Skip to content

Commit b1fe1c9

Browse files
ranbelDevinCarr
andauthored
[ZT] Load Balancing traffic to Cloudflare Tunnel endpoints (#25578)
* add mermaid diagrams * delete old private load balancing page * delete partial * edit diagrams * private load balancer for warp-to-tunnel * clean up tunnel LB overview page * move replica how-to instructions * begin public load balancer refresh * update diagrams * move cli instructions * small clarification * enhance LB instructions * small clarification * explain diagrams * minor edits * fix invalid links * add vnet details to IP/CIDR guide * add prereqs * hostname routes * update titles for example LB configs * clarify public LB instructions * clarify local connection preference * link to health notifications * replicas are identical * fix invalid link * Update src/content/docs/cloudflare-one/connections/connect-networks/routing-to-tunnel/dns.mdx Co-authored-by: Devin <[email protected]> * fix typo * dashboard/API for host header * fallback pool * legacy tunnels no longer supported * update rule links * Update src/content/docs/cloudflare-one/connections/connect-networks/routing-to-tunnel/public-load-balancers.mdx --------- Co-authored-by: Devin <[email protected]>
1 parent d3be8da commit b1fe1c9

File tree

21 files changed

+495
-384
lines changed

21 files changed

+495
-384
lines changed

public/__redirects

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -229,7 +229,7 @@
229229
/argo-tunnel/getting-started/installation/ /cloudflare-one/connections/connect-networks/get-started/ 301
230230
/argo-tunnel/quickstart/ /cloudflare-one/connections/connect-networks/get-started/ 301
231231
/argo-tunnel/reference/arguments/ /cloudflare-one/connections/connect-networks/configure-tunnels/ 301
232-
/argo-tunnel/reference/load-balancing/ /cloudflare-one/connections/connect-networks/routing-to-tunnel/lb/ 301
232+
/argo-tunnel/reference/load-balancing/ /cloudflare-one/connections/connect-networks/routing-to-tunnel/public-load-balancers/ 301
233233
/argo-tunnel/reference/service/ /cloudflare-one/connections/connect-networks/configure-tunnels/ 301
234234
/argo-tunnel/trycloudflare/ /cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/ 301
235235

@@ -1040,6 +1040,8 @@
10401040
/load-balancing/local-traffic-management/ /load-balancing/private-network/ 301
10411041
/load-balancing/local-traffic-management/ltm-tunnels-setup/ /load-balancing/private-network/tunnels-setup/ 301
10421042
/load-balancing/local-traffic-management/ltm-magic-wan/ /load-balancing/private-network/magic-wan/ 301
1043+
/load-balancing/private-network/tunnels-setup/ /load-balancing/private-network/warp-to-tunnel/ 301
1044+
/load-balancing/private-network/warp/ /load-balancing/private-network/warp-to-tunnel/ 301
10431045

