Configuring HTTP connectivity

Applies to: Kyvos Enterprise  Kyvos Cloud (SaaS on AWS) Kyvos AWS Marketplace

Kyvos Azure Marketplace   Kyvos GCP Marketplace Kyvos Single Node Installation (Kyvos SNI)

This section explains the steps to be performed after deploying or upgrading to Kyvos 2020.4.x with: 

• HTTP connectivity with a Public load balancer 

• HTTP connectivity with a Private load balancer

For HTTP Connectivity (Public IP)

This section explains the steps to be performed after deploying or upgrading to Kyvos 2020.4.x with HTTP connectivity with a Public load balancer.

To define the pubic load balancer, perform the following:

1. Create a Public Load Balancer in Azure

2. Configure the Backend pool

3. Configure the Health probe

4. Define Load Balancing rules

5. Define Outbound rules

The following sections explain each of these in detail.

Creating a Public Load Balancer in Azure

To create a public load balancer in Azure, perform the following steps.

1. Log in to the Azure portal using Admin credentials (or a user with sufficient rights to create load balancers).

2. Navigate to the Load Balancers page, and click Create Load Balancer. Alternatively, you can click the Add button.

3. On the Create load balancer page, enter details as:

   1. Resource Group: Select your resource group from the list or create a new one.

   2. Name: Provide a name for the load balancer.

   3. Region: Select the region for your load balancer instance.

   4. Type: Select the Public option. 

   5. SKU: Select the Standard option. 

   6. Virtual Network: Choose a virtual network from the selected subscription and location.
      
      
      
      

4. Public IP address: Choose the public IP address to be used in the frontend IP configuration. You can also create a new address (if needed).
   If you choose to create a new IP, you will need to provide the Availability Zone in which you want to deploy your public IP address. You can choose the Zone-redundant option to create a zone-redundant data path.

5. Add a public IPv6 address: Optionally assign the load balancer a public IPv6 address in addition to the public IPv4 address. The load balancing rules may be different for IPv4 and IPv6 traffic.
   
   

   Open

   

6. Click Next: Tags.

7. Here, provide tags, if required by your organization.

   Open

   

8. Click Next: Review+create. The system validates your inputs.
   
   

9. Click the Create button if the validation is successful. Else, click Previous and make the necessary changes.
   The Load Balancer is created. The system also creates the Frontend IP Address.

Configuring Backend Pool

To configure the Backend Pool, perform the following steps.

1. On the Load Balancer page, click Go to Resources.

2. From the left navigation pane, select the Backend pools option. 

3. On the Backend pool page, enter details as:

   1. Name: Provide a name for your backend pool.

   2. Virtual Network: Select the virtual network pool. A backend pool can only contain resources from one virtual network.

   3. IP version: Select the IPv4 option.

4. In the Virtual machines section, add all the Kyvos cluster nodes where the Web Portal service is configured (or expected to be configured).

5. Click Add. The Backend Pool is created and displayed in the list.

Configuring Health Probe

To configure the Health Probe, perform the following steps.

1. On the Load Balancer page, click Go to Resources.

2. From the left navigation pane, select the Health probes option. 

3. On the Add a Health probe page, enter details as:

   1. Name: Provide a name for the Health probe.

   2. Protocol: Select the TCP option.

   3. Port: Provide the port (default 8081) on which Kyvos Web Portal runs on Kyvos cluster nodes.

   4. Interval: Select the time interval (in seconds) between probe attempts.

   5. Unhealthy threshold: Select the number of consecutive probe failures that must occur before a virtual machine is considered unhealthy.

4. Click OK. The Health probe is created and added to the list.

Defining Load Balancing rules

A load balancing rule distributes incoming traffic that is sent to a selected IP address and port combination across a group of backend pool instances. Only backend instances that the health probe considers healthy receive new traffic.

To define the Load balancing rule for your public load balancer, perform the following steps.

1. On the Load Balancer page, click Go to Resources.

2. From the left navigation pane, select the Load Balancing rules option. 

3. On the Add Load Balancing Rule page, enter details as:

   1. Name: Provide a name for the rule.

   2. IP Version: Select the IPv4 option. 

   3. Frontend IP address: Select the Frontend IP address created for the load balancer. You can only select a frontend IP address that has one public IP.

   4. Protocol: Select the TCP option.

   5. Port: Provide the port required for the load balancer (The default port is 80). 
      
      

   6. Backend port: Provide the port used for the health probe (default: 8081). You can choose to route traffic to the virtual machines in the backend pool using a different port than the one clients use to communicate with the load balancer.

   7. Backend Pool: Select the backend pool created for your public load balancer. The virtual machines in the selected backend pool will be the target for the load-balanced traffic of this rule.

