mirror of
https://github.com/pomerium/pomerium.git
synced 2025-04-29 18:36:30 +02:00
Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>
This commit is contained in:
github-actions[bot]
GitHub
parent
4308807479
commit
41d0522da1
4 changed files with 112 additions and 11 deletions
|
|
@ -26,11 +26,12 @@ In the presence of multiple upstreams, make sure to specify either an active or
|
|||
|
||||
:::
|
||||
|
||||
### Active Health Checks
|
||||
## Active Health Checks
|
||||
|
||||
Active health checks issue periodic requests to each upstream to determine its health.
|
||||
See [Health Checking](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/health_checking) for a comprehensive overview.
|
||||
|
||||
### HTTP Example
|
||||
```yaml
|
||||
policy:
|
||||
- from: https://myapp.localhost.pomerium.io
|
||||
|
|
@ -46,7 +47,26 @@ policy:
|
|||
path: "/"
|
||||
```
|
||||
|
||||
### Passive Health Checks
|
||||
### TCP Example
|
||||
```yaml
|
||||
policies:
|
||||
- from: tcp+https://tcp-service.localhost.pomerium.io
|
||||
to:
|
||||
- tcp://tcp-1.local
|
||||
- tcp://tcp-2.local
|
||||
health_checks:
|
||||
- timeout: 1s
|
||||
interval: 5s
|
||||
unhealthy_threshold: 3
|
||||
healthy_threshold: 1
|
||||
tcp_health_check:
|
||||
send:
|
||||
text: "50494E47" #PING
|
||||
receive:
|
||||
text: "504F4E47" #PONG
|
||||
```
|
||||
|
||||
## Passive Health Checks
|
||||
|
||||
Passive health check tries to deduce upstream server health based on recent observed responses.
|
||||
See [Outlier Detection](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/outlier) for comprehensive overview.
|
||||
|
|
@ -65,11 +85,26 @@ policy:
|
|||
`lb_policy` should be set to [one of the values](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers):
|
||||
|
||||
- [`ROUND_ROBIN`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#weighted-round-robin) (default)
|
||||
- [`LEAST_REQUEST`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#weighted-least-request) and may be further configured using [``](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-msg-config-cluster-v3-cluster-leastrequestlbconfig)
|
||||
- [`LEAST_REQUEST`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#weighted-least-request) and may be further configured using [`least_request_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-msg-config-cluster-v3-cluster-leastrequestlbconfig)
|
||||
- [`RING_HASH`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#ring-hash) and may be further configured using [`ring_hash_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-ringhashlbconfig) option
|
||||
- [`RANDOM`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#random)
|
||||
- [`MAGLEV`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#maglev) and may be further configured using [`maglev_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-msg-config-cluster-v3-cluster-maglevlbconfig) option
|
||||
|
||||
### Example
|
||||
|
||||
```yaml
|
||||
policy:
|
||||
- from: https://myapp.localhost.pomerium.io
|
||||
to:
|
||||
- http://myapp-srv-1:8080
|
||||
- http://myapp-srv-2:8080
|
||||
- http://myapp-srv-3:8080
|
||||
- http://myapp-srv-4:8080
|
||||
- http://myapp-srv-5:8080
|
||||
lb_policy: LEAST_REQUEST
|
||||
least_request_lb_config:
|
||||
choice_count: 2 # current envoy default
|
||||
```
|
||||
## Further reading
|
||||
|
||||
- [Introduction to modern network load balancing and proxying](https://blog.envoyproxy.io/introduction-to-modern-network-load-balancing-and-proxying-a57f6ff80236)
|
||||
|
|
|
|||
|
|
@ -7,6 +7,16 @@ description: >-
|
|||
|
||||
# Since 0.12.0
|
||||
|
||||
## New
|
||||
|
||||
### Upstream load balancing
|
||||
|
||||
With the v0.13 release, routes may contain [multiple `to` URLs](/reference/#to), and Pomerium will load balance between the endpoints. This allows Pomerium to fill the role of an edge proxy without the need for additional HTTP load balancers.
|
||||
|
||||
* Active [health checks](/reference/#health-checks) and passive [outlier detection](/reference/#outlier-detection)
|
||||
* Configurable [load balancing algorithms](/reference/#load-balancing-policy)
|
||||
|
||||
See [Load Balancing](/docs/topics/load-balancing) for more information on using this feature set.
|
||||
## Breaking
|
||||
|
||||
### User impersonation removed
|
||||
|
|
|
|||
|
|
@ -1191,7 +1191,7 @@ If set, the URL path will be rewritten according to the pattern and substitution
|
|||
|
||||
Outlier detection and ejection is the process of dynamically determining whether some number of hosts in an upstream cluster are performing unlike the others and removing them from the healthy load balancing set.
