5 ms·

What's the benefit here instead of using the tcp load balancer? I'm guessing it's primarily URL mapping. Does it support websocket compression (meaning the loa

by jhgg 10y ago

What's the benefit here instead of using the tcp load balancer? I'm guessing it's primarily URL mapping. Does it support websocket compression (meaning the load balanced servers don't need to do compression - as it'd be handled by the proxy) We would probably switch in a heartbeat if it did

searchfaster 10y ago
Not sure if it GCP does, but the load balancer can handle HTTPS termination and even filter out DOS attacks or handle rate limiting.
- dyngts 10y ago
  Hi searchfaster, Can you elaborate more from documentation that this new features can filter out DDOS attacks or handle rate limiting? Because i can't find out that statement Thank you
  - Elect2 10y ago
    http(s) load balancer only route http(s) requests to your compute instances, and hide the instance IPs. So at least Layer 3 DDOS can not touch your instances.
    - dyngts 10y ago
      But, when talking Kubernetes. it is currently no support for internal load balancer, right? so it's still have vulnerability to get exposed to the world. Any comment about this? Thank you!
  - manigandham 10y ago
    Google's load balancers are global - as in they will route requests to the nearest region to the user without you having to run separate load balancers in each with dns routing. The backend services hooked up to the load balancer can have healthchecks and capacity limits based on req/sec or CPU usage, so a region that's close by but overloaded will be skipped for a further region that has available capacity. GCP also absorbs layer 4 and below attacks automatically. https://cloud.google.com/files/GCPDDoSprotection-04122016.pdf https://cloud.google.com/files/GCPDDoSprotection-04122016.pd...
  - searchfaster 10y ago
    Hey dyngts, sorry I have not used GCP load balancers extensively and was not sure if this is supported. Manigandham's post below confirms it though with all the necessary information.
thesandlord 10y ago
You can do URL routing to different backed services like you mentioned, but you can also have a single LB route traffic to the closet datacenter running your service that has capacity. This means you don't need a DNS based system with multiple LBs for a global or HA system.

by jhgg 10y ago

searchfaster 10y ago

Not sure if it GCP does, but the load balancer can handle HTTPS termination and even filter out DOS attacks or handle rate limiting.

dyngts 10y ago
Hi searchfaster, Can you elaborate more from documentation that this new features can filter out DDOS attacks or handle rate limiting? Because i can't find out that statement Thank you
- Elect2 10y ago
  http(s) load balancer only route http(s) requests to your compute instances, and hide the instance IPs. So at least Layer 3 DDOS can not touch your instances.
  - dyngts 10y ago
    But, when talking Kubernetes. it is currently no support for internal load balancer, right? so it's still have vulnerability to get exposed to the world. Any comment about this? Thank you!
- manigandham 10y ago
  Google's load balancers are global - as in they will route requests to the nearest region to the user without you having to run separate load balancers in each with dns routing. The backend services hooked up to the load balancer can have healthchecks and capacity limits based on req/sec or CPU usage, so a region that's close by but overloaded will be skipped for a further region that has available capacity. GCP also absorbs layer 4 and below attacks automatically. https://cloud.google.com/files/GCPDDoSprotection-04122016.pdf https://cloud.google.com/files/GCPDDoSprotection-04122016.pd...
- searchfaster 10y ago
  Hey dyngts, sorry I have not used GCP load balancers extensively and was not sure if this is supported. Manigandham's post below confirms it though with all the necessary information.

thesandlord 10y ago

You can do URL routing to different backed services like you mentioned, but you can also have a single LB route traffic to the closet datacenter running your service that has capacity. This means you don't need a DNS based system with multiple LBs for a global or HA system.