure what kind of isolation you are refering to.
2, Load Balancing: MapReduce master should be able to dispatch the job in a balanced way. What exactly LB you would like to achieve?
Related
I would like to know how I can protect my Nodejs microservices so only the API gateway can access it. Currently the microservices are exposed on a unique port on my machine and can be access directly without passing through the gateway. That defeats the purpose of the gateway to serve as the only entry point in the system for secure and authorized information exchange.
The microservices and the gateway are currently built with Nodejs and express.
The plan is to eventually deploy it on the cloud (digital ocean). I'd appreciate any response. Thanks.
Kubernetes can solve this problem.
Kubernetes manages containers where each container can be a micro service.
While connecting your micro services to your gateway server, you can choose to only allow foreign connections to your gateway server. You would have a load balancer / nginx in your kubernetes cluster that redirects request to your gateway server.
Kubernetes has many other features such as:
service discovery: each of your micro service's IP could potentially change on restart/deployment unless you have static IP for all ur services. service discovery solves this problem.
high availability & horizontal scaling & zero downtime: you can configure to have several replicas for each of your service. So when one of the service goes down there still are other replicas alive to deal with the remaining requests. This also helps with CICD. With something like github action, you can make a smooth CICD pipeline. When you deploy a new docker image(update a micro service), kubernetes will launch a new container first and then kill the old container. So you have zero down time.
If you are working with micro services, you should definitely have a deep dive into kubernetes.
Recently I have been researching about microservices and kubernetes. All the tutorial and article I read online talks about general staff. I have several specific questions about building a microservices app on kubernetes.
API gateway: Is API gateway a microservice I built for my app that can automatically scale? Or is it already a built-in function of kubernetes? The reason I ask is because a lot of the articles are saying that load-balancing is part of the API gateway which confuse me since in kubernetes, load-balancing is handled by service. Also, is this the same as the API gateway on AWS, why don't people use the AWS API gateway instead?
Communication within services: from what I read only, there are Rest/RPC way and Message queue way. But why do people say that the Rest way is for sync operation? Can we build the services and have them communicate with rest api with Nodejs async/await functions?
Service Discovery: Is this a problem with kubernetes at all? Does kubernetes automatically figure out this for you?
Databases: What is the best practice to deploy a database? Deploy as a microservice on one of the node? Also, some articles say that each service should talk to a different db. So just separate the tables of one db to several dbs?
Is API gateway a microservice I built for my app that can
automatically scale? Or is it already a built-in function of
kubernetes?
Kubernetes does not have its own API-gateway service. It has an Ingress controller, which operates as a reverse proxy and exposes Kubernetes resources to the outside world. And Services, which load-balance traffic between Pods linked to them.
Also, Kubernetes provides an auto-scaling according to the resources consumed by Pods, memory usage or CPU utilization and some custom metrics. It is called Horizontal Pod Autoscaler, and you can read more about it here or in the official documentation.
Service Discovery: Is this a problem with kubernetes at all? Does kubernetes automatically figure out this for you?
Service Discovery is not a problem in Kubernetes, it has an entity called Services responsible for this. For more information, you can look through the link.
Your other questions refer more to the architecture of your application.
i have Service fabric Cluster Running on Azure ,i have deployed Application to Service Fabric.
Now i want to use azure Application Gateway on this Scenario like Request First served to Application Gateway and then it migrated to Fabric Load Ba-lancer. I am Quite Confused on this.How to meet above Challenges with ApplicationGateway
I also able to configure ApplicationGateway but dont have IDea how to use it for service fabric
Microsoft Azure Application Gateway offers layer 7 load balancing capabilities, SSL offloading, layer-7 routeing, cookie based session affinity, URL routeing and able to host multiple web application. Azure Application Gateway requires its subnet; sometimes it is confusing if you are not familiar with Azure VNet and Subnet segmentation.
First what you need to understand is the architecture pattern, how Microsoft Application Gateway would play a part in.
I have written some detail series documenting my journey throughout Azure ServiceFabric.
I would suggest you go through these posts, and it will explain Architecture viewpoint for having Application Gateway in front of Service Fabric Cluster.
Irrespective of Application Gateway, you would need Internal Loadbalancer or External Loadbalancer (depends on your topology).
Cloud Architecture Pattern: Azure Service Fabric and Microservices - Part 1 (Physical Architecture)
How to implement Application Gateway with Azure Service Fabric
Also try to understand how it is going to impact, security architecture of your implementation
Also, I would recommend you Reverse proxy in Azure Service Fabric.
Not fully sure your meaning, but you could create sf cluster and related resources using ARM teplates. Thats what I have done. I created appgw, cluster, vmss etc. In the virtualMachinesScalesets networkProfile you must configure the ApplicationGateway back endAddress pool instead of configuring loadBalancerBackendAddressPools. The appgw must exist before vmss deployment. You don't necessarily need lb at all. Appgw can handle the load balancing for you. Even though internal lb would bring in some nice additional features, which you could utilize later on...
I have to admit that these things are quite poorly documented...
Currently I have a Service Fabric cluster with 2 stateless services hosting Asp Web APIs. While creating the cluster also appropriate Azure Load Balancers got created.
Now I would like to add Application Gateway in front of my cluster for various reasons like SSL offloading, url-routing etc.
I'd like to understand how to configure the Application Gateway correctly. I see 2 options, not sure which one is valid:
Application Gateway replaces the existing Load Balancer and points directly to SF services hosting WebApi
I keep existing LB configuration and Application Gateway points to this LB (seems like 1 LB solution too many)
Which one is correct? Any advise how to configure?
Approach 2 is what we are using, We have kept the load balancer and that is routing any request received from the Application Gateway. We found this to be easiest and simplest choice, as this involves minimum changes to be done in Application Gateway.
Your two web api's can run on every node in the VM scale set. The Azure Load Balancer is used to distribute traffic over those nodes. Targeting a single service on a single node will reduce scalability and fault tolerance.
You could use the App Gateway to translate incoming request to different ports on the Load Balancer. (E.g. direct traffic to API 1 #url ~/1/ and API 2 #url ~/2/)
Favor using load balancing rules (using all nodes) over NAT redirections (to single nodes). This way you'll have a performant, reliable system.
Solution 2 would also provide possibly to create VPN connection e.g to manage your cluster. Then no need to expose management endpoint to the public. Internal lb also brings on additional features to utilize in the future.
I would go with your first option and to implement it create / modify your ARM template so that it doesn't contain the load balancer and instead contains the application gateway.
Here is a link to the quick starts for ARM templates which you can use. There isn't an out of the box example for service fabric with a gateway but it will give you a great starting place.
link
In Azure, I have two Ubuntu VMs running the same python bottle services under one Cloud Service.
The two VMs are set to be in the same Load-Balanced Set and are load-balanced in a Round-Robin fashion under that cloud service.
However, my problem is that each request takes 3~8 seconds to get to the underlying VM. (i.e. The load balancer is working, but it's very slow routing the requests.) I assume it's not normal, is it?
It seems that I can't even access the cloud service instance(load balancer) in Azure. Can anyone give me a hint where I might have set wrong and resulted in this?
Thanks!