4.2 OCI Load Balancing Services

4.2 OCI Load Balancing Services

[!NOTE] Exam Blueprint Focus: Load balancing is a core architectural pillar tested under Domain 2 (Core OCI Services) of the OCI Foundations Associate (1Z0-1085-26) exam. Candidates must distinguish between Layer 7 Load Balancer capabilities (SSL offloading, cookie persistence, path routing, flexible shapes) and Layer 4 Network Load Balancer (NLB) characteristics (non-proxy, line rate, client IP preservation, zero bandwidth charges), as well as public versus private deployment topologies.

Modern enterprise cloud architectures demand continuous availability, fault tolerance, and the ability to absorb dynamic traffic surges without service disruption. In Oracle Cloud Infrastructure (OCI), Load Balancing Services solve these requirements by decoupling the entry point of incoming network traffic from individual backend servers, distributing connections smoothly across healthy compute instances, containers, or bare metal hosts.

---

Purpose & Fundamentals of Cloud Load Balancing

A load balancer acts as a single point of contact for incoming network traffic, receiving client requests and forwarding them across a configured backend set of servers.

Core Benefits of Load Balancing

• High Availability & Fault Tolerance: Load balancers eliminate single points of failure. By distributing backend nodes across multiple Availability Domains (ADs) and Fault Domains (FDs), an outage of an individual virtual machine, rack switch, or power unit will not disrupt the application.
• Automated Health Monitoring: The load balancer continuously probes backend servers using configured health checks. If a backend server fails its health checks (e.g., stops responding with HTTP 200 OK), the load balancer automatically reroutes traffic away from the failing node. Once the backend recovers and passes consecutive checks, it is seamlessly reintegrated into active service.
• Seamless Scalability & Maintenance: Administrators can dynamically scale backend pools by adding new compute instances during peak demand or taking instances offline for operating system patching without disconnecting clients or causing application downtime.

---

OCI Load Balancer (Layer 7 - Application Load Balancer)

The OCI Load Balancer operates at Layer 7 (Application layer) of the Open Systems Interconnection (OSI) reference model. It is a full proxy load balancer that inspects, evaluates, and manages application protocols including HTTP/1.1, HTTP/2, WebSocket, and HTTPS.

Key Layer 7 Features

1. SSL/TLS Termination & Offloading:
   • SSL Termination: The load balancer terminates the incoming SSL/TLS session from the client, decrypts the traffic, and forwards plaintext HTTP to backend servers. This offloads cryptographic CPU burdens from backend web servers, allowing them to dedicate computational power to core application processing.
   • SSL Tunneling (Pass-Through): The load balancer passes encrypted SSL packets directly through to backend instances without decrypting them.
   • End-to-End SSL: The load balancer decrypts incoming client traffic for header inspection/routing and then re-encrypts the traffic before sending it to backend servers, satisfying stringent zero-trust compliance mandates.
2. Path-Based & Virtual Host Routing:
   • Path-Based Routing: Traffic is routed to different backend server sets based on the URI path of the request. For example, requests matching /api/* are directed to an API backend pool, while requests matching /static/* or /media/* are routed to an optimized media caching pool.
   • Virtual Host Routing: A single load balancer listener can host multiple domain names (e.g., store.example.com and support.example.com) and direct requests to distinct backend sets based on the HTTP Host header.
3. Session Persistence (Sticky Sessions):
   • Ensures that all subsequent HTTP requests from a specific client during a browsing session are consistently routed to the same backend server.
   • Implemented using cookie-based session persistence, supporting either load-balancer-inserted cookies or application-generated cookies.
4. Advanced Health Checks:
   • Supports comprehensive health checking via HTTP, HTTPS, or TCP protocols.
   • Evaluates specific response status codes (such as expecting an exact 200 OK) and can match a specific string or regular expression within the HTTP response body.

Load Balancing Policies

The policy determines how incoming connections are distributed across healthy backend servers:

• Round Robin (Default): Distributes incoming requests sequentially across backend servers in rotation. Can be weighted to send proportionally more traffic to higher-capacity servers.
• Least Connections: Evaluates current connection loads and routes new requests to the backend server currently handling the fewest active connections. Optimal for applications with varying transaction durations (e.g., long database queries vs. instant file downloads).
• IP Hash: Uses a mathematical hash of the client's source IP address to consistently direct that specific IP to the same backend server. Provides a lightweight method to maintain session affinity without cookie manipulation.