10441046
# logs
10451047
/logs/log-fields/ /logs/logpush/logpush-job/datasets/ 301
@@ -2202,6 +2204,7 @@
22022204
/cloudflare-one/connections/connect-networks/private-net/private-hostnames-ips/ /cloudflare-one/connections/connect-networks/private-net/cloudflared/private-dns/ 301
22032205
/cloudflare-one/connections/connect-networks/private-net/tunnel-virtual-networks/ /cloudflare-one/connections/connect-networks/private-net/cloudflared/tunnel-virtual-networks/ 301
22042206
/cloudflare-one/connections/connect-networks/private-net/warp-connector/vpc-deployments/ /cloudflare-one/connections/connect-networks/private-net/warp-connector/tips/ 301
2207+
/cloudflare-one/connections/connect-networks/routing-to-tunnel/lb/ /cloudflare-one/connections/connect-networks/routing-to-tunnel/public-load-balancers/ 301
22052208
/argo-tunnel/faq/ /cloudflare-one/faq/cloudflare-tunnels-faq/ 301
22062209
/cloudflare-one/policies/browser-isolation/clientless-browser-isolation/ /cloudflare-one/policies/browser-isolation/setup/clientless-browser-isolation/ 301
22072210
/cloudflare-one/connections/connect-devices/agentless/dns-over-https/ /cloudflare-one/connections/connect-devices/agentless/dns/dns-over-https/ 301
@@ -2213,6 +2216,7 @@
22132216
/cloudflare-one/connections/connect-devices/warp/warp-settings/ /cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/ 301
22142217
/cloudflare-one/connections/connect-devices/warp/user-side-certificates/install-cloudflare-cert/ /cloudflare-one/connections/connect-devices/warp/user-side-certificates/manual-deployment/ 301
22152218
/cloudflare-one/connections/connect-devices/warp/user-side-certificates/install-cert-with-warp/ /cloudflare-one/connections/connect-devices/warp/user-side-certificates/automated-deployment/ 301
2219+
/cloudflare-one/connections/connect-networks/private-net/cloudflared/load-balancing/ /cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-availability/ 301
22162220
/cloudflare-one/connections/connect-networks/locations/ /cloudflare-one/connections/connect-devices/agentless/dns/locations/ 301
22172221
/cloudflare-one/connections/connect-networks/get-started/create-local-tunnel/ /cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/create-local-tunnel/ 301
22182222
/cloudflare-one/connections/connect-networks/configure-tunnels/remote-management/ /cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/ 301
Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
---
2+
pcx_content_type: how-to
3+
title: Deploy cloudflared replicas
4+
sidebar:
5+
order: 2
6+
---
7+
8+
import { Render } from "~/components";
9+
10+
To deploy multiple instances of `cloudflared`, you can create and configure one tunnel and run it on multiple hosts. If your tunnel runs as a service, only one `cloudflared` instance is allowed per host.
11+
12+
You can run the same tunnel across various `cloudflared` processes for up to 100 connections (25 replicas) per tunnel. Cloudflare Load Balancers and DNS records can still point to the tunnel and its UUID. Traffic will be sent to all `cloudflared` processes associated with the tunnel.
13+
14+
:::tip[Deploy replicas in Kubernetes]
15+
For information about running `cloudflared` in a Kubernetes deployment, refer to the [Kubernetes guide](/cloudflare-one/connections/connect-networks/deployment-guides/kubernetes/).
16+
:::
17+
18+
## Remotely-managed tunnels
19+
20+
1. To create a remotely-managed tunnel, follow the [dashboard setup guide](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/).
21+
2. On the **Tunnels** page, select your newly created tunnel.
22+
3. In the side panel, scroll down to **Connectors** to view the `cloudflared` instances for that tunnel.
23+
3. Select **Edit**.
24+
4. Select the operating system of the host where you want to deploy a replica.
25+
5. Copy the installation command and run it on the host.
26+
27+
The new replica will appear on the **Connectors** list for the tunnel. All replicas will serve the same routes and use the same configuration parameters.
28+
29+
## Locally-managed tunnels
30+
31+
1. To create a locally-managed tunnel, complete Steps 1 through 5 in the [CLI setup guide](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/create-local-tunnel/).
32+
33+
2. Run your newly created tunnel.
34+
35+
```sh
36+
cloudflared tunnel run <NAME>
37+
```
38+
39+
This will start a `cloudflared` instance and generate a unique `connector_id`.
40+
41+
3. In a separate window or on another host, run the same command again:
42+
43+
```sh
44+
cloudflared tunnel run <NAME>
45+
```
46+
47+
This will initialize another `cloudflared` instance and generate another `connector_id`.
48+
49+
4. Run `tunnel info` to show each `cloudflared` instance running your tunnel:
50+
51+
```sh
52+
cloudflared tunnel info <NAME>
53+
```
54+
55+
This will output your tunnel UUID as well as two Connector IDs, one for each `cloudflared` process running your tunnel. With this command, you can also see that your tunnel is now being served by eight connections.
56+

src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-availability/index.mdx

Lines changed: 57 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -11,81 +11,79 @@ Our lightweight and open-source connector, [`cloudflared`](https://github.com/cl
1111

