Description:

An internet-facing Load Balancer has a public IP address and can receive traffic directly from the public internet.

Load Balancers that do not require public access should use a Private IP and should not have a public IP address.


Rationale:

Preventing unnecessary internet-facing Load Balancers reduces public network exposure and limits the number of resources accessible from external networks.


Impact:

  • Removing public access may prevent external users from reaching applications through the Load Balancer.

  • Applications that require public access should be reviewed before making changes.

  • Application connectivity should be verified after changing the Load Balancer configuration.


Default Value:

Utho Load Balancers can be configured with public or private network connectivity. Each Load Balancer should be reviewed to ensure that public access is required.


Pre-requisites:

  • A Utho account with permission to manage Load Balancers.

  • Access to the Utho Console.

  • Permission to view and manage Load Balancers.

  • Knowledge of which Load Balancers require public internet access.


Remediation

Test Plan:

Using the Utho Console

  1. Sign in to the Utho Console using an account with appropriate permissions.

  2. Navigate to Netwoek → Load Balancer.

  3. Review the list of Load Balancers.

  4. Select the Load Balancer that you want to verify.

  5. Click Manage for the selected Load Balancer.

  6. Review the IP Address and Private IP fields.

  7. Verify that the IP Address is N/A and that a Private IP is assigned.

  1. If a public IP address is assigned, follow the Implementation Steps to remediate the issue.


Using the Utho API

List the Load Balancers:


curl -s \

-H "Authorization: Bearer $UTHO_API_TOKEN" \

https://api.utho.com/v2/loadbalancer/




Retrieve a specific Load Balancer:


curl -s \

-H "Authorization: Bearer $UTHO_API_TOKEN" \

https://api.utho.com/v2/loadbalancer/<loadbalancer-id>/



Review the response and verify whether a public IP address is assigned.



Implementation Steps

Using the Utho Console

  1. Sign in to the Utho Console using an account with appropriate permissions.

  2. Navigate to  Network →Load Balancer.

                                         

  1. Identify the Load Balancer that has a public IP address and does not require public access.

  2. Create a new Load Balancer.

  1. Configure the new Load Balancer with the required private network/VPC configuration. In the Public IP section, select Disable.

  1. Configure the required frontends on the new Load Balancer.

  2. Configure the required backend servers.

  3. Verify that the new Load Balancer shows:

    • IP Address: N/A

    • Private IP: Assigned

  4. Test the application through the new private Load Balancer.


Using the Utho API

Retrieve the existing Load Balancer configuration:


curl -s \

-H "Authorization: Bearer $UTHO_API_TOKEN" \

https://api.utho.com/v2/loadbalancer/<loadbalancer-id>/




If a new private Load Balancer is required, create it using the supported Utho API configuration:


curl -X POST \

-H "Authorization: Bearer $UTHO_API_TOKEN" \

-H "Content-Type: application/json" \

-d '<load-balancer-configuration>' \

https://api.utho.com/v2/loadbalancer/add/



Verify the new Load Balancer configuration:


curl -s \

-H "Authorization: Bearer $UTHO_API_TOKEN" \

https://api.utho.com/v2/loadbalancer/<new-loadbalancer-id>/




If the old public Load Balancer is no longer required, delete it using the supported Utho API operation:

curl -X DELETE \

-H "Authorization: Bearer $UTHO_API_TOKEN" \

https://api.utho.com/v2/loadbalancer/<loadbalancer-id>/destroy/




If the Load Balancer is internet-facing and cannot be changed to private through the available Utho configuration, create a replacement private Load Balancer if supported and then remove the old public Load Balancer.


Backout Plan:

  1. Sign in to the Utho Console using an account with appropriate permissions.

  2. Navigate to Load Balancer.

  3. Locate the Load Balancer created during remediation.

  4. Click Manage for the selected Load Balancer.

  5. If public access is required, create a Load Balancer with the required public network configuration.

  6. Configure the required frontends and backends.

  7. Verify that the application is accessible through the required public endpoint.

  8. Delete the replacement private Load Balancer if it is no longer required.


References: