Trying to understand some fundamentals.
If I want a load balancer for the benefits of caching and more intelligent load balancing, I see that I should probably consider L7 despite some of the performance hit I'll take no sticking with standard TCP/IP communication.
Now, let's say I have TLS termination at the LB level, however, I still want TLS communication from the LB communication to the micro-service or downstream server I'm communicating with.
Is the flow like so:
- Client makes request to
- TLS handshake begins by sending
serverHelloto load balancer, which then proxies the
serverHelloto the backend application.
- Without writing all the steps, I'm assuming the entire TLS handshake takes place with the LB as an intermediary, but with this idea that the LB itself is doing this kinda of separate TLS handshaking process and encryption + decryption with the downstream server.
Is that a correct line of thinking and is this how it works in the real world?
I personally am conceptualizing this as something you'd want because the communication from the LB to the service could cross boundaries of separate servers over a network, so you'd have a second TLS connection to avoid packet sniffing after the second connection is made.