<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
In a way kolla already does this by separating certain things onto "internal" VIPs vs "external" VIPs. So even though a single haproxy instance is running both internal and external, they are separated into their own connection paths that enforce segregation.
Ultimately running a separate haproxy won't really add much security as you'll essentially be doing what kolla is already doing.</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Mariusz Karpiarz <m.karpiarz@eschercloud.ai><br>
<b>Sent:</b> 16 November 2022 17:23<br>
<b>To:</b> Michal Arbet <michal.arbet@ultimum.io><br>
<b>Cc:</b> openstack-discuss <openstack-discuss@lists.openstack.org><br>
<b>Subject:</b> Re: [Kolla][kolla-ansible][HAProxy] Splitting the load balancer into internal and external?</font>
<div> </div>
</div>
<style>
<!--
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Calibri}
p.x_MsoNormal, li.x_MsoNormal, div.x_MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif}
a:link, span.x_MsoHyperlink
{color:blue;
text-decoration:underline}
.x_MsoChpDefault
{font-size:10.0pt}
@page WordSection1
{margin:72.0pt 72.0pt 72.0pt 72.0pt}
div.x_WordSection1
{}
-->
</style>
<div lang="EN-GB" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="x_mc-ip-hide">
<div style="color:#000000; font-size:12px; text-align:left; font-family:Helvetica,Arial,sans-serif">
<strong><br>
<div class="x_caution" style="background-color:#F47F53; font-family:sans-serif"><span style="font-size:14pt"><strong>CAUTION:</strong></span>
<span style="font-size:11pt; font-weight:400">This email originates from outside THG</span>
</div>
</strong><br>
</div>
<hr>
</div>
<div class="x_WordSection1">
<div>
<p class="x_MsoNormal">Michal,<br>
Thank you for your message.</p>
<p class="x_MsoNormal"><br>
To explain what I mean a little better, let’s look at a use case of a web-based service running in a cloud but not using a Database-as-a-Service offering. In this setup (a sample diagram:
<a href="https://www.cozumpark.com/wp-content/uploads/2020/02/image-5.png">
https://www.cozumpark.com/wp-content/uploads/2020/02/image-5.png</a>) a good security practice is to use a different (“internal”) load balancer for database servers and different (“public”) - for all the web servers serving user requests. The database doesn’t
need to be accessible from the outside world, so this split provides a physical separation of traffic and this is exactly what I’m suggesting here.</p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal">As for how to archive this, we can keep one HAProxy process in one container (and use regular Kolla images) but there will simply be two HAProxy containers (one “external” and one “public”) running either on the same controllers or on
different ones.</p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal">I hope this explanation helps but please do let me know if you want me to elaborate on any particular aspect of it.</p>
</div>
</div>
</div>
<div></div>
<p><span style="font-size:10.5pt;font-family:"Arial","sans-serif";color:black">Danny Webb</span>
<br>
<span style="font-size:8.5pt;font-family:"Arial","sans-serif";color:black">Principal OpenStack Engineer</span><br>
<span style="font-size:8.5pt;font-family:"Arial","sans-serif";color:#019EEB"><a href="http://www.thehutgroup.com/" target="_blank"><span style="color:#575a5d;
text-decoration:none;text-underline:none">The Hut Group</span></a></span>
<br>
<br>
<span style="font-size:8.5pt;font-family:"Arial","sans-serif";color:black">Tel: </span>
<br>
<span style="font-size:8.5pt;font-family:"Arial","sans-serif";color:black">Email:
<a href="mailto:Danny.Webb@thehutgroup.com">Danny.Webb@thehutgroup.com</a></span></p>
<p style="margin-bottom:12.0pt"><br>
<span style="font-size:7.5pt;font-family:"Arial","sans-serif";color:#666666">For the purposes of this email, the "company" means The Hut Group Limited, a company registered in England and Wales (company number 6539496) whose registered office is at Fifth Floor,
Voyager House, Chicago Avenue, Manchester Airport, M90 3DQ and/or any of its respective subsidiaries.</span>
<br>
<br>
<b><span style="font-size:7.5pt;font-family:"Arial","sans-serif";color:#666666">Confidentiality Notice</span></b>
<br>
<span style="font-size:7.5pt;font-family:"Arial","sans-serif";color:#666666">This e-mail is confidential and intended for the use of the named recipient only. If you are not the intended recipient please notify us by telephone immediately on +44(0)1606 811888
or return it to us by e-mail. Please then delete it from your system and note that any use, dissemination, forwarding, printing or copying is strictly prohibited. Any views or opinions are solely those of the author and do not necessarily represent those of
the company.</span> <br>
<br>
<b><span style="font-size:7.5pt;font-family:"Arial","sans-serif";color:#666666">Encryptions and Viruses</span></b>
<br>
<span style="font-size:7.5pt;font-family:"Arial","sans-serif";color:#666666">Please note that this e-mail and any attachments have not been encrypted. They may therefore be liable to be compromised. Please also note that it is your responsibility to scan this
e-mail and any attachments for viruses. We do not, to the extent permitted by law, accept any liability (whether in contract, negligence or otherwise) for any virus infection and/or external compromise of security and/or confidentiality in relation to transmissions
sent by e-mail.</span> <br>
<br>
<b><span style="font-size:7.5pt;font-family:"Arial","sans-serif";color:#666666">Monitoring</span></b>
<br>
<span style="font-size:7.5pt;font-family:"Arial","sans-serif";color:#666666">Activity and use of the company's systems is monitored to secure its effective use and operation and for other lawful business purposes. Communications using these systems will also
be monitored and may be recorded to secure effective use and operation and for other lawful business purposes.</span>
</p>
<span style="font-size:4pt;color:#FFFFFF">hgvyjuv</span>
<div></div>
</body>
</html>