Load Balancer Security

Overview

Securing the Polystack Load Balancer infrastructure protects both the management plane (controller-to-appliance communication) and the data plane (client traffic). This guide covers network isolation of the management plane, appliance TLS certificate lifecycle, quota auditing, and access log configuration.

Administrator Access Required — This operation requires the admin role. Contact your Polystack administrator if you do not have sufficient permissions.

Management Plane Isolation

The load balancing management network carries control traffic between the controller and appliances. This network must be isolated from tenant and provider networks to prevent unauthorized appliance access.

Assign a dedicated management network

The management network should use a non-routable CIDR not reachable from tenant networks or the internet. Configure in the deployment console globals:

Load balancer management network

octavia_management_network: lb-management-net
octavia_management_subnet: lb-management-subnet

Apply security group rules

The management security group should allow only the controller IP to reach appliance management ports:

TCP 9443 — appliance API (controller → appliance only)
UDP 5555 — health manager heartbeat (bidirectional)

Verify management security group rules

openstack security group rule list octavia-management-sg

Verify network isolation

Confirm tenant instances cannot reach the management network CIDR:

Test management network isolation

# From a tenant instance — should be unreachable
ping <management-network-cidr-first-ip>

Ping should fail — management network is not routable from tenant networks.

TLS Certificate Lifecycle

Appliances use TLS certificates for secure controller-to-appliance communication. Monitor and rotate certificates before expiry.

Check all appliance certificate expiration dates

openstack loadbalancer amphora list \
  -c id -c cert_expiration -c status \
  --sort-column cert_expiration

For appliances with certificates expiring within 30 days:

Trigger certificate rotation via failover

openstack loadbalancer amphora failover <amphora-id>

Certificate rotation via failover replaces the appliance with a fresh instance using a new certificate. In ACTIVE_STANDBY topology, this is non-disruptive. In SINGLE topology, expect a brief interruption.

Quota Auditing

Regularly review quota consumption to identify projects with unusual resource usage:

Audit all project quotas

openstack loadbalancer quota list --all-projects

Find projects using more than 80% of their load balancer quota

openstack loadbalancer quota list --all-projects -f json | python3 -c "
import json, sys
quotas = json.load(sys.stdin)
for q in quotas:
    lbs = q.get('in_use_loadbalancer', 0)
    limit = q.get('loadbalancer', 10)
    if limit > 0 and lbs / limit >= 0.8:
        print(f'{lbs}/{limit} LBs  {q[\"project_id\"]}')
"

Investigate projects consuming unusually high member or listener counts — this may indicate misconfigured applications creating excessive resources or resource leaks.

Access Log Configuration

Configure load balancer access logs to forward to your centralized logging platform. Access logs capture source IPs, request URIs, response codes, and latency — essential data for compliance auditing and security incident investigation.

Enable access logging in the deployment console globals

octavia_enable_access_log: "yes"
octavia_access_log_facility: LOG_LOCAL0

Apply:

Apply access log configuration

ironcore-ansible deploy --tags octavia

Store load balancer access logs in Polystack Object Storage for long-term retention. A retention policy of 90 days satisfies most compliance frameworks.

Security Checklist

Management network isolated

Verify the management network CIDR is not reachable from tenant instances or external networks.

Appliance certificates valid

All appliances have cert_expiration dates more than 30 days in the future.

Quota limits configured

All projects have explicit quota limits set — none are using unlimited defaults in a multi-tenant environment.

Access logs forwarded

Access logs are configured and flowing to the centralized logging platform. Verify by creating a test load balancer and checking for log entries.

Next Steps

Monitoring

Set up proactive alerts for certificate expiry and appliance health.

Quotas

Configure per-project resource limits to prevent over-consumption.

Admin Troubleshooting

Resolve security-related configuration and access failures.

Architecture

Review the management and data plane boundaries for security design.

Core Services

Other Services

Overview

Management Plane Isolation

Assign a dedicated management network

Apply security group rules

Verify network isolation

TLS Certificate Lifecycle

Quota Auditing

Access Log Configuration

Security Checklist

Next Steps

Monitoring

Quotas

Admin Troubleshooting

Architecture

​Overview

​Management Plane Isolation

Assign a dedicated management network

Apply security group rules

Verify network isolation

​TLS Certificate Lifecycle

​Quota Auditing

​Access Log Configuration

​Security Checklist

​Next Steps

Monitoring

Quotas

Admin Troubleshooting

Architecture

Overview

Management Plane Isolation

TLS Certificate Lifecycle

Quota Auditing

Access Log Configuration

Security Checklist

Next Steps