L4 vs L7 Load Balancing: OSI Model Explained

Weighted round robin addresses server power variance by assigning manual weights based on server capacity, sending proportionally more requests to more powerful servers. Dynamic weighted round robin automates this using latency metrics, adapting to changing server performance without human configuration. Least connections represents a fundamentally different approach by tracking outstanding requests on each server and routing new requests to whichever has the least current workload. This algorithm maintains accurate server state awareness, performing exceptionally well regardless of variance in server power or request cost, and only drops requests when all servers' queues are full.

Load balancers distribute traffic using various algorithms: (1) Round Robin sequentially distributes requests across available servers in a loop; (2) Sticky Round Robin ties clients to specific servers using session IDs via cookies or client IP addresses, ensuring all requests from the same client go to the same server—useful for applications relying on server-side session data; (3) Weighted Round Robin assigns weights to servers, sending proportionally more requests to more capable servers and fewer to those with limited resources; (4) IP/URL Hashing uses hash functions to consistently route the same IP or URL to the same server, useful for static content; (5) Least Connections directs traffic to the server with the fewest active connections; (6) Least Time routes requests to the fastest or most responsive server.

Load balancers use four main algorithms to distribute traffic: (1) Round Robin - distributes requests sequentially in a circular pattern across servers (A→B→C→A...); (2) Weighted Round Robin - assigns requests proportionally based on server capacity ratios (e.g., 15:10:5 ratio for servers A, B, C); (3) Least Connection - routes requests to servers with the fewest active connections; (4) Least Response Time - assigns requests to servers with the fastest response time and lowest connection count. These algorithms ensure optimal traffic distribution based on server capabilities and current load conditions.

Load balancers are essential infrastructure components that distribute incoming network traffic across multiple servers to ensure no single server becomes overwhelmed, thereby maintaining smooth performance, preventing crashes, and providing automatic failover when servers fail. These systems operate at different OSI model layers: Layer 4 load balancers work at the transport layer, routing requests based on IP addresses and port numbers without examining content, while Layer 7 load balancers operate at the application layer, analyzing request content to make routing decisions. Three primary algorithms govern how load balancers distribute traffic: Round Robin sequentially assigns requests to servers in a cyclic manner, ensuring even distribution when servers have similar capacity; Least Connections dynamically routes requests to the server with the fewest active connections, making it ideal for requests with varying processing times; and IP Hashing maps client IP addresses to specific servers using a hashing function, ensuring session persistence for stateful applications like online banking or e-commerce platforms.

IP Hash directs requests based on client IP address hashing, ensuring consistent routing of a client's requests to the same server, useful when servers maintain session-specific state. Weighted algorithms assign weights to servers based on capacity/performance metrics (like RAM size), allowing more capable servers to handle proportionally more traffic while accounting for both responsiveness and active connection counts.

When a Layer 7 load balancer terminates TLS, it presents its own certificate to clients and decrypts traffic before forwarding it to backend servers. This allows the load balancer to inspect encrypted traffic and make routing decisions based on the decrypted content. The load balancer can also support Server Name Indication (SNI) to serve different certificates for multiple domains hosted on the same IP address.

SSL/TLS termination involves the Big-IP decrypting encrypted traffic to access Layer 7 content. Without termination, the Big-IP only sees encrypted data and cannot make intelligent routing decisions. With termination, the Big-IP can inspect headers, cookies, and other application data. The Big-IP can then either re-encrypt traffic for backend servers or send it unencrypted, depending on security requirements. When the Big-IP terminates SSL, it uses its own certificates for encryption, centralizing certificate management and eliminating the need to manage certificates on individual backend servers. The Big-IP can use certificates with longer validity periods than typical public certificates. For re-encryption to backend servers, the Big-IP acts as a client, negotiating SSL with each server using its own certificates. Load balancing provides three main benefits: (1) Availability - if one server fails, traffic continues to healthy servers; (2) Performance - distributing connections prevents any single server from becoming overwhelmed; (3) Scalability - applications can grow by adding more servers to the pool rather than upgrading individual servers.