1212
## `cloudflared` replicas
1313

14-
Cloudflare Tunnel also allows users to deploy additional instances of our connector, `cloudflared`, for availability and failover scenarios. We refer to these unique instances as replicas. Each replica establishes four new connections which serve as additional points of ingress to your origin, should you need them. Each of the replicas will point to the same tunnel. This ensures that your network remains up in the event a single host running `cloudflared` goes down.
14+
Cloudflare Tunnel allows users to deploy additional instances of our connector, `cloudflared`, for availability and failover scenarios. We refer to these unique instances as replicas. Each replica establishes four new connections which serve as additional points of ingress to your origin, should you need them. Each of the replicas will point to the same tunnel. This ensures that your network remains up in the event a single host running `cloudflared` goes down.
15+
16+
```mermaid
17+
graph LR
18+
C((Cloudflare))
19+
subgraph E[Private network]
20+
cf1["cloudflared <br> (Tunnel-1 replica)"]
21+
cf2["cloudflared <br> (Tunnel-1 replica)"]
22+
S1[Application]
23+
cf1-->S1
24+
cf2-->S1
25+
end
26+
C -- "Connections x 4 <br>"--> cf1
27+
C --> cf1
28+
C --> cf1
29+
C --> cf1
30+
C -- Connections x 4--> cf2
31+
C --> cf2
32+
C --> cf2
33+
C --> cf2
34+
```
1535

1636
By design, replicas do not offer any level of traffic steering (random, hash, or round-robin). Instead, when a request arrives to Cloudflare, it will be forwarded to the replica that is geographically closest. If that distance calculation is unsuccessful or the connection fails, we will retry others, but there is no guarantee about which connection is chosen.
1737

1838
### When to use `cloudflared` replicas
1939

2040
- To provide additional points of availability for a single tunnel.
2141
- To allocate failover nodes within your network.
22-
- To update the configuration of a tunnel without downtime.
42+
- To update the configuration of a tunnel [without downtime](/cloudflare-one/connections/connect-networks/downloads/update-cloudflared/#update-with-multiple-cloudflared-instances).
2343

24-
### Deploy `cloudflared` replicas
25-
26-
To deploy multiple instances of `cloudflared`, you can create and configure one tunnel and run it on multiple hosts. If your tunnel runs as a service, only one `cloudflared` instance is allowed per host.
27-
28-
<Details header="Remotely-managed tunnels" open = {true} >
29-
30-
1. To create a remotely-managed tunnel, follow the [dashboard setup guide](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/).
31-
2. On the **Tunnels** page, select your newly created tunnel. The **Connectors** section shows all of the `cloudflared` instances for that tunnel.
32-
3. Select **Configure**.
33-
4. Select the operating system of the host where you want to deploy a replica.
34-
5. Copy the installation command and run it on the host.
35-
36-
The new replica will appear on the **Connectors** list for the tunnel.
37-
38-
</Details>
39-
40-
<Details header="Locally-managed tunnels">
41-
42-
1. To create a locally-managed tunnel, complete Steps 1 through 5 in the [CLI setup guide](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/create-local-tunnel/).
43-
44-
2. Run your newly created tunnel.
45-
46-
```sh
47-
cloudflared tunnel run <NAME>
48-
```
49-
50-
This will start a `cloudflared` instance and generate a unique `connector_id`.
51-
52-
3. In a separate window or on another host, run the same command again:
53-
54-
```sh
55-
cloudflared tunnel run <NAME>
56-
```
57-
58-
This will initialize another `cloudflared` instance and generate another `connector_id`.
59-
60-
4. Run `tunnel info` to show each `cloudflared` instance running your tunnel:
61-
62-
```sh
63-
cloudflared tunnel info <NAME>
64-
```
65-
66-
This will output your tunnel UUID as well as two Connector IDs, one for each `cloudflared` process running your tunnel. With this command, you can also see that your tunnel is now being served by eight connections.
67-
68-
</Details>
69-
70-
You can run the same tunnel across various `cloudflared` processes for up to 100 connections (25 replicas) per tunnel. Cloudflare Load Balancers and DNS records can still point to the tunnel and its UUID. Traffic will be sent to all `cloudflared` processes associated with the tunnel.
71-
72-
:::note[Deploy replicas in Kubernetes]
73-
For information about running `cloudflared` in a Kubernetes deployment, refer to the [Kubernetes guide](/cloudflare-one/connections/connect-networks/deployment-guides/kubernetes/).
74-
:::
44+
For setup instructions, refer to [Deploy cloudflared replicas](/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-availability/deploy-replicas/).
7545

