(I've looked at other questions, I don't think any of them cover the same stuff as this)
I'm looking at a load balancing solution for our farm of webservers. We currently use Cisco CSS11000 series devices, but these have a few limitations:
- We currently offload SSL, which I'm aware puts load on the LBs, rather than being able to horizontally scale SSL work over multiple webservers
- The CSS LBs don't support IPv6
- The CSSs don't work very well for failover - we want to be able to gracefully move user traffic around to let us upgrade webservers without service interruption.
Aims:
- Let us deactivate half of the webservers in a 'graceful' way (i.e. new user connections go to a specified subgroup of webservers, and it tells us when existing connections are closed - bonus points if it can force them to close gracefully so users don't notice).
- Let us restart/reconfigure the load balancers without interrupting service
- Support the usual HA stuff you'd expect (If a single server explodes or crashes, don't break)
- I'd like to do this without spending $$$ on commercial / hardware load balancers
- I'd like to do this on Linux if possible to utilise internal experience.
- The rest of the business likes "Enterprise" stuff because they can blame Someone Else when it goes wrong. So whatever I recommend to put in place needs to be as reliable as a commercial solution.
Ideas:
Two pairs of HAProxy. We'd use the HAProxy socket control mechanism (http://code.google.com/p/haproxy-docs/wiki/UnixSocketCommands) to gracefully remove webservers. Each pair would use heartbeat to maintain service, and we'd modify the DNS to point at the other pair to move new user connections over to the other pair. Would need some form of monitoring to tell us when a particular pair had 0 active connections.
Two Linux machines doing the balancing with iptables and the -m random module. I'd use heartbeat to keep the HA VIP live on one of the machines, and I'd use conntrackd to synchronise the TCP connection state, so we can failover without loss of service. Would need some scripting to insert/remove iptables rules depending on the state of the backends (Unless anyone knows of a tool?)
Does anyone have any comments on the above? Or any other/better/complimentary ideas?
Thanks!