#loadbalancers

Simplify networking for container applications with Amazon VPC Lattice‘s integrated Amazon ECS support.

What is VPC Lattice?

Amazon VPC Lattice is a fully managed application networking solution that facilitates service monitoring, security, and connection between virtual private clouds (VPCs) and accounts.

- Advertisement -

Make service-to-service communication, security, and monitoring easier with Amazon VPC Lattice.

Advantages

Make connecting easier

Discover and safely link services across VPCs and accounts with Amazon VPC Lattice, which streamlines and automates service connectivity.

Boost security

Context-specific authorization and trustworthy authentication can help you establish a better and more consistent security posture.

Scale automatically

Automatically scale network and computing resources to accommodate high-bandwidth HTTP, HTTPS, and gRPC workloads.

Implement flexibly

With support for instances, containers, and serverless computing, you can increase productivity and deployment flexibility.

How it operates

An application networking tool called Amazon VPC Lattice continuously links, tracks, and secures communications between your services, enhancing efficiency and freeing up your developers to work on things that are important to your company. To connect compute services in a straightforward and uniform manner across instances, containers, and serverless apps, you can specify policies for network traffic control, access, and monitoring.

Use cases

Simplify scalable service-to-service connectivity

Thousands of services can be connected across accounts and VPCs without making the network more complicated.

Boost security at the application layer

With context-specific authorization, centralized access controls, and authentication, you can enhance service-to-service security and support Zero Trust architectures.

Put smart traffic control into practice

For blue/green and canary deployments, use granular traffic restrictions like weighted targets and request-level routing.

Get insight into interactions between services

Keep an eye on and troubleshoot service-to-service communication for faults, response time, traffic volume, request type, and other factors.

AWS introduced Amazon Elastic Container Service (Amazon ECS) built-in support for Amazon VPC Lattice today. Amazon ECS services can now be directly linked to VPC Lattice target groups without the use of intermediary load balancers with this new built-in connection.

A brief overview of how to locate Amazon VPC Lattice integration when developing an Amazon ECS service is provided here:

IP addresses from ECS tasks within a service are registered and deregistered as targets in a VPC Lattice target group as part of the Amazon VPC Lattice interaction with Amazon ECS. Amazon ECS will automatically register ECS tasks to the VPC Lattice target group as soon as they are launched for the service.

Additionally, Amazon ECS will automatically replace ECS activities that fail VPC Lattice health checks. Additionally, the target group is excluded from any work that is discontinued or scaled down.

Utilizing the Lattice integration for Amazon VPC

Allow me to demonstrate how to utilize this just-added integration. You will set up the interaction with VPC Lattice and install a basic application server operating as an ECS service in the demo that follows. The application server will then be tested by connecting to the VPC Lattice domain name without the need to set up extra load balancers on Amazon ECS.

You must confirm that Amazon ECS will have the necessary authorization to register and deregister targets inside VPC Lattice before you can begin this integration.

You must define a task definition with at least one container and one port mapping in order to use the interaction with VPC Lattice. Here is an illustration of how we define our tasks.

{

“containerDefinitions”: [

{

“name”: “webserver”,

“image”: “public.ecr.aws/ecs-sample-image/amazon-ecs-sample:latest”,

“cpu”: 0,

“portMappings”: [

{

“name”: “web-80-tcp”,

“containerPort”: 80,

“hostPort”: 80,

“protocol”: “tcp”,

“appProtocol”: “http”

}

],

… *redacted for brevity*

}

Then select Create after navigating to your ECS cluster.

The job specification must then be chosen, and the service name must be assigned.

To begin setting up the target group for VPC Lattice, select Turn on VPC Lattice in the VPC Lattice integration section. Since you will be using VPC Lattice, you don’t need to define a load balancer. By default, it will route requests to healthy targets using a round-robin routing mechanism.

Now begin creating it integration for your ECS service. Start by choosing the Amazon ECS infrastructure role. Next, you have to decide which virtual private cloud (VPC) you want to use for your service. The target groups that will receive traffic must then be defined. You build this service once you’ve finished setting the VPC Lattice integration.

