Guide

Linux and networking

Load balancers, DNS and the edge in the cloud

Configuring the traffic layer, from DNS and cloud load balancers through TLS, WAF and CDN to a regional traffic shift. Start here for the map of edge pages.

22 of 162 · 2 min read

Users never hit your pods directly. A name resolves somewhere. A CDN or WAF may answer first. A cloud load balancer ends TLS and spreads connections. Then an Ingress or Gateway API route sends each request to a Service. When this layer is wrong, you see 502s, sticky sessions that are not sticky, certificates that expire on a Friday, and a "failover" nobody has tried.

The system design pages cover load balancing and CDNs as patterns. This topic covers how those patterns show up as cloud settings, on top of the VPC you already designed.

Read in order

StepConceptWhat it answers
1Cloud load balancersWhich load balancer type fits, and what does a health check decide?
2DNS routing and TTLHow do DNS records steer traffic, and how fast does a change reach users?
3TLS, WAF and CDNWhere does TLS end, and what filters bad traffic before it hits your servers?
4Shifting traffic between regionsHow do you move users to another region in steps you can undo?

Common mistakes across the topic

  • Assuming a 300-second TTL means a 5-minute failover. Clients cache answers, and some cache for much longer.
  • Health checks that call the database. A brief database blip can remove every backend at once.
  • Certificates managed by hand. A manual cert on a listener is an outage waiting for a date.
  • WAF rules deployed without review. A bad rule is a self-inflicted outage.
  • Skipping the drawing. Write the path from DNS to pod, with the timeout at each hop.

Key takeaways

  • ALB and HTTP(S) load balancers suit HTTP APIs. NLB suits static IPs, non-HTTP traffic and PrivateLink.
  • DNS policies steer traffic, but TTLs decide how fast a change spreads.
  • Ingress consolidates HTTP entry. Gateway API is the newer model.
  • Use managed certificates and monitor expiry.
  • Put WAF and DDoS protection at the outermost edge. Practice regional shifts with a rollback weight ready.

Further learning

Start with the load balancer page and work down the table. The AWS and Kubernetes docs are the references for the settings named here.

An ELB deep-dive covers ALB vs NLB feature boundaries, target groups, and integration with Route 53 and WAF:

AWS re:Invent 2018: [REPEAT 1] Elastic Load Balancing: Deep Dive and Best Practices (NET404-R1)Amazon Web Services
Elastic Load Balancing documentationdocs.aws.amazon.com Kubernetes Gateway APIRedirecting to /docsGateway API Route 53 routing policiesChoose a routing policy before you create records in Amazon Route 53.docs.aws.amazon.com AWS WAFUse AWS WAF to monitor requests that are forwarded to your web applications and control access to your content. Use Shield Advanced to help protect against DDoS attacks. Use AWS Firewall Manager to set up your firewal…docs.aws.amazon.com

Load balancing and proxies

How a load balancer chooses which server gets each request, and how a badly set up balancer can cause the outage it was meant to prevent.

CDNs and the edge

Serve content from points of presence near users. A CDN cuts latency, absorbs attacks and cuts bandwidth costs, and its cache keys, headers and purge rules decide how well it works.

DNS

How names become addresses, which record types matter, how caching and TTLs shape change speed, and why DNS failures look like outages of everything else.