Shared NLB and per-cluster TLS targets

Shared NLB and per-cluster TLS targets An architecture diagram generated by Archify. Client · New connections · Architecture component Client New connections NLB · TCP 443 · Cross-zone · client SG · Architecture component NLB · TCP 443 Cross-zone · client SG Blue target group · traffic_weights.blue · Architecture component Blue target group traffic_weights.blue Green target group · traffic_weights.green · Architecture component Green target group traffic_weights.green Blue TLS Pods · Service 443 → Pod 8443 · Blue cluster Blue TLS Pods Service 443 → Pod 8443 Green TLS Pods · Service 443 → Pod 8443 · Green cluster Green TLS Pods Service 443 → Pod 8443 Requests weight B weight G TLS 8443 TLS 8443 Blue cluster Green cluster Legend Backend Cloud External

Ports and ownership

  • • NLB TCP443 → Pod TLS8443; no HTTP redirect
  • • Separate LBC TGB registers targets and backend rules
  • • Application provides TLS certificate and HTTPS /healthz

Staged transition

  • • Weights are relative 0..999; total100 is not required
  • • Weight zero requires connection/retry validation
  • • Verify flows, errors, latency, and capacity after change

Other layer requirements

  • • DNS selection needs two independent LB endpoints
  • • Automation proposes by default; no atomicity with external writers
  • • Plan data replication, schema compatibility, and recovery separately