ECS service is available in a few minutes. Select Configuration and Networking after navigating to the service. The VPC Lattice target group is generated if you scroll down to the VPC Lattice section.

Click on the target group name to be sent to the VPC Lattice target group website, where you can get more details about this target group. You can see that Amazon ECS was able to correctly register the task’s IP address here.

Now you have to set up a service network and VPC Lattice service. Creating the VPC Lattice service first, then connecting to the VPC Lattice service network later. Let’s do that, then.

In the VPC Lattice section, select Services and then select Create service.

You can select Next after entering all the information needed to start a VPC Lattice service.

Then add a listener and choose the newly formed target group for the Forward to target group on the Listener default action.

You can skip this step and select Next, check the configurations, and create the service on the following page since you’ll be creating the VPC Lattice service network later.

Now that VPC Lattice services have been established, VPC Lattice service networks need to be established. Select Create service network after navigating to Service networks in the VPC Lattice section.

Start by entering the network name for the VPC Lattice service.

Then choose the service you created on the Service associations page.

You link both the security group and your VPC to this service network.

It has everything set up for this integration at this point. Both VPC and VPC Lattice service are now connected to your VPC Lattice service network.

Copy the domain name from your VPC Lattice service page once everything is configured.

Then use the domain name from VPC Lattice to call the service after logging into the instance in the same VPC.

Things to be aware of

Here are some crucial things to remember:

VPC Lattice GA

In AWS regions where Amazon VPC Lattice and Amazon ECS are accessible, Amazon VPC Lattice integration with Amazon ECS is now possible.

All ECS launch types, including AWS Fargate and Amazon Elastic Compute Cloud (Amazon EC2), are compatible with this integration.

VPC Lattice pricing

The standard cost for Amazon ECS and VPC Lattice is applicable. This integration does not come with any extra fees.

Try out this new feature of Amazon VPC Lattice now to discover how it can improve communication between your container applications running on Amazon ECS.

Difference between auto scaling and load balancing

Although both load balancing and autoscaling are automated procedures that aid in the development of scalable and economical systems, their primary goals and modes of operation are different:

Concentrate

Whereas auto scaling concentrates on resource management, load balancing concentrates on traffic management.

How they operate

While auto scaling adjusts the number of servers in response to demand, load balancing divides traffic among several servers.

How they collaborate

Auto scaling can start new instances for load balancing to attach connections to, while load balancing can assist auto scaling by redirecting connections from sick instances.

Additional information regarding load balancing and auto scaling is provided below:

Balancing loads

Distributes requests among several servers using algorithms. Each instance’s health can be checked by load balancers, which can also route requests to other instances and halt traffic to unhealthy ones.

Auto-scaling

Determines when to add or delete servers based on metrics. Application requirements for scaling in and out instances can serve as the basis for auto scaling strategies.

Advantages

Auto scaling can optimize expenses and automatically maintain application performance.

Application autoscaling is strongly related to elastic load balancing. Load balancing and application autoscaling both lessen backend duties, including monitoring server health, controlling traffic load between servers, and adding or removing servers as needed. Load balancers with autoscaling capabilities are frequently used in systems. However, auto-scaling and elastic load balancing are two different ideas.

Here’s how an application load balancer auto scaling package complements it. You can reduce application latency and increase availability and performance by implementing an auto scaling group load balancer. Because you may specify your autoscaling policies according to the needs of your application to scale-in and scale-out instances, you can control how the load balancer divides the traffic load among the instances that are already running.

A policy that controls the number of instances available during peak and off-peak hours can be established by the user using autoscaling and predetermined criteria. Multiple instances with the same capability are made possible by this; parallel capabilities can grow or shrink in response to demand.

An elastic load balancer, on the other hand, just connects each request to the proper target groups, traffic distribution, and instance health checks. An elastic load balancer redirects data requests to other instances and terminates traffic to sick instances. It also keeps requests from piling up on any one instance.

