How does Azure AppGateway connection draining work with cookie-based affinity?

twilson 20

We are looking to deploy an Azure scale set in combination with an AppGateway to take advantage of the scale in/out capabilities for our application VM's. The application does require session affinity so we would enable the cookie-based load balancing capabilities of the AppGateway. What is not entirely clear to me is how the connection draining works ... specifically does the configurable timeout value get reset each time a new request is received for an existing managed session?

For example, lets say the timeout value is set to 600s (10 minutes) and at time 'x', a scale-in operation designates a particular VM to be deregistered. Subsequently at time 'x + 9 minutes', a new request associated with an existing session on this VM is received by the AppGateway and passed on to the VM. At this point, does the timeout value get reset so that the VM would not be shutdown until 'x + 19 minutes' OR does the VM still get shutdown at 'x + 10 minutes'? Ideally we want the former so that the VM would not get shutdown until at least 10 minutes after the last request to the application VM.

1 answer

KapilAnanth-MSFT 45,031 Reputation points Microsoft Employee

2024-09-25T07:34:35.62+00:00
@twilson ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to know if Session Affinity would impact the Connection Draining timeout value.

Per your observation, even with Connection Draining enabled, a new request would land on the deregistering instances when Session Affinity enabled.

The only exception to this are requests bound for deregistering instances because of gateway-managed session affinity and will continue to be forwarded to the deregistering instances

I doubt this will any impact on the connection draining's timeout value. The App gateway will continue to send the traffic only till "x+10"th minute.

Nevertheless, I shall confirm this internally once again and update this thread soon.

P.S:

In your verbatim, I see you have mentioned "shutdown" of the VMs

Please note that App Gateway will only stop sending connections to the VM

App gateway does not control the "shut down" the VM by itself

Cheers,

Kapil
Please sign in to rate this answer.
twilson 20 Reputation points

2024-09-25T14:21:44.4233333+00:00

@KapilAnanth-MSFT appreciate you looking into this. Just wanted to provide a little more context as to what I am looking for. As I said in my original post, our application requires session affinity ... so ideally once a user is logged in and using our web application, we would want to ensure that they can continue to use it until they log off (or we auto log them off). If the App Gateway stops sending requests to a VM that the user is currently utilizing at 'x + 10', then potentially the user session would be interrupted and they would receive an error if they are still using the system. Alternatively if the App Gateway only stops sending requests to the VM 10 minutes after the last request it receives, then we can guarantee that the user session will continue until they are done since we auto-logoff the user after 10 minutes of in-activity.

KapilAnanth-MSFT 45,031 Reputation points Microsoft Employee

2024-09-26T03:40:58.4033333+00:00

@twilson ,

Thank you for explaining the requirement.

I just got a confirmation that with Session Affinity, the “new” requests are sent to the deregistering backend server until the connection drain times out.

The connection draining timeout is not affected under any circumstances.

Please let us know if we can be of any further assistance here.

Thanks,

Kapil

Please Accept an answer if correct.

Original posters help the community find answers faster by identifying the correct answer.

twilson 20 Reputation points

2024-09-26T21:56:46.04+00:00

@KapilAnanth-MSFT thanks for the follow up ... so sounds like the App Gateway will stop sending requests to the deregistered VM at 'x + 10 minutes' and would presumably send any subsequent requests to a different VM. So in our case, if a user is still actively using the application past 10 minutes (and was on that deregistered VM), they will start being redirected to a different VM ... which in our case will unfortunately result in errors. Any suggestions on how we might be able to avoid this situation (while still being able to take advantage of the auto scaling capabilities of VMSS)?

One other minor point, you mentioned in your original response that the App Gateway does not control the "shut down" of the VM ... I assume, however, there must be some interaction between the App Gateway and the VMSS to perform the shut down of a deregistered VM at the appropriate time?

KapilAnanth-MSFT 45,031 Reputation points Microsoft Employee

2024-09-27T05:28:31.8666667+00:00

@twilson ,

Yes.

I am not aware of any out of the box solution for this from Platform level.

A better approach would be to control this in the Application code.

Wrt, "there must be some interaction between the App Gateway and the VMSS to perform the shut down of a deregistered VM at the appropriate time?"

Not exactly

Azure App Gateway uses the health probe response to finalize if a backend is healthy or not.

A VM could be running (not deregistering) and still fail the health probe request (send unexpected HTTP response status code or no response at all) and App gateway will consider this as unhealthy

It does not have awareness of if the VM is actually shutting down and thus not responding or the VM is running perfectly but still not responding

All it sees is the HTTP Response

Thanks,

Kapil

Please don’t forget to close the thread by clicking Accept the answer wherever the information provided helps you, as this can be beneficial to other community members.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How does Azure AppGateway connection draining work with cookie-based affinity?

1 answer

Your answer