Load Balancers

A load balancer distributes incoming traffic across a pool of backend instances. Frostmoln offers two provider drivers; you choose one at create time — it can't be changed in place (to switch, delete and recreate).

Choosing a provider

	Amphora (default)	OVN
Layers	L4 and L7 (HTTP/HTTPS)	L4 only (TCP/UDP/SCTP)
TLS termination	Yes (via the platform key manager)	No
PROXY protocol / header insertion	Yes	No
Source IP to backends	X-Forwarded-For (L7) or PROXY protocol (L4)	Preserved natively (L4)
Overhead	Runs a load-balancer VM	No VM (built into the fabric)
Best for	Web apps, TLS, HTTP routing	High-throughput L4, source-IP-sensitive workloads

fm load-balancer create --name web-lb --vpc my-vpc --subnet my-subnet                 # Amphora (default)
fm load-balancer create --name l4-lb  --vpc my-vpc --subnet my-subnet --provider ovn  # OVN, L4

fm lb is an alias for fm load-balancer. In Terraform the resource is frostmoln_load_balancer (provider type and flavor are immutable / force-new).

Internal vs public

A load balancer is internal by default (a private VIP reachable within the VPC). For a public one, allocate a public IP first and pass it:

fm load-balancer create --name web-lb --vpc my-vpc --subnet my-subnet \
  --scheme public --public-ip <public-ip-id>

Listeners — and required allowed-CIDRs

A listener accepts traffic on a protocol/port (e.g. HTTPS:443). Listeners are deny-by-default: you must specify the client CIDRs allowed to reach them — this is required, not optional. Use 0.0.0.0/0 to accept from anywhere.

fm load-balancer listener create --lb web-lb --name https \
  --protocol https --port 443 --allowed-cidr 0.0.0.0/0

Pools, members, and health monitors

• A pool is the set of backend members, with a load-balancing algorithm: round_robin (default), least_connections, or source_ip. (OVN pools must use source_ip_port.)
• Members are backend instances (address + port, optional weight, optional backup). Members outside the load balancer's subnet need the cross-subnet flag.
• A health monitor probes members (tcp / http / https, with delay, timeout, retries, and for HTTP a path + expected codes) and removes unhealthy ones from rotation.

fm load-balancer pool   create --lb web-lb --name web-pool --protocol http --algorithm round_robin
fm load-balancer member create --pool web-pool --address 10.0.1.10 --port 8080
fm load-balancer health-monitor create --pool web-pool --type http --url-path /healthz

TLS, PROXY protocol, and source IP (Amphora)

• TLS termination — create a terminated_https listener referencing a TLS certificate; the load balancer terminates TLS and forwards to the pool. (Amphora only.)
• PROXY protocol (v1/v2) — preserves the real client IP to L4 backends; your members must be configured to accept the PROXY header. (Amphora only.)
• Source IP: with OVN (L4) the client IP is preserved natively; with Amphora L7 read it from X-Forwarded-For; with Amphora L4 use PROXY protocol.

Status and stats

A load balancer is active when healthy, or degraded when it's provisioned and editable but its backend members are currently unhealthy (not an error — fix the members or health check). Amphora reports traffic counters (connections, bytes, errors) plus per-member health; OVN reports member health only (no counters).

Attach a public IP for public reach and allow the listener ports in the relevant security group.

Related

• Compute / Instances · Public IPs · Security Groups