Layer 7 Load Balancing

Hop has grown three kinds of back end: redirect servers for short codes, an API service under /api/, and an admin dashboard under /admin/. All three arrive at the same address on port 443. A layer 4 balancer sees identical-looking connections and cannot tell them apart. To route by what is being asked, the balancer must read the request.

The rule

Layer 7 reads the request, so it can route by what is asked.

Layer 7 is the application layer — HTTP for web traffic. A layer 7 load balancer parses each request and can decide using anything in it:

• the path: /api/… to the API pool, /admin/… to the dashboard
• the host name: hop.example vs docs.hop.example
• headers and cookies: a beta-tester cookie goes to the new version
• the method: send writes to one pool and reads to another

Because it understands the request, it can also do more than choose:

• terminate HTTPS and manage certificates in one place
• add or remove headers, rewrite paths, compress, cache
• retry a failed request on another server, and balance each request rather than each connection

To read an HTTPS request, the balancer must decrypt it — it terminates TLS. That costs CPU per request and makes the balancer the holder of your certificates.

The shortcut

Write the routing rule in plain words. If the rule mentions a path, host, header or cookie, you need layer 7. If it mentions only "any healthy server", layer 4 will do.

The trap is paying layer 7 costs where no rule needs content. Many designs use both: a fast layer 4 tier in front, spreading connections over a few layer 7 balancers that do the smart routing.

Drills

Answer fast — trust the rule.

Remember

• Layer 7 reads the request, so it can route by what is asked.
• Shortcut: if the rule mentions a path, host, header or cookie, you need layer 7.
• Trap: paying layer 7 costs where "any healthy server" would do.