Load Balancing, Ingress & Traffic Engineering
Traffic enters your infrastructure once, and it enters through a design you can explain, test with real numbers, and renew certificates without anyone waking up.
What this usually looks like
Your load balancer is a configuration file that three people are afraid to edit, and certificate expiry is treated as an outage waiting to happen.
- Health checks are TCP port probes, so a hung application still receives traffic.
- You cannot answer what QPS the edge survives, because nobody has load-tested it.
- TLS certificates renew by calendar reminder and hope.
- In Kubernetes, ingress-nginx is doing a job the Gateway API would do more clearly.
Three ways to buy this
Audit if you want to know how bad it is. Build if you have the team and want the capability. Managed if you don't want to own the pager. Most engagements start with the audit and decide afterwards.
Audit
A fixed-price health check — the cheapest way in
- Edge topology and single-point analysis (VIP, LB pair, upstream paths)
- Health-check effectiveness review
- TLS configuration grade and renewal automation check
- Achievable QPS/latency baseline under load test
Build
One-off delivery: design, code, hardening, handover
- L4 VIP layer (LVS/IPVS in DR mode) or eBPF datapath (Katran/DPVS)
- L7 tier with HAProxy or Envoy, tuned and reloaded without dropping connections
- Kubernetes ingress via Gateway API on Cilium, Envoy Gateway, or NGINX Gateway Fabric
- TLS via cert-manager with an internal PKI where relevant
- WAF (ModSecurity/Coraza) and rate limiting at the edge
Managed
Build plus 7×24 on-call, SLA and quarterly drills
- Certificate lifecycle with expiry alerting from two independent sources
- Load-test baseline re-run after material change
- Configuration review on every change, versioned in Git
- Autoscaling and connection-limit tuning
What we actually deploy
Specific tooling, not categories. If a version matters to your decision, ask — we will tell you which one we would pick and why, including when the answer is the older one.
L4
- LVS / IPVS (DR, TUN, NAT)
- DPVS
- Katran (eBPF/XDP)
- Nginx stream
- F5 BIG-IP (existing estates)
L7
- HAProxy 2.9+
- Nginx / OpenResty
- Envoy 1.30+
- Traefik v3
- Apache APISIX
- Kong Gateway
Kubernetes ingress
- Gateway API 1.2
- Cilium Gateway
- Envoy Gateway
- NGINX Gateway Fabric
- Istio (ambient mode)
- Linkerd
TLS & PKI
- cert-manager
- ACME / Let's Encrypt
- step-ca
- HashiCorp Vault PKI
- mTLS with SPIFFE/SPIRE
Security at the edge
- ModSecurity v3 / Coraza
- OWASP CRS
- OAuth2/OIDC (Keycloak)
- rate limiting
- bot mitigation
Global
- DNS GSLB
- Anycast
- health-checked failover
- EDNS client subnet awareness
What we will be measured on
These are the numbers we put in the delivery report. If we cannot measure it, we do not promise it.
- Single-node loss moves the VIP in under 3 seconds, verified by test.
- A published load-test curve: real QPS, real p95 latency, real saturation point.
- Zero-downtime config reload, demonstrated under sustained traffic.
- Certificate renewal fully automated, with independent expiry monitoring as backup.
- Health checks that fail a hung process, not just a closed port.
What we would build, and where the weak point is
cert-manager is a hard dependency for TLS renewal. If it is a single replica with no readiness alerting, your certificate expires quietly at 3am — we monitor it as a production service, not a helper.
marks a single point of failure we would raise with you rather than hide. Every architecture has one; the question is whether you know where it is.
What we don't do
Every vendor says yes to everything. Here is where our answer is no, or where someone else needs to be in the room. If this list looks wrong for your situation, tell us — we would rather argue about scope before the contract than after.
- Requires partner
Writing application-level retry, timeout and idempotency logic
Load balancing cannot fix a client that retries non-idempotent writes. We will document the contract your team must implement.
- Requires partner
CDN and global anycast as a managed product
We integrate Cloudflare, Fastly or CloudFront into your design; we do not operate their network.
- Out of scope
DDoS mitigation at carrier scale
Volume-based attacks need upstream absorption. We tune what happens after scrubbing, and we say plainly where our ceiling is.
- Out of scope
Legacy F5 iRules development
We audit and migrate existing F5 estates; we do not author iRules.
What it looked like last time
A SaaS edge moved from ingress-nginx to Cilium Gateway API: config surface reduced by roughly two thirds, and a load test established the real saturation point at 4× the previously assumed capacity — no hardware change required.
Anonymised under NDA. No client names, no logos, no invented metrics. Full case library on the work page.
Talk to the network & edge engineer about your load balancing & ingress
Send us the architecture, or just describe what broke most recently. You'll get an engineer's answer, not a discovery questionnaire.
Talk to a network & edge engineer: botonwa@gmail.com · +86 130 5181 3099