   8. Health Probe: Select the health probe created for the load balancer (in the previous section). The selected probe is used by this rule to determine which virtual machines in the backend pool are healthy and can receive load-balanced traffic.

   9. Session persistence: Set the value as Client IP and protocol. Session persistence specifies that the same virtual machine should handle traffic from a client in the backend pool for the duration of a session.

   10. Idle timeout (minutes): Provide the time interval to keep a TCP or HTTP connection open without relying on clients to send keep-alive messages.

   11. Floating IP: Select the Disabled option. 

   12. Outbound source network address translation (SNAT): Select the Use outbound rules to provide backend pool members access to the internet option. 
       
       

4. Click OK. The rule is created.

Defining Outbound rules

To add an Outbound rule for the Load Balancer, perform the following steps.

1. On the Load Balancer page, click Go to Resources.

2. From the left navigation pane, select the Outbound rules

3. On the Add outbound rule page, enter details as:

   1. Name: Provide a name for the Health probe.

   2. Frontend IP address: Select the Frontend IP address for the outbound rule. You can select up to 16 IP addresses to be used by outbound traffic. Select more IP addresses to increase the number of ports per instance and the maximum number of backend instances.

   3. Protocol: Select the All option. 

   4. Idle timeout (minutes): Provide the time interval in minutes to keep a TCP connection open.

   5. TCP Reset: Select the Enable option to send a TCP reset packet when idle timeout is reached.

   6. Backend Pool: Select the backend pool created for the load balancer. This rule applies to all instances in the backend pool.

   7. Port allocation: Select Use the default number of outbound ports

4. Click the OK. The rule is added to the list.

For HTTP Connectivity (Private IP)

This section explains the steps to be performed after deploying or upgrading to Kyvos 2020.4.x with HTTP Connectivity with the Private IP of the Load Balancer.

To create a Private Load Balancer, Azure recommends creating one private (internal) and one public load balancer (with outbound rules defined) to create outbound connectivity for VMs behind an internal load balancer.

To define the Private load balancer, perform the following.

1. Create a Public Load Balancer in Azure, and then:

   1. Configure Backend pool

   2. Define Outbound rules

2. Create a Private Load Balancer in Azure, and then:

   1. Configure Backend pool

   2. Configure Health probe

   3. Define Load Balancing rules

The following sections explain the procedures for each of these in detail.

Creating a Private Load Balancer

To create a Private Load Balancer from the Azure portal, perform the following steps.

1. Log in to the Azure portal using Admin credentials (or a user with sufficient rights to create load balancers).

2. Navigate to the Load Balancer page, and click Create Load Balancer. Alternatively, click the Add button.

3. On the Create load balancer page, enter details as:

   1. Resource Group: Select your resource group from the list or create a new one.

   2. Name: Provide a name for the load balancer.

   3. Region: Select the region for your load balancer instance.

   4. Type: Select the Internal option. 

   5. SKU: Select the Standard option. 
      
      
      
      

4. In the Configure virtual network area, enter details as:

5. Virtual Network: Choose a virtual network from the selected subscription and location.

6. Subnet: Select the subnet for the virtual network.

7. IP address assignment: Select the Dynamic option. 

8. Availability Zone: Provide the zone in which you want to deploy your public IP address. You can choose the Zone-redundant option to create a zone-redundant data path.
   
   

9. Click Next: Tags. Provide tags, if required by your organization.

10. Click Next: Review+create. The system validates your inputs.

11. Click the Create button if the validation is successful. Else, click Previous and make the necessary changes.
    The Load Balancer is created. The system also creates the Frontend IP Address.

Configuring Backend Pool

To configure the Backend Pool, perform the following steps.

1. On the Load Balancer page, click Go to Resources.

2. From the left navigation pane, select the Backend pools

3. On the Backend pool page, enter details as:

   1. Name: Provide a name for your backend pool.

   2. Virtual Network: Select the virtual network pool. A backend pool can only contain resources from one virtual network.

   3. IP version: Select the IPv4 option.

4. In the Virtual machines area, add all the Kyvos cluster nodes where the Web Portal service is configured (or expected to be configured).

5. Click Add. The Backend Pool is created and displayed in the list.

Configuring Health Probe

To configure the Health Probe, perform the following steps.

1. On the Load Balancer page, click Go to Resources.

2. From the left navigation pane, select the Health probes

3. On the Add health probe page, enter details as:

   1. Name: Provide a name for the Health probe.

   2. Protocol: Select the TCP option.

   3. Port: Provide the port (default 8081) on which Kyvos Web Portal is running on Kyvos cluster nodes.

   4. Interval: Select the time interval (in seconds) between probe attempts.

   5. Unhealthy threshold: Select the number of consecutive probe failures that must occur before a virtual machine is considered unhealthy.

