Load balancers — EnclaveStack

Overview

A load balancer has one address and spreads traffic across apps’ replicas, skipping any that fail its health check. Weights let you move traffic between versions gradually.

When to use it

One address for an app with several replicas.
Shifting traffic from one service to another by weight.
Balancing TCP for something that isn’t HTTP.

How it works

HAProxy 3.2: One HAProxy container per load balancer, pinned by digest, in master-worker mode.
Graceful reloads: A new configuration is checked first, then loaded without dropping established connections.
Health checks: TCP connection or HTTP request checks per replica; algorithms round robin, fewest connections or same client to the same replica.

The load balancer joins its targets’ network and follows each target app’s replicas by name. When apps deploy or scale, its configuration is rendered again, checked and reloaded in place.

Architecture

One address in front of several replicas; a failing replica gets no traffic.

Flows

A request

A client connects to the load balancer’s address.
HAProxy picks a healthy replica by the algorithm and weights.
The replica answers through it.

Set it up

In the console

Open Load balancers and choose New load balancer.
Choose HTTP or TCP and the port.
Add target apps with weights.
Choose the health check and Create.

With the CLI

enclave lb create front --port 8080 --target api --wait

With OpenTofu

OpenTofu configuration

resource "enclave_load_balancer" "front" {
  name = "front"
  port = 8080
  target = [
    { app = "api" },
  ]
}

Settings reference

Every setting and output of the OpenTofu resource; the console and the CLI use the same names in their own words. Generated from platform 4d30582.

`enclave_load_balancer`
Name	Type	Use	What it does
`name`	text	required	Name of the load balancer: 3–40 lowercase letters, digits or hyphens, starting with a letter. Changing it replaces the load balancer.
`port`	number	required	Port it listens on.
`target`	list of objects	required	Apps to send traffic to (1–8, one network).
`algorithm`	text	optional	round_robin (default), least_conn or source.
`health_check`	list of objects	optional	How replicas are checked (default: tcp every 2 s).
`machine`	text	optional	The machine to run on (default: EnclaveStack chooses, and this reads back its choice). Changing it moves the resource, with its data, in place; apply waits for the move.
`machine_labels`	map of text	optional	Labels the machine must have, when machine isn't set (key=value, all must match).
`project`	text	optional	The project to create it in. Defaults to the provider's project (ENCLAVE_PROJECT, else default). Changing it replaces the resource.
`protocol`	text	optional	http (default) or tcp.
`publish`	true or false	optional	Also listen on a host port.
`healthy_targets`	number	output	Replicas passing their checks (refreshed on read).
`host_port`	number	output	Port on this machine when published.
`id`	text	output	Resource ID.
`internal_host`	text	output	Host other resources in the network use.
`private_dns`	text	output	Name it answers to inside its network: <name>.loadbalancer.internal.

Limits and security

Good to know

Targets must be in the same network as the load balancer.

Security

Firewalls on target apps allow their load balancers on the target ports automatically.