CLB supports personalized configuration feature, allowing you to set the configuration parameters of a single CLB instance, such as client_max_body_size, ssl_protocols, etc., to meet your personalized configuration needs.
Note:
- The number limit of personalized configurations is consistent with the tenant's public network CLB quota. For example, if the public network CLB quota is 200 by default, the number limit of personalized configurations is also 200.
- The length of the personalized configuration is limited to 64 k.
- Currently, only one personalized configuration can be bound to an instance.
- Personalized configuration is only effective for the layer-7 HTTP/HTTPS listener of the CLB.
CLB personalized configuration parameters description
The current CLB personalized configuration supports the following fields:
| Configuration fields | Default/recommended values | Parameter Range | Description |
|---|---|---|---|
ssl_protocols |
TLSv1 TLSv1.1 TLSv1.2 |
TLSv1 TLSv1.1 TLSv1.2 |
The TLS protocol version to use. |
| ssl_ciphers | See below | See below | Cipher suite. |
| client_header_timeout | 60s | [30-120]s | Get the timeout period in the Client request header. If the timeout period expires, return 408. |
| client_header_buffer_size | 4k | [1-256]k | The default Buffer size for storing the Client request header. |
| client_body_timeout | 60s |
[30-120]s |
The timeout for obtaining the client request body does not refer to the duration of obtaining the entire body, but refers to the timeout for a period of idle time without transmitting data. If the timeout occurs, 408 is returned. |
client_max_body_size |
60M |
[1-10240]M |
- The default configuration range is 1 M-256 M, you can configure it directly. - The maximum supported speed is 10,240 M, or 10 G. When the configuration range of client_max_body_size is greater than 256M, the value of proxy_request_buffering must be set to off. |
| keepalive_timeout | 75s | [0-3600]s | Client-Server long connection persistence time: if set to 0, then long connection is disabled. |
| add_header | User-defined additions | - | Returns specific header fields to the client in the format of add_header xxx yyy. |
| more_set_headers | User-defined additions | - | Returns specific header fields to the client in the format of more_set_headers "A:B". |
| proxy_connect_timeout | 4s | [4-120]s | Upstream backend connection timeout. |
| proxy_read_timeout | 60s | [30-3600]s | Timeout for reading upstream backend response. |
| proxy_send_timeout | 60s | [30-3600]s | The timeout for sending requests to the upstream backend. |
| keepalive_requests | 100 | [1-10000] | The maximum number of requests that can be sent on a long Client-Server connection. |
| proxy_buffer_size | 4k |
[1-32]k |
For the size of the Server response header, by default, it is the size of the single buffer set in proxy_buffer. When using proxy_buffer_size, proxy_buffers must be set at the same time. |
| proxy_buffers | 8?4k | [3-8]?[4-16]k | Number of buffers and buffer size. |
proxy_request_buffering |
on |
on, off |
- On means caching the client request body: CLB will cache the request and forward it to the backend CVM in blocks after receiving all requests. - Off means not caching the client request body: After receiving the request, CLB immediately forwards it to the backend CVM, which will cause certain performance pressure on the backend CVM. |
proxy_set_header |
X-Real-Port $remote_port |
- X-Real-Port $remote_port - X-clb-stgw-vip $server_addr - Stgw-request-id $stgw_request_id - X-Forwarded-Port?$vport - X-Method $request_method - X-Uri?$uri |
- X-Real-Port $remote_port indicates the client port. - X-clb-lbid $lbid represents the LBID of the CLB, which is the identifier of the CLB instance. - Stgw-request-id $stgw_request_id indicates the request ID (used internally by CLB). - X-Forwarded-Port indicates the port of the CLB listener. - X-Method indicates the client request method. - X-Uri represents the client request path URI. |
| send_timeout | 60s | [1-3600]s | The timeout for the server to transmit data to the client is the interval between two consecutive data transmissions, not the entire request transmission time. |
| ssl_verify_depth | 1 | [1, 10] | Sets the verification depth in the client certificate chain. |
| proxy_redirect | http:// https:// |
http://?https:// | When the response returned by the upstream server is a redirect or refresh request (For example, the HTTP response code is 301 or 302), proxy_redirect resets the http in the Location or Refresh field of the HTTP header to https to achieve a secure jump. |
| http2_max_field_size | 4k | [1-256]k | Limit the maximum size of the HPACK compressed request header field ( Size ). |
| error_page | - |
error_page?code?[?=?[response]]?uri | When a specific error code (Code) occurs, a predefined URI can be displayed, and the default status code (Response) is 302. The URI must be a path beginning with / . |
| proxy_ignore_client_abort | off | on, off | When the client actively disconnects from the CLB without waiting for a response result, configure whether the connection between the CLB and the backend server is disconnected. |
ssl_ciphers configuration instructions
When configuring the ssl_ciphers cipher suite, the format must be consistent with the format used by OpenSSL. The algorithm list is one or more <cipher strings> Multiple algorithms are separated by “:”. ALL means all algorithms, “!” means that the algorithm is not enabled, and “+” means that the algorithm is placed last.
