nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Any one configured Jira/Bitbucket Data Center to work with A10 load balancer?

Manohar Goli (Dnfcs)

Hello Atlassian Community,

We are working on a Data center configuration that has A10 hardware load balancer in front of 4 node JIRA/BB cluster running on https all the way from Load balancer URL to Node ( SSL' are setup on server, to have end to end secure connection).

Most of the examples shared are with Apache, Nginx, F5 nothing on A10, please share details on configuration if any one has done it.

Thanks in advance.

Cheers

Manohar

Accepted answers

All comments

Dave Theodore [Coyote Creek Consulting]

You really shouldn't need to do anything special. For Confluence, your LB needs to support websockets, but I don't believe websockets are needed for Jira or Bitbucket. We've done some configurations with pretty primitive load balancers and haven't had any issues. If you're using self-signed ssl certs for TLS between the application nodes and LB, you may need to import the certs into the load balancer so they are trusted.

When you configure your rules, you need to make sure you are session sticky. Most load balancers support cookie based session control, so I would expect you can use this option. To test, go to the "Clustering" link in the admin interface and refresh the page a few times to make sure you stay sticky on one node. I would also recommend using "least load" or whatever it's called in A10 speak. In testing, we have found that provides the most even distribution of loading among nodes. I hope that helps.

Manohar Goli (Dnfcs)

@Dave Theodore [Coyote Creek Consulting] Thank you very much for the info. Do you have any KB for configuring Data center with SSL on nodes, instead of terminating SSL at Load balancer? were there any challenges that we need to be aware of??

Dave Theodore [Coyote Creek Consulting]

Ah, I think I may have misunderstood what you were asking. Are you suggesting having the LB only serve as a load balancer and terminating the SSL on each application node? I understood the problem to be that you would terminate SSL on your LB and also do SSL to each node. Why wouldn't you want to terminate SSL on the load balancer if it can do it? It's much better to manage certificates in one place than in many.

Another thing that I forgot to mention is that you will need the ability to load balance TCP and HTTP(S) traffic for Bitbucket. A normal HTTP only load balancer will not be able to proxy the SSH traffic. You could have your users use HTTP for their git traffic, though.

Manohar Goli (Dnfcs)

Security team has concerns of leaving connectivity between LB and Nodes on http, so we had to have SSL terminate at node, so that connection between LB and Node are on HTTPS. We did mention about the challenges of having nodes handle SSL but they are not ready to buy any of those arguments. Here is the current ask:

A10 load balancer handles all https request and forwards the same to nodes and nodes handle decryption and encryption before sending response back to LB. We have communicated the need of TCP and SSH requirement to A10 team and they are aware of that requirement.

I hope my question is clear now? How do we handle certs now and are you aware any precautions we need to take to make sure this configuration works.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

server

jira

bitbucket

jira-server