Skip to content

Commit ffab475

Browse files
BernieWhiteBernieWhite
authored
Updates to LB rule docs (Azure#2821)
1 parent d439488 commit ffab475

File tree

5 files changed

+389
-39
lines changed

5 files changed

+389
-39
lines changed

‎.github/workflows/docs.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,7 @@ jobs:
6767
- name: Push content
6868
run: |
6969
cd site/
70+
git config advice.addIgnoredFile false
7071
git config user.name github-actions
7172
git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
7273
git add *

‎docs/en/rules/Azure.LB.Probe.md

+206-2
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,232 @@
11
---
2+
reviewed: 2024-04-11
23
severity: Important
34
pillar: Reliability
45
category: RE:05 Redundancy
56
resource: Load Balancer
67
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.LB.Probe/
78
---
89

9-
# Use specific load balancer probe
10+
# Use a specific load balancer probe
1011

1112
## SYNOPSIS
1213

1314
Use a specific probe for web protocols.
1415

1516
## DESCRIPTION
1617

17-
A load balancer probe can be configured as TCP/ HTTP or HTTPS.
18+
A load balancer is an Azure service that distributes traffic among instances of a service in a backend pool (such as VMs).
19+
Load balancers route traffic to instances in the backend pool based on configured rules.
20+
21+
In additional to routing traffic, load balancers can also monitor the health of backend instances with a health probe.
22+
Monitoring the health of backend instances allows the load balancer to route traffic towards health instances.
23+
For example, if one instance is unavailable, the load balancer can route traffic to another instance that is available.
24+
25+
To monitor the health of backend instances, the load balancer sends periodic requests and checks the response from the backend.
26+
Azure Load Balancer supports health probes for TCP, HTTP, and HTTPS.
27+
28+
If your backend is communicating over HTTP or HTTPS, you should:
29+
30+
- Use HTTP/ HTTPS probes — instead of a TCP port.
31+
For example, if a web server process is running it may not be able to respond to a TCP probe.
32+
However, that does not indicate that the application is working correctly, as it could be returning a `5XX` error.
33+
Using HTTP/ HTTPS probes allows you to check for a HTTP 200 status code.
34+
- Use a dedicated health check endpoint — such as `/health` or `/healthz` for health probes.
35+
Commonly the main landing page of an application `/` is not a good health check endpoint.
36+
By design, it may only serve static content and not execute any application logic, such as a login page.
1837