SSL termination is the process of offloading SSL/TLS encryption and decryption from web servers to a load balancer like HAProxy, which offers benefits including reduced server workload, centralized certificate management, and enhanced security controls such as restricting supported SSL/TLS versions and cipher suites; to implement it in HAProxy, configure the frontend with SSL-enabled bind lines pointing to combined PEM certificate files, optionally redirect HTTP traffic to HTTPS using HTTP-Request redirect rules, and fine-tune security settings by specifying allowed SSL/TLS versions and ciphers, then verify the configuration using SSL Labs SSL test.

L7 load balancers operate at the application layer and terminate both TCP and TLS connections. Unlike L4 proxy mode where data remains encrypted, L7 load balancers decrypt HTTPS traffic to inspect request headers, cookies, and other content. This enables intelligent routing based on user authentication status, premium account type, or other application-specific criteria. For example, a load balancer can route premium users to dedicated high-end servers. Additionally, L7 termination simplifies certificate management since only the load balancer needs SSL certificates, eliminating the need to manage certificates on hundreds of backend servers.

TLS termination at the load balancer provides significant performance and security benefits: backend servers avoid TLS computational overhead, certificate management simplifies to a single point of maintenance, and header inspection enables intelligent timeout handling to prevent premature connection termination. However, current implementations transmit decrypted traffic to backend servers, requiring plaintext transmission on trusted networks. The community is actively developing end-to-end re-encryption capabilities. Layer 7 processing extends these capabilities by enabling content-based routing through policies and rules that match hostnames, URL paths, or file types, allowing sophisticated traffic management like blocking malicious file types or redirecting HTTP to HTTPS.

This section covers service discovery mechanisms and L7 routing in Kubernetes. Endpoints represent the actual pods behind a service, created by the endpoints controller which converts pods matching the service's label selector into an endpoints object. Endpoint Slices are a newer API that splits endpoints into smaller chunks for scalability. DNS is integral to service discovery, with CoreDNS as the default implementation running as a pod. Service names follow the format <service-name>.<namespace>.svc.cluster.local, with aliases allowing shorter names. Kube-proxy runs on every node using iptables, IPVS, or user-space mechanisms. It watches services and endpoints, applies filters, links endpoints to services, and updates node rules. No Local DNS addresses high DNS resource cost caused by name alias expansion and high application density. The solution is a slimmed-down local cache on each node based on CoreDNS, without many plugins. Ingress is a Kubernetes API for describing an HTTP proxy and routing rules, matching hostnames and URL paths to target services.

Service discovery is a mechanism in microservices architecture that enables services to dynamically locate and communicate with each other without hardcoding network addresses, using a two-stage process where services first register with a service registry (storing their type and network address) and then look up the addresses of other services when making requests; it can be implemented at the application level using tools like Eureka or HashiCorp Consul, or at the infrastructure level using Kubernetes, which provides built-in DNS-based service discovery that routes traffic to available instances automatically.

In Kubernetes, microservices discover each other through a built-in DNS system that resolves service names to IP addresses, enabling containers within the same pod to communicate via shared IP addresses while different pods use service names for inter-service communication, with services exposed through ClusterIP (internal cluster access), NodePort (external access via node ports), or LoadBalancer (external load balancing).

In Kubernetes, Services bundle pods into a single network endpoint using ClusterIP, NodePort, or LoadBalancer types, operating at Layer 4 (TCP/UDP), while Ingress is an advanced Layer 7 controller that routes HTTP/HTTPS traffic to Services based on domain and path rules, enabling external web traffic access to internal pods through domain-based routing.

This section explains Service discovery and label-based routing in Kubernetes. Services act as load balancers, distributing incoming traffic across multiple Pods. Labels are key-value pairs attached to resources that enable organization and filtering. Selectors allow Services to identify which Pods they should route traffic to. The section explains how Services enable automatic service discovery between microservices, allowing applications to find each other without hardcoding IP addresses. This abstraction simplifies scaling and management by decoupling application code from infrastructure.