Load balancers
A load balancer fronts a fleet of VMs with a single VIP (virtual IP), distributing traffic across the backends and removing unhealthy ones from rotation automatically. Two flavors: L4 (TCP / UDP / proxy-protocol) and L7 (HTTP / HTTPS with path + header routing).
The four sub-resources
A load balancer is itself a container; the routing logic lives in nested resources:
- Listener — one per (protocol, port) the LB accepts traffic on.
HTTPS:443is one listener;HTTP:80is another. A single LB can host many listeners. - Pool — a group of backend VMs, defined per listener. Each pool has an algorithm (
round-robin,least-connections,source-ip-hash) and a session-persistence policy. - Member — one backend in a pool. References a VM + port + weight.
- Health monitor — the active health check per pool. Failed members are removed from rotation until they recover.
The endpoints below operate on the top-level load balancer. Nested CRUD for listeners/pools/members/health-monitors lives at /v1/load-balancers/{id}/listeners, etc. (not in this minimal sample — covered in the live spec).
SSL termination
For HTTPS listeners you have two choices:
- TLS terminated at the LB. Upload a cert (or use Let's Encrypt via the cert-manager add-on), and the LB serves TLS to clients while talking plaintext to your VMs. Easier to manage; lets the LB inspect HTTP headers for L7 routing.
- TLS passthrough. The LB does L4 TCP forwarding only; your VMs handle TLS. Required when the backend needs to see the original client cert.
Health checks
A health monitor probes each member periodically (default every 10s) on a configured path / port. Three results:
- Healthy — last 2 probes succeeded (default; configurable). Member receives traffic.
- Unhealthy — last 3 probes failed (configurable). Member removed from rotation; current connections drain.
- Recovering — was unhealthy, now passing again. After 2 successful probes flips to healthy.
For HTTP health checks, the LB sends a GET to /healthz (configurable) and expects 200. Implement /healthz in your app to return a quick body — and avoid making the check do real work, or the check itself becomes the load.
Pricing
Load balancers bill at a flat rate per hour per region ($0.024/hr for the standard tier in the EN-pricing reference). Listener / pool / member / health-monitor creates are free. Cross-LB traffic between regions counts as standard inter-region egress.
What's next
- Virtual machines — what becomes pool members.
- Floating IPs — alternative for single-VM public access without an LB.
- Security groups — the firewall at the VM interface; LBs respect security groups on members.