Layer 7 policies

Define Layer 7 policies to specify actions the load balancer takes when all associated rules evaluate to true.

Note

You cannot create L7 policies and rules with UDP load balancers.

Layer 7 policy evaluation logic
Copy link

Understand Layer 7 policy evaluation logic where all rules must match for the policy to apply, using multiple policies for OR logic.

The RHOSO Load-balancing service (octavia), layer 7 load-balancing policy uses the following logic: all the rules associated with a given policy are logically AND-ed together. A request must match all of the policy rules to match the policy.

If you need to express a logical OR operation between rules, create multiple policies with the same action or, make a more elaborate regular expression).

Layer 7 policy action types and precedence
Copy link

Configure Layer 7 policy actions to reject requests, redirect to URLs or pools, or apply prefix-based redirects with proper precedence ordering.

The Load-balancing service layer 7 policy actions are:

  • REJECT: The request is denied with an appropriate response code, and not forwarded on to any back end pool.
  • REDIRECT_TO_URL: The request is sent an HTTP redirect to the URL defined in the redirect_url parameter.
  • REDIRECT_PREFIX: Requests matching this policy are redirected to this prefix URL.
  • REDIRECT_TO_POOL: The request is forwarded to the back-end pool associated with the L7 policy.

How you position layer 7 policy actions impact how the Load-balancing service manages policies:

  • In the reference implementation of the Load-balancing service (HAProxy amphorae), HAProxy enforces the following ordering regarding policy actions:
    • REJECT policies take precedence over all other policies.
    • REDIRECT_TO_URL policies take precedence over REDIRECT_TO_POOL policies.
    • REDIRECT_TO_POOL policies are evaluated only after all of the above, and in the order that the position of the policy specifies.
  • L7 policies are evaluated in a specific order, as defined by the position attribute, and the first policy that matches a given request is the one whose action is followed.
  • If no policy matches a given request, then the request is routed to the listener’s default pool, if it exists. If the listener has no default pool, then an error 503 is returned.
  • Policy position numbering starts with one (1).
  • If a new policy is created with a position that matches that of an existing policy, then the new policy is inserted at the given position.
  • If a new policy is created without specifying a position, or specifying a position that is greater than the number of policies already in the list, the new policy is appended to the list.
  • When policies are inserted, deleted, or appended to the list, the policy position values are re-ordered from one (1) without skipping numbers. For example, if policy A, B, and C have position values of 1, 2 and 3, if you delete policy B from the list, the position for policy C becomes 2.