|
||||
|
||||
See the [envoy documentation](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/outlier#arch-overview-outlier-detection) for more details.
|
||||
See Envoy [documentation](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/outlier#arch-overview-outlier-detection) and [API](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/outlier_detection.proto#envoy-v3-api-msg-config-cluster-v3-outlierdetection) for more details.
|
||||
|
||||
|
||||
### Route Timeout
|
||||
|
|
@ -1378,19 +1378,37 @@ If set, enables proxying of SPDY protocol upgrades.
|
|||
Runtime metrics for this policy would be available under `envoy_cluster_`*`name`* prefix.
|
||||
|
||||
|
||||
### Load Balancing
|
||||
### Load Balancing Policy
|
||||
- Config File Key: `lb_policy`
|
||||
- Type: `enum`
|
||||
- Optional
|
||||
|
||||
In presence of multiple upstreams, defines load balancing strategy between them.
|
||||
|
||||
See [Envoy documentation](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-enum-config-cluster-v3-cluster-lbpolicy) for more details.
|
||||
|
||||
- [`ROUND_ROBIN`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#weighted-round-robin) (default)
|
||||
- [`LEAST_REQUEST`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#weighted-least-request) and may be further configured using [``](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-msg-config-cluster-v3-cluster-leastrequestlbconfig)
|
||||
- [`LEAST_REQUEST`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#weighted-least-request) and may be further configured using [`least_request_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-msg-config-cluster-v3-cluster-leastrequestlbconfig)
|
||||
- [`RING_HASH`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#ring-hash) and may be further configured using [`ring_hash_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-ringhashlbconfig) option
|
||||
- [`RANDOM`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#random)
|
||||
- [`MAGLEV`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#maglev) and may be further configured using [`maglev_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-msg-config-cluster-v3-cluster-maglevlbconfig) option
|
||||
|
||||
Some policy types support additional [configuration](#load-balancing-policy-config).
|
||||
|
||||
|
||||
### Load Balancing Policy Config
|
||||
- Config File Key: `least_request_lb_config`, `ring_hash_lb_config`, `maglev_lb_config`
|
||||
- Type: `object`
|
||||
- Optional
|
||||
|
||||
When [`lb_policy`](#load-balancing-policy) is configured, you may further customize policy settings for `LEAST_REQUEST`, `RING_HASH`, AND `MAGLEV` using one of the following options.
|
||||
|
||||
- [`least_request_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-msg-config-cluster-v3-cluster-leastrequestlbconfig)
|
||||
- [`ring_hash_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-ringhashlbconfig)
|
||||
- [`maglev_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-msg-config-cluster-v3-cluster-maglevlbconfig)
|
||||
|
||||
See [Load Balancing](/docs/topics/load-balancing) for example [configurations](/docs/topics/load-balancing.html#load-balancing-method)
|
||||
|
||||
|
||||
### Health Checks
|
||||
- Config File Key: `health_checks`
|
||||
|
|
@ -1400,7 +1418,16 @@ In presence of multiple upstreams, defines load balancing strategy between them.
|
|||
When defined, will issue periodic health check requests to upstream servers. When health checks are defined, unhealthy upstream servers would not serve traffic.
|
||||
See also `outlier_detection` for automatic upstream server health detection.
|
||||
In presence of multiple upstream servers, it is recommended to set up either `health_checks` or `outlier_detection` or both.
|
||||
See [Envoy documentation](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/health_checking) for a list of supported parameters.
|
||||
|
||||
See [Envoy documentation](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/health_checking) for a list of [supported parameters](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/health_check.proto#envoy-v3-api-msg-config-core-v3-healthcheck).
|
||||
|
||||
Only one of `http_health_check`, `tcp_health_check`, or `grpc_health_check` may be configured per health_check object definition.
|
||||
|
||||
- [TCP](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/health_check.proto#envoy-v3-api-msg-config-core-v3-healthcheck-tcphealthcheck)
|
||||
- [HTTP](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/health_check.proto#envoy-v3-api-msg-config-core-v3-healthcheck-httphealthcheck)
|
||||
- [GRPC](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/health_check.proto#envoy-v3-api-msg-config-core-v3-healthcheck-grpchealthcheck)
|
||||
|
||||
See [Load Balancing](/docs/topics/load-balancing) for example [configurations](/docs/topics/load-balancing.html#active-health-checks).
|
||||
|
||||
|
||||
### Websocket Connections
|
||||
|
|
|
|||
|
|
@ -1320,7 +1320,7 @@ settings:
|
|||
doc: |
|
||||
Outlier detection and ejection is the process of dynamically determining whether some number of hosts in an upstream cluster are performing unlike the others and removing them from the healthy load balancing set.
