Allow Autoscale Load Balancer to Use Private IP Instead

[btzq]

ISSUE TYPE

• Improvement Request

COMPONENT NAME

Autoscale

CLOUDSTACK VERSION

4.19.0

CONFIGURATION

OS / ENVIRONMENT

SUMMARY

Currently, Autoscale Load Balancer requires a Public IP in order to work.

In our usage, we have API Gateways which we put into Autoscale Groups, that route traffic to the Load Balancer of the respective services. In our company case, we have around 20 Autoscale Groups which the API Gateway routes traffic to, but it does not require any ingress traffic from the internet. They are only used internally.

But this creates an issue for us where we have large number of Public IPs not being used.

This ticket is to request for Autoscale Feature to allow the use of Private IPs instead of Public IPs

This is done

STEPS TO REPRODUCE

EXPECTED RESULTS

This ticket is to request for Autoscale Feature to allow the use of Private IPs instead of Public IPs

ACTUAL RESULTS

Currently Autoscale Requires the use of Public IPs which is a waste if the Autoscale Group is only used for non-internet use.

[rohityadavcloud]

@btzq could you explain what load balancers the private IP? Is it VR's haproxy that implements internal LB for isolated network; or you want to use internal LB of a VPC? The former does not exist, but latter exists.

[btzq]

Hey @rohityadavcloud , im refering to the built in Load Balancing feature in the Cloudstack Virtual Router.

Right now, when we create a Load Balance (or Load Balancer via an AutoscaleGroup), Cloudstack requires a Public IP to be associated to the LB to work. This is done by doing the following steps:

• Go to VPC > Public IP Addresses > Acquire New IP
• Go to Public IP Adresses Menu > Select Public IP > Create Load Balance Rule
• Create Autoscale Group > Enter Mandatory Info > Select Load Balancer

As a result, it is required for users to create a LB (and Autoscale Group) with a Public IP.

In our case, we have the following scenarios:

1. Internet/LeasedLine -> ASG LB (Service 1) -> Database

2.Internet/LeasedLine -> ASG LB (Service 1) -> ASG LB (Service 2) -> Database

3.Internet/LeasedLine -> ASG LB (Service 1) -> Private GW to another VPC within same zone -> ASG LB (Service 2) -> Database

In scenarios 2 and 3, there is no need for the LB to use a Public IP, because they are only meant to be receiving traffic from other VMs via LAN. Only the LB for (Service 1) requires a Public IP.

By enhancing Cloudstack to allow the creation of LB using a Private IP achieve 2 things:

• Save Cost by Reducing the number of Public IPs required
• Better security, because LBs that do not need to talk to the internet, are not exposed to the internet.

[alexandremattioli]

@btzq you can add a private (i.e. RFC 1918) IP range to the "Public" IPs for the zone and dedicate it to a domain/account, the term "Public" there only means the external interface of the VR, not necessarily a publicly routed IP address.

[btzq]

Hey @alexandremattioli yes that is what we do at the moment to save the Public IPs.

Another benefit i can think of as a result of supporting private ips for the load balancer (or autoscale) is that the VR wouldnt need to do NAT, which should reduce the resource consumption of the VR.

[alexandremattioli]

@btzq the VR still NATs, from an RFC1918 IP to another RFC1918 IP. In ROUTED mode (Coming in 4.20), there's no loadbalancer.

What you are describing as a requirement is already possible. Unless I misunderstood your requirement.