Traefik Active Load Balancer on Rancher

Raul is a DevOps microservices architect specializing in scrum, kanban, microservices, CI/CD, open source and other new technologies. This post focuses on the Traefik \“active mode\” load balancer technology that works in conjunction with Docker labels and Rancher meta-data to configure itself automatically and provide access to services. Load balancers/proxies are software programs that make it possible for you to access your services backend. In the microservices architectures scope, they have an additional challenge to manage high dynamism. They have to be aware of frontend and backend changes in a dynamic and automated way so as to update and reload their configuration. They also need to talk with discovery systems. Rancher-metadata In Rancher, we have an excellent built-in discovery system called the rancher-metadata service. In rancher-metadata, we could get info from self-services or from other stacks or services. Rancher-metadata information is up to date on what is running on your system and where it is located. To generate dynamic configs files for your service, you need to talk with rancher-metadata. To do it, use confd with specifics templates. To get more details, I recommend reading Bill Maxwell’s article, located in the community Zookeeper catalog package; https://rancher.com/introducing-rancher-metadata-service-for-docker/ Load Balancers Rancher provides a built-in load balancer service. It is a containerized haproxy, and it’s very useful in publishing your services ports externally. The load balancer can work in two different modes. That implies that it can act in two different OSI levels, specifically, layers 4 and 7. But, what does that mean?

• Layer 4 - You can publish and provide access to TCP ports. It works in a kind of raw mode that forwards packages to the backend of your service, without the possibility of modifying them. In this mode, you couldn’t share ports. It means you need to publish a different port for every service.

• Layer 7 - You are working at the application level, and can only publish HTTP(s) ports. In this mode, the load balancer has the possibility to see and modify HTTP packets. You can check, add, or change the HTTP header. In this mode, you can share the same published port to different services. Obviously, the load balancer has to know how to differentiate the incoming packets so it can forward them to the right service. To do it, you need to define HTTP header filters that are checked with the incoming HTTP packages. Once the match is made, the request is sent to the correct service.
• In both modes, load balancers work in “passive mode”. That means that once you deploy a new service, you have to edit the load balancer config and add your service. Obviously, if you remove a service configured in the load balancer, it removes itself from the load balancer config.

Traefik Active Load Balancer To provide users a better choice, we’ve created an “active mode” load balancer using Docker labels and rancher-metadata. The load balancer scans rancher-metadata and is able to configure itself and provide access to services that have configured certain labels. To obtain that feature, we use Traefik. Traefik is a programmatic open source load balancer, written in golang. It can be integrated with different service discovery systems such as Zookeeper, etcd, Consul and others. We did an early integration with rancher-metadata. Traefik has a true zero downtime reload and implements the possibility of defining circuit breakers rules. To get more info, go to https://traefik.io/. To use Traefik, select it from community catalog and launch it. With default parameters, Traefik will run in all hosts with label traefik_lb=true. Expose the host port 8080 for HTTP services and 8000 as the Traefik admin port. It refreshes configuration every 60 seconds. It is possible to override all parameters when you deploy the service. Once the service is deployed, you can access the admin interface at http://host-address:9000 You need to define these labels at the service to get services automatically exposed at Traefik:

• traefik.enable = <true | false>
• traefik.domain = < domainname to route rule >
• traefik.port = < port to expose throught traefik >

It’s mandatory that you define a health check in your service because only healthy backends are added to Traefik. If you define, traefik.enable = true label in your service, but, the service does not have a health check then the frontend would be added to Traefik, but with an empty list of backends. Testing We’ve written a basic web test service to make it possible to check the Traefik service and test it in a quick way. That service exposes the web service at port 8080. You will create a new stack importing these docker-compose.yml and rancher-compose.yml

docker-compose.yml
web-test:
  log_driver: ''
  labels:
    traefik.domain: local
    traefik.port: '8080'
    traefik.enable: 'true'
    io.rancher.container.hostname_override: container_name
  tty: true
  log_opt: {}
  image: rawmind/web-test

rancher-compose.yml
web-test:
  scale: 3
  health_check:
    port: 8080
    interval: 2000
    initializing_timeout: 60000
    unhealthy_threshold: 3
    strategy: recreate
    response_timeout: 2000
    request_line: GET "/" "HTTP/1.0"
    healthy_threshold: 2

It has Traefik labels added to its definition. When deployed, its backend would be in “healthy” state. They would be added automatically to the Traefik service exposed as http://\${service_name}.\${stack_name}.\${traefik.domain}:\${http_port}. You could verify this at the Traefik admin UI; http://host-address:8000 If you scale the web-test service up or down, you could see in the Traefik admin UI how the backend server will be added or removed automatically. However, you have to wait for the refresh interval time before the configuration is refreshed. To access the web-test service, add an alias to your DNS, web-test.proxy-test.local pointing to your host address, and go to http://web-test.proxy-test.local:8080. When you request the web-test service, it shows you all the headers, as below: http://web-test.proxy-test.local:8080 Once you refresh the page, you should see that the Real_Server is changing as the load balancer is doing its job. TIP: To avoid having to set the DNS entry, you could test the service with curl, adding a Host header curl -H Host:web-test.proxy-test.local http://host-address:8080 Exposing your services To expose your services to Traefik, update them an add the following labels to them:

• traefik.enable = true
• traefik.domain = < yourdomain >
• traefik.port = < service_port >

The service \${traefik.port} would be exposed externally as: http://\${service_name}.\${stack_name}.\${traefik.domain}:\${http_port} TIP: If you delete the Traefik stack, when you deploy it again, you don’t need to reconfigure it, it would be configured by automatically scanning services labels. Work In Progress At the moment, only HTTP services access are available. We are working to integrate ssl certificates to get HTTPS services access available. Look for my next post here on the Rancher blog that extends this discussion to ssl certificate integration. References https://github.com/rawmind0/alpine-traefik https://github.com/rawmind0/rancher-traefik https://github.com/rawmind0/web-test