1938
## RECOMMENDATION
2039

2140
Consider using a dedicated health check endpoint for HTTP or HTTPS health probes.
2241

42+
## EXAMPLES
43+
44+
### Configure with Azure template
45+
46+
To deploy load balancers that pass this rule:
47+
48+
- Configure HTTP or HTTPS based probes on ports that commonly use HTTP or HTTPS protocols.
49+
- Set the `properties.probes[*]` property to include a probe with the following properties:
50+
- `properties.probes[*].properties.protocol` set to `HTTPS`.
51+
- `properties.probes[*].properties.requestPath` set to `/health`.
52+
53+
For example:
54+
55+
```json
56+
{
57+
"type": "Microsoft.Network/loadBalancers",
58+
"apiVersion": "2023-09-01",
59+
"name": "[parameters('lbName')]",
60+
"location": "[parameters('location')]",
61+
"sku": {
62+
"name": "Standard"
63+
},
64+
"properties": {
65+
"frontendIPConfigurations": [
66+
{
67+
"name": "frontend1",
68+
"properties": {
69+
"privateIPAddressVersion": "IPv4",
70+
"privateIPAllocationMethod": "Dynamic",
71+
"subnet": {
72+
"id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('name'), 'GatewaySubnet')]"
73+
}
74+
},
75+
"zones": [
76+
"2",
77+
"3",
78+
"1"
79+
]
80+
}
81+
],
82+
"backendAddressPools": [
83+
{
84+
"name": "backend1"
85+
}
86+
],
87+
"probes": [
88+
{
89+
"name": "https",
90+
"properties": {
91+
"protocol": "HTTPS",
92+
"port": 443,
93+
"requestPath": "/health",
94+
"intervalInSeconds": 5,
95+
"numberOfProbes": 1
96+
}
97+
}
98+
],
99+
"loadBalancingRules": [
100+
{
101+
"name": "https",
102+
"properties": {
103+
"frontendIPConfiguration": {
104+
"id": "[resourceId('Microsoft.Network/loadBalancers/frontendIPConfigurations', parameters('lbName'), 'frontend1')]"
105+
},
106+
"frontendPort": 443,
107+
"backendPort": 443,
108+
"enableFloatingIP": false,
109+
"idleTimeoutInMinutes": 4,
110+
"protocol": "TCP",
111+
"loadDistribution": "Default",
112+
"probe": {
113+
"id": "[resourceId('Microsoft.Network/loadBalancers/probes', parameters('lbName'), 'https')]"
114+
},
115+
"disableOutboundSnat": true,
116+
"enableTcpReset": false,
117+
"backendAddressPools": [
118+
{
119+
"id": "[resourceId('Microsoft.Network/loadBalancers/backendAddressPools', parameters('lbName'), 'backend1')]"
120+
}
121+
]
122+
}
123+
}
124+
],
125+
"inboundNatRules": [],
126+
"outboundRules": []
127+
},
128+
"dependsOn": [
129+
"[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('name'), 'GatewaySubnet')]"
130+
]
131+
}
132+
```
133+
134+
### Configure with Bicep
135+
136+
To deploy load balancers that pass this rule:
137+
138+
- Configure HTTP or HTTPS based probes on ports that commonly use HTTP or HTTPS protocols.
139+
- Set the `properties.probes[*]` property to include a probe with the following properties:
140+
- `properties.probes[*].properties.protocol` set to `HTTPS`.
141+
- `properties.probes[*].properties.requestPath` set to `/health`.
142+
143+
For example:
144+
145+
```bicep
146+
resource https_lb 'Microsoft.Network/loadBalancers@2023-09-01' = {
147+
name: lbName
148+
location: location
149+
sku: {
150+
name: 'Standard'
151+
}
152+
properties: {
153+
frontendIPConfigurations: [
154+
{
155+
name: 'frontend1'
156+
properties: {
157+
privateIPAddressVersion: 'IPv4'
158+
privateIPAllocationMethod: 'Dynamic'
159+
subnet: {
160+
id: subnet01.id
161+
}
162+
}
163+
zones: [
164+
'2'
165+
'3'
166+
'1'
167+
]
168+
}
169+
]
170+
backendAddressPools: [
171+
{
172+
name: 'backend1'
173+
}
174+
]
175+
probes: [
176+
{
177+
name: 'https'
178+
properties: {
179+
protocol: 'HTTPS'
180+
port: 443
181+
requestPath: '/health'
182+
intervalInSeconds: 5
183+
numberOfProbes: 1
184+
}
185+
}
186+
]
187+
loadBalancingRules: [
188+
{
189+
name: 'https'
190+
properties: {
191+
frontendIPConfiguration: {
192+
id: resourceId('Microsoft.Network/loadBalancers/frontendIPConfigurations', lbName, 'frontend1')
193+
}
194+
frontendPort: 443
195+
backendPort: 443
196+
enableFloatingIP: false
197+
idleTimeoutInMinutes: 4
198+
protocol: 'TCP'
199+
loadDistribution: 'Default'
200+
probe: {
201+
id: resourceId('Microsoft.Network/loadBalancers/probes', lbName, 'https')
202+
}
203+
disableOutboundSnat: true
204+
enableTcpReset: false
205+
backendAddressPools: [
206+
{
207+
id: resourceId('Microsoft.Network/loadBalancers/backendAddressPools', lbName, 'backend1')
208+
}
209+
]
210+
}
211+
}
212+
]
213+
inboundNatRules: []
214+
outboundRules: []
215+
}
216+
}
217+
```
218+
219+
<!-- external:avm avm/res/network/load-balancer probes -->
220+
221+
## NOTES
222+
223+
This rule only applies to probes for ports that commonly use HTTP or HTTPS protocols.
224+
23225
## LINKS
24226

