Layer 7 rules

Define Layer 7 rules to evaluate hostnames, paths, file types, headers, cookies, and SSL certificates for traffic routing decisions.

For the RHOSO Load-balancing service (octavia), a layer 7 (L7) load-balancing rule is a single, simple logical test that returns either true or false. It consists of a rule type, a comparison type, a value, and an optional key that is used depending on the rule type.

An L7 rule must always be associated with an L7 policy.

Note

You cannot create L7 policies and rules with UDP load balancers.

The load-balancing layer 7 rules are:

  • HOST_NAME: The rule compares the HTTP/1.1 hostname in the request against the value parameter in the rule.
  • PATH: The rule compares the path portion of the HTTP URI against the value parameter in the rule.
  • FILE_TYPE: The rule compares the last portion of the URI against the value parameter in the rule, for example, txt, jpg, and so on.
  • HEADER: The rule looks for a header defined in the key parameter and compares it against the value parameter in the rule.
  • COOKIE: The rule looks for a cookie named by the key parameter and compares it against the value parameter in the rule.
  • SSL_CONN_HAS_CERT: The rule matches if the client has presented a certificate for TLS client authentication. This does not imply that the certificate is valid.
  • SSL_VERIFY_RESULT: This rule matches the TLS client authentication certificate validation result. A value of zero (0) means the certificate was successfully validated. A value greater than zero means the certificate failed validation. This value follows the openssl-verify result codes.
  • SSL_DN_FIELD: The rule looks for a Distinguished Name field defined in the key parameter and compares it against the value parameter in the rule.

Layer 7 rule comparison operators
Copy link

Use comparison operators such as REGEX, STARTS_WITH, ENDS_WITH, CONTAINS, and EQUAL_TO to create precise Layer 7 routing rules.

The Load-balancing service comparison operators are:

  • REGEX: Perl type regular expression matching
  • STARTS_WITH: String starts with
  • ENDS_WITH: String ends with
  • CONTAINS: String contains
  • EQUAL_TO: String is equal to

To more fully express the logic that some policies require and the Red Hat OpenStack Services on OpenShift (RHOSO) Load-balancing service (octavia) uses, layer 7 load-balancing rules can have their result inverted.

If the invert parameter of a given rule is true, the result of its comparison is inverted.

For example, an inverted equal to rule effectively becomes a not equal to rule. An inverted regex rule returns true only if the given regular expression does not match.