cossacklabs / acra

Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.
https://www.cossacklabs.com/acra/
Apache License 2.0
1.32k stars 128 forks source link

[Query] acraserver in distributed environment behind load balancer #696

Open devendermishra opened 6 months ago

devendermishra commented 6 months ago

Describe the bug I want to know if acra can be run in multiple servers/pods behind a load balancer to ensure better availability.

To Reproduce NA

Expected behavior NA

Acra configuration files NA

Environment (please complete the following information):

Additional context In distributed environment, a node may go out of service unexpectedly. In order to ensure that acraserver works in such case to use multiple server behind load balancer. So, I want to know that if acraserver can work in such settings. Also, want to know what are recommendations to ensure better availability.

vixentael commented 6 months ago

Hi @devendermishra!

Yes, Acra server works well with horizontal scaling.

Acra has the whole sections in the docs regarding optimisation, which includes vertical and horizontal scaling: https://docs.cossacklabs.com/acra/configuring-maintaining/optimizations/

Acra also has the Balancer demo with AcraServer, PostgreSQL and HAProxy which demostrates different combination: balancer before the databases, or balancer before AcraServers https://github.com/cossacklabs/acra-balancer-demo

Hope it helps!

devendermishra commented 5 months ago

Thanks @vixentael for prompt response. My question is related to MySQL 8 based clients. Currently, MySQL 8 client is not supported. However, acra needs to store the capability of connected client. How that will work in case of horizontal scaling?

devendermishra commented 5 months ago

In the given demo, there is 1 acra server per DB. I want to know if we can have multiple acra server per DB (especially MySQL).

Lagovas commented 5 months ago

My question is related to MySQL 8 based clients. Currently, MySQL 8 client is not supported.

However, acra needs to store the capability of connected client.

For now, Acra doesn't store it. Your balancers should park the same client's connection to the same AcraServer and AcraServer will use the same database. Database wire protocols are stateful and operate with client sessions. Every session has its own set of registered prepared statements, opened transactions, connection parameters, db variables, and so on. So, the same client's connection should be proxied to the same database that handle that connection. You can scale your infrastructure by X database instances and every instance should have own AcraServer instance.

In the given demo, there is 1 acra server per DB. I want to know if we can have multiple acra server per DB (especially MySQL).

Yes, you can. But it depends on how your apps will connect to the AcraServer/Database. Let's use next example. You have a service parallelized into 2 instances and it uses a pool of connections of size 2. How you will distribute connection between different AcraServers?