4. Click OK. The Health probe is created and added to the list.

Defining Load Balancing Rule

To define the Load balancing rule for your private load balancer, perform the following steps.

1. On the Load Balancer page, click Go to Resources.

2. From the left navigation pane, select the Load Balancing rules

3. On the Add load balancing rule page, enter details as:

   1. Name: Provide a name for the rule.

   2. IP Version: Select the IPv4 option

   3. Frontend IP address: Select the Frontend IP address created for the load balancer. You can only select a frontend IP address that has one public IP.

   4. HA Ports: No need to select (default).

   5. Port: Provide the port required for the load balancer (default: 80)

   6. Backend port: Provide the port used for the health probe (default: 8081). You can choose to route traffic to the virtual machines in the backend pool using a different port than the one clients use to communicate with the load balancer.
      
      
      

       

   7. Backend Pool: Select the backend pool created for your private load balancer. The virtual machines in the selected backend pool will be the target for the load-balanced traffic of this rule.

   8. Health Probe: Select the health probe created for your private load balancer (in the previous section). The selected probe is used by this rule to determine which virtual machines in the backend pool are healthy and can receive load-balanced traffic.

   9. Session persistence: Set the value as Client IP and protocol. Session persistence specifies that the same virtual machine should handle traffic from a client in the backend pool for the duration of a session.

   10. Idle timeout (minutes): Provide the time interval to keep a TCP or HTTP connection open without relying on clients to send keep-alive messages.

   11. TCP Reset: Select the Disabled option.

   12. Floating IP: Select the Disabled option.
       
       
       

4. Click the OK. The rule is created.

Create a public load balancer

To create a public load balancer in Azure, perform the following steps.

1. Log in to the Azure portal using Admin credentials (or a user with sufficient rights to create load balancers).

2. Navigate to the Load Balancers page, and click the Create Load Balancer. Alternatively, you can click the Add button.

3. On the Create load balancer page, enter details as:

4. Resource Group: Select your resource group from the list or create a new one.

5. Name: Provide a name for the load balancer.

6. Region: Select the region for your load balancer instance.

7. Type: Select the Public option. 

8. SKU: Select the Standard option. 

9. Virtual Network: Choose a virtual network from the selected subscription and location.
   
   

    

10. Public IP address: Choose the public IP address to be used in the frontend IP configuration. You can also create a new address (if needed).
    If you choose to create a new IP, you will need to provide the Availability Zone, in which you want to deploy your public IP address. You can choose the Zone-redundant option to create a zone-redundant data path.

11. Add a public IPv6 address: Optionally assign the load balancer a public IPv6 address in addition to the public IPv4 address. The load balancing rules may be different for IPv4 and IPv6 traffic.
    
    

12. Click Next: Tags.

13. Here, provide tags, if required by your organization.
    
    

     

14. Click Next: Review+create. The system validates your inputs.

15. Click the Create button if the validation is successful. Else, click Previous and make the necessary changes.
    The Load Balancer is created. The system also creates the Frontend IP Address.

Configuring Backend Pool

To configure the Backend Pool, perform the following steps.

1. On the Load Balancer page, click Go to Resources.

2. From the left navigation pane, select the Backend pools

3. On the Backend pool page, enter details as:

   1. Name: Provide a name for your backend pool.

   2. Virtual Network: Select the virtual network pool. A backend pool can only contain resources from one virtual network.

   3. IP version: Select the IPv4 option.

4. In the Virtual machines area, add all the Kyvos cluster nodes where the Web Portal service is configured (or expected to be configured).

5. Click Add. The Backend Pool is created and displayed in the list.

Defining Outbound Rule

Add an Outbound rule with default configuration by selecting frontend and backend pool.

To add an Outbound rule for the Load Balancer, perform the following steps.

1. On the Load Balancer page, click Go to Resources.

2. From the left navigation pane, select the Outbound rules

3. On the Add outbound rule page, enter details as:

   1. Name: Provide a name for the Health probe.

   2. Frontend IP address: Select the Frontend IP address for the outbound rule. You ca select up to 16 IP addresses to be used by outbound traffic. Select more IP addresses to increase the number of ports per instance and the maximum number of backend instances.

   3. Protocol: Select the All

   4. Idle timeout (minutes): Provide the time interval in minutes to keep a TCP connection open.

   5. TCP Reset: Select the Enable option to send a TCP reset packet when idle timeout is reached.

   6. Backend Pool: Select the backend pool created for the load balancer. This rule applies to all instances in the backend pool.

   7. Port allocation: Select the Use the default number of outbound ports

4. Click OK. The rule is added to the list.