Applies to: Kyvos Enterprise Kyvos Cloud (SaaS on AWS) Kyvos AWS Marketplace
Kyvos Azure Marketplace Kyvos GCP Marketplace Kyvos Single Node Installation (Kyvos SNI)
Note
While configuring an external load balancer for GCP, ensure that the frontend and backend certificates are in the same format.
Prerequisites
Reserve a static IP address for the load balancer. See Google documentation for more details.
Create a Proxy-only subnet in the VPC you are using. See Google documentation for more details.
SSL or TLS enabled on Kyvos and Kyvos Manager
Firewall Rules
Rule to allow Google health check to the Virtual Machine.
Target: Service Account which is used by Kyvos VMs
Source IP Ranges: 35.191.0.0/16, 130.211.0.0/22
Protocol: tcp -> ports 8443,9443
Rule to allow access to selected ports from load balancer to Virtual Machine Target:
Service Account which is used by Kyvos VMs
Source IP Ranges: CIDR of the Proxy only Subnet
Protocol: tcp -> 8443, 9443
Note:
Without source filter as Proxy-only subnet you will get the upstream request timeout while browsing the Application Load Balancer URL.
Creating and configuring a load balancer
Creating instance group
Create an instance group.
To do this, search Instance Group in the Search box and click the Create Instance Group option.Click the New unmanaged instance group.
On the page, provide the following details:
Type a Name to your instance group. For example, kyvos-instancegroup.
From the Network and Instances list, select the Networks shared with me option.
From the shared subnetwork list, select the required option.
From the VM Instances list, select the VMs on which you want to use this backend service.
You must select the VMs used for the Kyvos Webserver node.In the Port Mapping area,
Port name as km-https and Port number as 9443
Port name as kyvos-https and Port number as 8443
Click Create.
Creating a load balancer
Select the preferred project.
On the navigation pane, in the Networking section, select Network services.
In the Network Services list, select the Load balancing option.
On the Load balancing page, click Create Load Balancer.
In the Create a load balancer section, click the HTTP(S) Load Balancing option.
Click the Start Configuration link provided at the bottom of the page.
In the Internet facing or internal only section, select the From internet to my VMs or serverless services option.
In the Global or Regional section, select the Global HTTP(S) Load Balancer (classic) option.
Click Continue.
Configuring frontend services
Click Frontend Configuration.
On the page, enter details as:
Provide a name to the frontend configuration, such as frontendwebserverhttps.
In the Protocol list, select the HTTPS option.
From the Certificate list, select the appropriate option.
Click Done.
Configuring backend services
Switch to the Backend tab. The Backend configuration section is displayed.
Click Create a Backend Service.
For Kyvos Manager: Provide a Name to create a backend service—for example, backendservicekmhttps.
Backend Type: Instance Group
Protocol: HTTPS
Named Port: km-https
For Kyvos: Provide a Name to create a backend service—for example, backendservicekyvoshttps.
Backend Type: Instance Group
Protocol: HTTPS
Named Port: kyvos-https
In the Health check section, click the Create a Health Check option.
For Kyvos Manager: Provide a Name, such as kyvosmanagerhealthcheck.
Path: /kyvosmanager/kmha/activeKyvosManagerInstance
Protocol: HTTPS
Port: 9443
For Kyvos: Provide a Name, such as kyvoshealthcheck.
Path: /kyvos/
Protocol: HTTPS
Port: 8443
Click the Save button.
Scroll down and expand the Advanced Configurations section, and then select the Client IP option from the Session Affinity list and click Create.
Provide a Name, such as httpskyvoswebserver.
Enter Host and Path rules.
Click Create.
The load balancer is created with requisite configurations.