In order to route all requests to all instances equally, autoscaling using elastic load balancing involves connecting a load balancer and an autoscaling group. Another distinction between load balancing and autoscaling in terms of how they function independently is that the user is no longer required to keep track of how many endpoints the instances generate.

The Difference Between Scheduled and Predictive Autoscaling

Autoscaling is a reactive decision-making process by default. As traffic measurements change in real time, it adapts by scaling traffic. Nevertheless, under other circumstances, particularly when things change rapidly, a reactive strategy could be less successful.

By anticipating known changes in traffic loads and executing policy responses to those changes at predetermined intervals, scheduled autoscaling is a type of hybrid method to scaling policy that nonetheless operates in real-time. When traffic is known to drop or grow at specific times of the day, but the shifts are usually abrupt, scheduled scaling performs well. Scheduled scaling, as opposed to static scaling solutions, keeps autoscaling groups “on notice” so they can jump in and provide more capacity when needed.

Predictive autoscaling uses predictive analytics, such as usage trends and historical data, to autoscale according to future consumption projections. Particular applications for predictive autoscaling include:

Identifying significant, impending demand spikes and preparing capacity a little beforehand

Managing extensive, localized outages

Allowing for greater flexibility in scaling in or out to adapt to changing traffic patterns over the day

Auto scaling Vertical vs Horizontal

The term “horizontal auto scaling” describes the process of expanding the auto scaling group by adding additional servers or computers. Scaling by adding more power instead of more units for instance, more RAM is known as vertical auto scaling.

There are a number of things to think about when comparing vertical and horizontal auto scaling.

Vertical auto scaling has inherent architectural issues because it requires increasing the power of an existing machine. The application’s health is dependent on the machine’s single location, and there isn’t a backup server. Downtime for upgrades and reconfigurations is another need of vertical scaling. Lastly, while vertical auto scaling improves performance, availability is not improved.

Due to the likelihood of resource consumption and growth at varying rates, decoupling application tiers may help alleviate some of the vertical scaling difficulty. Better user experience requests and adding more instances to tiers are best handled by stateless servers. This also enables more effective scaling of incoming requests across instances through the use of elastic load balancing.

Requests from thousands of users are too much for vertical scaling to manage. In these situations, the resource pool is expanded using horizontal auto scaling. Effective horizontal auto scaling includes distributed file systems, load balancing, and clustering.

Stateless servers are crucial for applications that usually have a large user base. It is preferable for user sessions to be able to move fluidly between several servers while retaining a single session, rather than being restricted to a single server. Better user experience is made possible by this type of browser-side session storage, which is one outcome of effective horizontal scalability.

Applications that use a service-oriented architecture should include self-contained logical units that communicate with one another. This allows you to scale out blocks individually according to need. To lower the costs of both vertical and horizontal scalability, microservice design layers should be distinct for applications, caching, databases, and the web.

Due to the independent creation of new instances, horizontal auto scaling does not require downtime. Because of this independence, it also improves availability and performance.

Don’t forget that not every workload or organization can benefit from vertical scaling solutions. Horizontal scaling is demanded by many users, and depending on user requirements, a single instance will perform differently on the same total resource than many smaller instances.

Horizontal auto scaling may boost resilience by creating numerous instances for emergencies and unforeseen events. Because of this, cloud-based organizations frequently choose this strategy.

An overview

Service Extensions plugins are a new functionality that Google Cloud has added to its Application Load Balancers. With the help of these plugins, users can run custom code directly within the load balancer’s request and response paths, increasing the programmability of web application delivery. Because the plugins are based on WebAssembly (Wasm), they offer features like secure sandboxing, compatibility for several programming languages, and quick execution speeds. Use cases for this new functionality are varied and include HTML rewriting, custom logging, security policy implementation, and header manipulation. Scalability and low latency are provided by the completely managed environment in which users can operate the plugins.