The default encryption algorithm that is disabled is: . aNULL:! eNULL:! EXPORT:! DES:! RC4:! MD5:! PSK:! DHE.
Default Value:
ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:AES:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!DHE:3DES;
Parameter Range:
ECDH-ECDSA-AES128-SHA256:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:SRP-DSS-AES-256-CBC-SHA:SRP-AES-128-CBC-SHA:ECDH-RSA-AES128-SHA256:DH-RSA-AES128-SHA256:DH-RSA-CAMELLIA128-SHA:DH-DSS-AES256-GCM-SHA384:DH-RSA-AES256-SHA256:AES256-SHA256:SEED-SHA:CAMELLIA256-SHA:ECDH-RSA-AES256-SHA384:ECDH-ECDSA-AES128-GCM-SHA256:DH-RSA-AES128-SHA:DH-RSA-AES128-GCM-SHA256:DH-DSS-AES128-SHA:ECDH-RSA-AES128-SHA:DH-DSS-CAMELLIA256-SHA:SRP-AES-256-CBC-SHA:DH-DSS-AES128-SHA256:SRP-RSA-AES-256-CBC-SHA:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-RSA-AES256-GCM-SHA384:DH-DSS-AES256-SHA256:ECDH-ECDSA-AES256-SHA384:AES128-SHA:DH-DSS-AES128-GCM-SHA256:AES128-SHA256:DH-RSA-SEED-SHA:ECDH-ECDSA-AES128-SHA:IDEA-CBC-SHA:AES128-GCM-SHA256:DH-RSA-CAMELLIA256-SHA:CAMELLIA128-SHA:DH-RSA-AES256-GCM-SHA384:SRP-RSA-AES-128-CBC-SHA:SRP-DSS-AES-128-CBC-SHA:ECDH-RSA-AES128-GCM-SHA256:DH-DSS-CAMELLIA128-SHA:DH-DSS-SEED-SHA:AES256-SHA:DH-RSA-AES256-SHA:kEDH+AESGCM:AES256-GCM-SHA384:DH-DSS-AES256-SHA:HIGH:AES128:AES256:AES:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!DHE
CLB personalization configuration example
- Log in to the CLB console and click Personalized Configuration in the left sidebar.
- On the Personalization Configuration page, click Create.
- In the pop-up Configuration Information dialog box, fill in the configuration name and code configuration item. The code configuration item ends with ;. After completing the configuration, click Finish.
Note:
Default configuration code example:
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;client_header_timeout 60s;client_header_buffer_size 4k;client_body_timeout 60s;client_max_body_size 60M;keepalive_timeout 75s;add_header xxx yyy;more_set_headers "A:B";proxy_connect_timeout 4s;proxy_read_timeout 60s;proxy_send_timeout 60s;
- Return to the Personalization Configuration page and click Bind to Instance in the Operation column on the right.
- In the Bind to Instance dialog box that pops up, select the CLB instance to be bound and click Submit.
- After binding the instance, click the personalized configuration ID just configured on the Personalized Configuration page to enter the details page, and click the Bind to Instance tab to view the CLB instance just bound.