25227
- [RE:05 Redundancy](https://learn.microsoft.com/azure/well-architected/reliability/redundancy)
26228
- [Load Balancer health probes](https://learn.microsoft.com/azure/load-balancer/load-balancer-custom-probe-overview)
27229
- [Health Endpoint Monitoring pattern](https://learn.microsoft.com/azure/architecture/patterns/health-endpoint-monitoring)
230+
- [Reliability in Load Balancer](https://learn.microsoft.com/azure/reliability/reliability-load-balancer)
231+
- [Health Probes](https://learn.microsoft.com/azure/reliability/reliability-load-balancer#health-probes)
28232
- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.network/loadbalancers)

‎docs/en/rules/Azure.LB.StandardSKU.md

+30-36
Original file line numberDiff line numberDiff line change
@@ -36,41 +36,32 @@ For example:
3636

3737
```json
3838
{
39-
"apiVersion": "2020-07-01",
40-
"name": "[parameters('name')]",
41-
"type": "Microsoft.Network/loadBalancers",
42-
"location": "[parameters('location')]",
43-
"dependsOn": [],
44-
"tags": {},
45-
"properties": {
46-
"frontendIPConfigurations": [
47-
{
48-
"name": "frontend-ip-config",
49-
"properties": {
50-
"privateIPAddress": null,
51-
"privateIPAddressVersion": "IPv4",
52-
"privateIPAllocationMethod": "Dynamic",
53-
"subnet": {
54-
"id": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/lb-rg/providers/Microsoft.Network/virtualNetworks/lb-vnet/subnets/default"
55-
}
56-
},
57-
"zones": [
58-
"1",
59-
"2",
60-
"3"
61-
]
62-
}
63-
],
64-
"backendAddressPools": [],
65-
"probes": [],
66-
"loadBalancingRules": [],
67-
"inboundNatRules": [],
68-
"outboundRules": []
69-
},
70-
"sku": {
71-
"name": "Standard",
72-
"tier": "[parameters('tier')]"
73-
}
39+
"type": "Microsoft.Network/loadBalancers",
40+
"apiVersion": "2023-09-01",
41+
"name": "[parameters('lbName')]",
42+
"location": "[parameters('location')]",
43+
"sku": {
44+
"name": "Standard",
45+
"tier": "Regional"
46+
},
47+
"properties": {
48+
"frontendIPConfigurations": [
49+
{
50+
"name": "frontendIPConfig",
51+
"properties": {
52+
"privateIPAllocationMethod": "Dynamic",
53+
"subnet": {
54+
"id": "[reference(resourceId('Microsoft.Network/virtualNetworks', parameters('name')), '2023-09-01').subnets[1].id]"
55+
}
56+
},
57+
"zones": [
58+
"1",
59+
"2",
60+
"3"
61+
]
62+
}
63+
]
64+
}
7465
}
7566
```
7667

@@ -83,11 +74,12 @@ To configure Standard SKU for a load balancer.
8374
For example:
8475

8576
```bicep
86-
resource lb_001 'Microsoft.Network/loadBalancers@2021-02-01' = {
77+
resource internal_lb 'Microsoft.Network/loadBalancers@2023-09-01' = {
8778
name: lbName
8879
location: location
8980
sku: {
9081
name: 'Standard'
82+
tier: 'Regional'
9183
}
9284
properties: {
9385
frontendIPConfigurations: [
@@ -110,6 +102,8 @@ resource lb_001 'Microsoft.Network/loadBalancers@2021-02-01' = {
110102
}
111103
```
112104

105+
<!-- external:avm avm/res/network/load-balancer skuName -->
106+
113107
## LINKS
114108

115109
- [RE:04 Target metrics](https://learn.microsoft.com/azure/well-architected/reliability/metrics)

0 commit comments

Comments
 (0)