Flexible Bandwidth Shaping

OCI Load Balancer employs a modern Flexible Shape architecture that eliminated older, rigid fixed-bandwidth tiers:

• Administrators define a Minimum Bandwidth and a Maximum Bandwidth when creating the load balancer.
• The bandwidth range spans anywhere from 10 Mbps to 8,000 Mbps (8 Gbps).
• The load balancer dynamically and automatically scales its capacity between the configured minimum and maximum boundaries based on real-time client traffic patterns.
• Billing is based on the configured minimum bandwidth base cost plus dynamic consumption over the baseline, preventing over-provisioning expenses.

---

OCI Network Load Balancer (NLB - Layer 4)

The OCI Network Load Balancer (NLB) operates at Layer 4 (Transport layer) of the OSI model. It is designed for ultra-high throughput, massive concurrency, and sub-millisecond network performance.

Core Characteristics of the Network Load Balancer

• Non-Proxy Architecture (Line-Rate Performance):
  • Unlike the Layer 7 Load Balancer, the NLB is a non-proxy load balancer. It does not terminate TCP connections, evaluate HTTP headers, or proxy traffic.
  • It directs Layer 4 packets (TCP, UDP, and ICMP) directly to backend instances at line rate with near-zero latency overhead (measured in microseconds).
• Preservation of Client Source IP Address:
  • Because the NLB passes packets through without proxying, the packet's original source IP address and source port are naturally preserved.
  • Backend servers receive packets displaying the client's actual public IP address directly at the network interface layer, eliminating the need to parse HTTP X-Forwarded-For headers.
  • This feature is critical for legacy applications, database clustering, and security monitoring appliances that rely on client IP socket inspection.
• Massive Concurrency & Scale:
  • Handles millions of concurrent connections and tens of gigabits of bandwidth seamlessly.
• Zero Bandwidth Cost:
  • In OCI, the Network Load Balancer carries no bandwidth charges—it is free to use with your compute and networking infrastructure.
• Typical Workloads: Real-time gaming, VoIP, real-time video streaming, IoT telemetry ingestion, DNS infrastructure, and third-party Network Virtual Appliances (firewalls/NVAs).

---

Public Load Balancers vs. Private Load Balancers

Both the Layer 7 Load Balancer and the Layer 4 Network Load Balancer can be provisioned in either Public or Private deployment modes:

+-----------------------------------------------------------------------------------------+
|                     Public vs. Private Load Balancer Topologies                         |
+-----------------------------------------------------------------------------------------+
| Attribute                   | Public Load Balancer          | Private Load Balancer     |
+-----------------------------------------------------------------------------------------+
| Access Scope                | Public Internet Clients       | Internal VCN & Hybrid Only|
| IP Address Type             | Public IPv4 (Regional Floating)| Private IPv4 (from Subnet)|
| Subnet Placement            | Regional Public Subnet        | Regional Private Subnet   |
| High Availability           | Spans ADs/FDs automatically   | Spans ADs/FDs internally  |
| Backend Server Placement    | Private or Public Subnets     | Private Subnets           |
| Primary Workloads           | E-commerce, APIs, Websites    | DB tiers, ERP, Microservices|
+-----------------------------------------------------------------------------------------+

1. Public Load Balancers

• Publicly Accessible: Receives an externally routable, floating public IPv4 address.
• Subnet Placement: Deployed into a Regional Public Subnet (or across two AD-specific subnets in legacy designs).
• Architectural Best Practice: Public load balancers terminate internet traffic at the public edge while forwarding requests to backend compute instances residing safely inside Private Subnets. Internet clients never directly touch the backend servers.

2. Private Load Balancers

• Internally Isolated: Assigned a private IPv4 address drawn from the private subnet in which it is provisioned. Has no public IP address and is completely inaccessible from the internet.
• Use Cases: Ideal for internal multi-tier application architectures (e.g., an internal load balancer distributing web-tier requests across middle-tier application servers) or balancing traffic arriving from corporate on-premises datacenters via Site-to-Site VPN or FastConnect.

---

Layer 7 Load Balancer vs. Layer 4 Network Load Balancer Comparison