7646
## Cloudflare Load Balancers
7747

78-
[Cloudflare Load Balancing](/load-balancing/) allows users to proactively steer traffic away from unhealthy origins (or other <GlossaryTooltip term="endpoint" link="/glossary/?term=endpoint">endpoints</GlossaryTooltip>) and intelligently distribute the traffic load based on a multitude of steering algorithms. This process ensures that errors are not served to end users and empowers businesses to tightly couple overall business objectives to their traffic behavior.
79-
80-
In this model, more than one tunnel is required with identical configurations. The DNS record (`UUID.cfargotunnel.com`) for each Cloudflare Tunnel can be used at the origin within the load balancer. You can then define traffic steering policies to determine how traffic should be routed to each tunnel.
48+
[Cloudflare Load Balancing](/load-balancing/) proactively steers traffic away from unhealthy origins and intelligently distributes the traffic load based on your choice of [steering algorithms](/load-balancing/understand-basics/traffic-steering/). Unlike [`cloudflared` replicas](#cloudflared-replicas) which all use the same tunnel, a typical load balancer setup requires creating multiple tunnels. Most customers will create one tunnel per data center and one load balancer pool per tunnel.
49+
50+
```mermaid
51+
graph LR
52+
accTitle: Load balancing traffic to applications behind Cloudflare Tunnel
53+
54+
A[Internet] --> C{Cloudflare <br> Load Balancer}
55+
B[WARP clients] --> C
56+
M[Magic WAN] --> C
57+
C -- Tunnel 1 --> cf1
58+
C -- Tunnel 2 --> cf2
59+
subgraph F[Data center 2]
60+
cf2[cloudflared <br> server]
61+
S3[App server]
62+
S4[App server]
63+
cf2-->S3
64+
cf2-->S4
65+
end
66+
subgraph E[Data center 1]
67+
cf1[cloudflared <br> server]
68+
S1[App server]
69+
S2[App server]
70+
cf1-->S1
71+
cf1-->S2
72+
end
73+
```
8174

8275
### When to use load balancers
8376

8477
- To intelligently steer traffic based on latency, geolocation, or other signals.
8578
- To implement failover logic if a tunnel reaches an inactive state.
86-
- To get alerted when a tunnel reaches an inactive state.
79+
- To get a [health alert](/notifications/notification-available/#load-balancing) when a tunnel reaches an inactive state.
8780
- To distribute traffic more evenly across your Cloudflare Tunnel-accessible origins or endpoints.
8881

89-
### Deploy a load balancer
82+
For setup instructions, refer to [Public load balancers](/cloudflare-one/connections/connect-networks/routing-to-tunnel/public-load-balancers/) or [Private Network Load Balancing](/load-balancing/private-network/) depending on your [use case](#types-of-load-balancers).
83+
84+
### Types of load balancers
85+
86+
There are two types of load balancers that you can use with Cloudflare Tunnel endpoints:
9087

91-
Refer to the [Load Balancer page](/cloudflare-one/connections/connect-networks/routing-to-tunnel/lb/) for more information.
88+
- [Public load balancers](/cloudflare-one/connections/connect-networks/routing-to-tunnel/public-load-balancers/) steer traffic from the Internet to applications published on a Cloudflare domain. Use this method if your service is served by Cloudflare Tunnel via a [published application route](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/#2a-publish-an-application).
89+
- [Private load balancers](/load-balancing/private-network/) steer traffic from WARP clients, Magic WAN, and other <GlossaryTooltip term = "on-ramp">on-ramps</GlossaryTooltip> to an internal IP on your private network. Use this method if your service is connected to Cloudflare Tunnel via a [CIDR route](/cloudflare-one/connections/connect-networks/private-net/cloudflared/connect-cidr/).

0 commit comments

Comments
 (0)