Now use the Application Load Balancers to execute your own code at the edge.

For dependable online application delivery on Google Cloud, application load balancers are necessary. Although Google Cloud’s load balancers allow for a great deal of customization, there are some circumstances that call for even more programmability.

Google Cloud just revealed the Application Load Balancer Service Extensions plugins in Preview. To adapt load balancers to your business needs, you can now run your custom code right in the request/response path in a fully controlled Google environment with optimal latency. Just supply the code, and Google Cloud takes care of the rest. You can look to Service Extensions callouts, which are presently GA for Application Load Balancers if you want to handle the computation yourself for heavier workloads.

Service Extensions plugins use cases

The following use cases are supported by Service Extensions plugins:

Header addition: Include additional headers for requests and responses, or make new headers pertinent to your apps or particular clients.

Header manipulation: Rewriting request and response headers or overriding client headers while they are being sent to the backend or while replying to a client are examples of header manipulation.

Security: Create sophisticated security rules, such as custom token authentication, depending on response headers or client requests, and decide how to apply them within your plugin.

Custom logging: Enter custom data or user-defined headers into Cloud Logging.

Exception handling: For specific response types, send customers to a personalized error page.

HTML Rewriting: To enable Google Analytics tagging or Google reCAPTCHA integration, rewrite HTML from its original source.

Where your code can be executed

Service Extensions operate at the edge of Google’s widely dispersed network, in the request and response channel. The current traffic extension for the global external Application Load Balancer now includes Service Extensions plugins. The traffic extension executes prior to traffic reaching the backend, but after Cloud CDN and Cloud Armor. Service Extensions will be supported by cloud CDNs in a later edition. Additionally, as part of the route and traffic extensions, the cross-region internal load balancer supports Service Extensions plugins.

Architecture of Service Extension Plugins

Lightweight computation tasks that are part of the Application Load Balancer request/response flow are the focus of Service Extensions plugins. WebAssembly (Wasm), on which plugins are built, has the following advantages:

Startup time in milliseconds and near-native execution speed

Numerous programming languages, including C++ and Rust, are supported.

Cross-platform portability allows you to test the plugin locally or run it across many installations.

Protections for security, including running plugin logic in a sandbox

Service Extensions Plugins make use of Proxy-Wasm, an open source project backed by Google that offers Wasm modules a common API for interacting with network proxies.

Google developed a computing platform that is both scalable and massively multi-tenant (similar to load balancers) to execute Service Extensions plugins. Fully managed plugins offer auto-scaling and dynamic sharding to accommodate traffic demands. This design makes it possible for:

Scalability: As traffic patterns change, we can expand to a large number of Wasm hosts as needed.

Low latency: This proxyless serverless architecture enables even more latency-optimal pathways because there are no extra proxies between the load balancer and Wasm hosts.

The Cloud Load Balancers of Rackspace has suffered many issues early this week.

On May 19, an incident “Cloud Load Balancers is currently experiencing a degradation of service.” is reported at 04:32 PM EDT and closed 10 minutes later. The next day, at 09:47 AM EDT same report but not closed before 12:34 PM EDT.

Rackspace Cloud Load Balancer engineers has given more information about this issues:

Load Balancer Nodes ztn-n09 and ztn-n10 in our ORD1 data center […] experienced a rare capacity issue from a combination of active load balancers, new provisioning requests, and overall traffic. This caused both of the affected nodes (ztn-n09 and ztn-n10) to attempt to shift their traffic to the failover node (ztn-n12) simultaneously, which in turn affected network connectivity for the instances supported by ztn-n09 and ztn-n10. After several attempts to restart services for ztn-n09 and ztn-n10, engineers determined that a reboot of all four nodes in the cluster was required to restore services.

After rebooting one of the nodes, engineers discovered that the previous node failures had corrupted the global configuration files. This contributed to the inability to add the ztn-n09 and ztn-n10 back into the cluster. The corruption was corrected and the original two problem nodes were restarted and began to take traffic from ztn-n12.