Azure Standard_v2 Application Gateway

this topic explains how to use an azure standard v2 application gateway (layer 7) for your turbine deployment two load balancers are required for this deployment the azure standard v2 application gateway (layer 7) is used for external access to the turbine platform and the turbine platform installer an additional azure load balancer (layer 4) is still required for the internal cluster communication architecture diagram standard v2 application gateway for the turbine platform and the turbine platform installer create an azure standard v2 application gateway https //docs microsoft com/en us/azure/application gateway/quick create portal resource group should be set according to your organization's standards region should match that of the virtual machines that turbine will be installed in tier set to standard v2 enable autoscaling should be set according to your organization's standards availability zone set to select all zones that will have virtual machines that turbine will be installed on virtual network should be set according to your organization's standards the virtual network that the application gateway is in needs to be able to communicate to the virtual network that the turbine virtual machines are in frontend ip address type should be set according to your organization's standards backend pools create the following backend pools port 443 add the ip of each virtual machine that turbine will be installed on port 8800 add the ip of each virtual machine that turbine will be installed on routing rules create the following routing rules port 443 frontend ip set to the ip that was selected above protocol set to https port set to 443 listener type set to basic backend targets target type set to backend pool backend target set to the port 443 backend pool created above http settings backend protocol set to https backend port set to 4443 note that this is 4443 and not 443 trusted root certificate use well known ca certificate if your certificates are signed by a well known ca you can set this to yes if you're using a private or untrusted ca then set this to no and set cer certificate to the root ca certificate of the certificate uploaded for the turbine web backend on the turbine platform installer config page more information on how to export this certificate in the right format can be found in azure's certificates for backend authentication https //docs microsoft com/en us/azure/application gateway/certificates for backend authentication#export trusted root certificate for v2 sku documentation request time out may vary based on your preferences for how long the load balancer will wait for a request from the backend before returning a "connection timed out" error message override with new host name set to yes host name override set to override with specific domain name set the host name override field to the hostname of the certificate uploaded for the turbine web backend on the turbine platform installer config page create custom probes set to no port 8800 frontend ip set to the ip that was selected above protocol set to https port set to 8800 listener type set to basic backend targets target type set to backend pool backend target set to the port 800 backend pool created above http settings backend protocol set to https backend port set to 8800 trusted root certificate use well known ca certificate if your certificates are signed by a well known ca you can set this to yes if you're using a private or untrusted ca then set this to no and set cer certificate to the root ca certificate of the certificate uploaded for the turbine platform installer ui more information on how to export this certificate in the right format can be found in azure's certificates for backend authentication https //docs microsoft com/en us/azure/application gateway/certificates for backend authentication#export trusted root certificate for v2 sku documentation request time out may vary based on your preferences for how long the load balancer will wait for a request from the backend before returning a "connection timed out" error message override with new host name set to yes host name override set to override with specific domain name set the host name override field to the hostname of the certificate uploaded for the turbine platform installer ui create custom probes set to no optional port 80 used for the http to https redirect and can be excluded if you only want https/443 to be available frontend ip set to the ip that was selected above protocol set to http port set to 80 listener type set to basic backend targets target type set to redirection redirection type set to permanent redirection target set to listener target listener set to the port 443 listener created above include query string set to yes include path set to yes network security groups for azure standard v2 application gateways, ingress port access is defined in the network security groups used by the subnets the port requirements are available in system requirements, system requirements for an embedded cluster install docid 9lxricxlm1t14ydlkt4zr azure requires special ports to be open for the subnets that application gateways are in more information can be found in azure's application gateway infrastructure configuration https //docs microsoft com/en us/azure/application gateway/configuration infrastructure documentation load balancer for internal cluster communication create a public azure load balancer https //docs microsoft com/en us/azure/load balancer/quickstart load balancer standard public portal resource group should be set according to your organization's standards region should match that of the virtual machines that turbine will be installed in type set to public this has to be set to public because internal load balancers do not support hairpinning access to the virtual machines should still be restricted by network security groups sku set to standard tier set to regional public ip address can either be a new public ip address to use or select an existing one availability zone set to zone redundant backend pools create the following backend pool port 6443 backend pool configuration set to nic ip version set to ipv4 virtual machines add the first virtual machine that you'll be running the turbine platform installer on to the backend pool after turbine has been installed on the additional nodes they need to be added to this target group health probes create the following health probe port 6443 protocol set to tcp port set to 6443 interval and unhealthy threshold may vary based on your preferences for how quickly a virtual machine should become unhealthy in order to stop receiving traffic load balancing rules create the following load balancing rule port 6443 ip version set to ipv4 frontend ip address set to the ip that was chosen when the load balancer was created protocol set to tcp port set to 6443 backend port set to 6443 backend pool set to the port 6443 backend pool created above health probe set to the port 6443 health probe created above floating ip set to disabled outbound source network address translation set to outbound and inbound use the same ip network security groups for azure load balancers, ingress port access is defined in the network security groups used by the virtual machines and subnets the port requirements are available in system requirements, system requirements for an embedded cluster install docid 9lxricxlm1t14ydlkt4zr turbine configuration azure application gateways require explicitly trust of the backend certificates so be sure to upload your own certificate for the turbine platform installer ui and for the turbine platform be sure to enable the expose the swimlane web service externally option on the turbine platform installer ui config tab