|
||||
|
||||
See the [envoy documentation](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/outlier#arch-overview-outlier-detection) for more details.
|
||||
See Envoy [documentation](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/outlier#arch-overview-outlier-detection) and [API](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/outlier_detection.proto#envoy-v3-api-msg-config-cluster-v3-outlierdetection) for more details.
|
||||
- name: "Route Timeout"
|
||||
keys: ["timeout"]
|
||||
attributes: |
|
||||
|
|
@ -1511,7 +1511,7 @@ settings:
|
|||
- Optional
|
||||
doc: |
|
||||
Runtime metrics for this policy would be available under `envoy_cluster_`*`name`* prefix.
|
||||
- name: "Load Balancing"
|
||||
- name: "Load Balancing Policy"
|
||||
keys: ["lb_policy"]
|
||||
attributes: |
|
||||
- Config File Key: `lb_policy`
|
||||
|
|
@ -1520,11 +1520,30 @@ settings:
|
|||
doc: |
|
||||
In presence of multiple upstreams, defines load balancing strategy between them.
|
||||
|
||||
See [Envoy documentation](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-enum-config-cluster-v3-cluster-lbpolicy) for more details.
|
||||
|
||||
- [`ROUND_ROBIN`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#weighted-round-robin) (default)
|
||||
- [`LEAST_REQUEST`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#weighted-least-request) and may be further configured using [``](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-msg-config-cluster-v3-cluster-leastrequestlbconfig)
|
||||
- [`LEAST_REQUEST`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#weighted-least-request) and may be further configured using [`least_request_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-msg-config-cluster-v3-cluster-leastrequestlbconfig)
|
||||
- [`RING_HASH`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#ring-hash) and may be further configured using [`ring_hash_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-ringhashlbconfig) option
|
||||
- [`RANDOM`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#random)
|
||||
- [`MAGLEV`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#maglev) and may be further configured using [`maglev_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-msg-config-cluster-v3-cluster-maglevlbconfig) option
|
||||
|
||||
Some policy types support additional [configuration](#load-balancing-policy-config).
|
||||
- name: "Load Balancing Policy Config"
|
||||
keys:
|
||||
["least_request_lb_config", "ring_hash_lb_config", "maglev_lb_config"]
|
||||
attributes: |
|
||||
- Config File Key: `least_request_lb_config`, `ring_hash_lb_config`, `maglev_lb_config`
|
||||
- Type: `object`
|
||||
- Optional
|
||||
doc: |
|
||||
When [`lb_policy`](#load-balancing-policy) is configured, you may further customize policy settings for `LEAST_REQUEST`, `RING_HASH`, AND `MAGLEV` using one of the following options.
|
||||
|
||||
- [`least_request_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-msg-config-cluster-v3-cluster-leastrequestlbconfig)
|
||||
- [`ring_hash_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-ringhashlbconfig)
|
||||
- [`maglev_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-msg-config-cluster-v3-cluster-maglevlbconfig)
|
||||
|
||||
See [Load Balancing](/docs/topics/load-balancing) for example [configurations](/docs/topics/load-balancing.html#load-balancing-method)
|
||||
- name: "Health Checks"
|
||||
keys: ["health_checks"]
|
||||
attributes: |
|
||||
|
|
@ -1535,7 +1554,17 @@ settings:
|
|||
When defined, will issue periodic health check requests to upstream servers. When health checks are defined, unhealthy upstream servers would not serve traffic.
|
||||
See also `outlier_detection` for automatic upstream server health detection.
|
||||
In presence of multiple upstream servers, it is recommended to set up either `health_checks` or `outlier_detection` or both.
|
||||
See [Envoy documentation](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/health_checking) for a list of supported parameters.
|
||||
|
||||
See [Envoy documentation](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/health_checking) for a list of [supported parameters](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/health_check.proto#envoy-v3-api-msg-config-core-v3-healthcheck).
|
||||
|
||||
Only one of `http_health_check`, `tcp_health_check`, or `grpc_health_check` may be configured per health_check object definition.
|
||||
|
||||
- [TCP](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/health_check.proto#envoy-v3-api-msg-config-core-v3-healthcheck-tcphealthcheck)
|
||||
- [HTTP](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/health_check.proto#envoy-v3-api-msg-config-core-v3-healthcheck-httphealthcheck)
|
||||
- [GRPC](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/health_check.proto#envoy-v3-api-msg-config-core-v3-healthcheck-grpchealthcheck)
|
||||
|
||||
See [Load Balancing](/docs/topics/load-balancing) for example [configurations](/docs/topics/load-balancing.html#active-health-checks).
|
||||
|
||||
- name: "Websocket Connections"
|
||||
keys: ["allow_websockets"]
|
||||
attributes: |
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue