[Yandex Cloud documentation](../../index.md) > [Yandex Application Load Balancer](../index.md) > [Step-by-step guides](index.md) > Backend groups > Creating a backend group # Creating a backend group To create a [backend group](../concepts/backend-group.md): {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) where you want to create a backend group. 1. Navigate to **Application Load Balancer**. 1. In the left-hand panel, select ![image](../../_assets/console-icons/cubes-3-overlap.svg) **Backend groups**. 1. Click **Create backend group**. 1. Specify the backend group name. 1. Select the [backend group type](../concepts/backend-group.md#group-types): * `HTTP`: For HTTP or HTTPS traffic. * `gRPC`: For HTTP or HTTPS traffic with [gRPC](https://en.wikipedia.org/wiki/GRPC). * `Stream`: For unencrypted TCP traffic or TCP traffic with TLS encryption support. 1. Optinally, enable [session affinity](../concepts/backend-group.md#session-affinity). `HTTP` and `gRPC` backend groups support the following session affinity modes: * `By IP address`. * `By HTTP header`. * `By cookie`. `Stream` backend groups support session affinity by client [IP address](../../vpc/concepts/address.md). {% note info %} Currently, session affinity only works for a single active backend in a group, containing at least one target group and using the `MAGLEV_HASH` [load balancing mode](../concepts/backend-group.md#balancing-mode). {% endnote %} 1. Under **Backends**, click **Add**. Specify the backend settings: * Backend **Name**. * **Weight**: Backend weight in traffic distribution. If this option is disabled, the backend weight will be 0 and its endpoints will not be receiving traffic. * Backend **Type**: `Target group` for Application Load Balancer [target groups](../concepts/target-group.md) or `Bucket` for Object Storage [buckets](../../storage/concepts/bucket.md). This option works for `HTTP` backend groups only. `gRPC` and Stream group backends have the `Target group` backend type. For more on backend types, see [Backend types](../concepts/backend-group.md#types). * The settings described below only work for **Target group** backends: * Under **Load balancing settings**: * **Balancing mode**: [Load balancing mode](../concepts/backend-group.md#balancing-mode). * **Panic mode threshold**: Healthy endpoint threshold triggering [panic mode](../concepts/backend-group.md#panic-mode) when the load balancer distributes requests across all endpoints, regardless of their health status. * **Locality aware routing**: Share of incoming traffic the load balancer node will route to its availability zone backends. The remaining traffic is split equally between the other zones. For more information, see [Locality aware routing](../concepts/backend-group.md#locality). * **Strict locality**: If this option is enabled, the load balancer will return `503 Service Unavailable` if no application backends are operational in the request’s originating availability zone. * Under **Protocol settings**: * For a `HTTP` backend group: * **HTTP/2**: With this option enabled, the load balancer will use the HTTP/2 protocol when routing requests to `HTTP` group backends. By default, the load balancer uses the HTTP/1.1 protocol. `gRPC` backend groups only support the HTTP/2 protocol. * **Protocol**: Backend connection protocol, e.g., `HTTP` without encryption or `HTTPS` with TLS encryption. For `HTTPS`, specify: * **SNI**. SNI domain name for TLS connections. * **Trusted root certificate**. Specify the [root CA](https://en.wikipedia.org/wiki/Root_certificate) for the certificate chain installed on backend endpoints. The L7 load balancer supports [IETF](https://www.ietf.org/) (RFC [2459](https://www.ietf.org/rfc/rfc2459.txt)/[3280](https://www.ietf.org/rfc/rfc3280.txt)/[5280](https://www.ietf.org/rfc/rfc5280.txt)) compliant [X.509 certificates](https://en.wikipedia.org/wiki/X.509). For [ECDSA](https://en.wikipedia.org/wiki/ECDSA) certificates, only the P-256 curve is supported. * For a `gRPC` backend group: * **Protocol**: Backend connection protocol, e.g., `Plain-text` or `Encrypted`. For the encrypted protocol, specify **SNI** and **Trusted root certificate** as shown above. * For a `Stream` backend group: * **PROXY protocol**: With this option enabled, the load balancer will send its client connection metadata, e.g., its IP address, to the backend via [HAProxy](https://www.haproxy.org/download/1.9/doc/proxy-protocol.txt) protocol. * **Protocol**: Backend connection protocol, e.g., `Plain-text` or `Encrypted`. For the encrypted protocol, specify **SNI** and **Trusted root certificate** as shown above. * The following settings only work for **Bucket** backends in **HTTP** backend groups: * **Bucket ID format**: `List` or `ID`. * **Bucket**: Select a bucket from the list or specify its ID. * Under **HTTP health check**, **gRPC health check**, or **Stream health check** specify: * **Timeout, s**: Response timeout. Maximum connection time. * **Interval**: Health check request interval. * **Healthy threshold**: Number of consecutive successful checks required before considering the endpoint healthy. The load balancer ignores this setting at start, conducting one health check to identify the endpoint as healthy. * **Unhealthy threshold**: Number of consecutive failed checks required before considering the endpoint unhealthy. The load balancer ignores this setting when receiving `503 Service Unavailable` from a backend, following which it is considered unhealthy right away. * **Port**. * **Type**: Health check protocol, e.g., `HTTP`, `gRPC`, or `Stream`. The health check protocol does not need to match the backend group type. Also specify: * For the `HTTP` type: * **Path**: Endpoint request URI path. * **Authority**: HTTP/1.1 `Host` or HTTP/2 `:authority` header of the backend endpoint health check requests. * **HTTP/2**: Use HTTP v2 protocol. * **HTTP codes**: HTTP status codes deemed valid during a backend health check. * For the `gRPC` type: * **Service name**: Name of the gRPC service you want to check. If no service is specified, the system will check the backend overall health. * For the `Stream` type: * **Send**: Data sent to the endpoint for a health check. * **Receive**: Data the endpoint must return to pass the health check. {% note alert %} If all backends with health checks enabled in an availability zone fail those checks, traffic will no longer route to that zone, even if functional backends without health checks remain. We recommend configuring [health checks](../concepts/backend-group.md#health-checks) for all backends. {% endnote %} To add a health check, at the bottom of the backend section, click **Add health check** and specify the check settings. To remove a health check, click ![image](../../_assets/console-icons/ellipsis.svg) next to the **HTTP health check**, **gRPC health check**, or **Stream health check** title, and select **Delete**. 1. Click **Create**. - CLI {#cli} If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install). The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id ` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions. {% note info %} You can create a `gRPC` backend group in the [management console](https://console.yandex.cloud) or using Terraform. {% endnote %} 1. See the description of the [CLI](../../cli/index.md) command for creating a backend group: ```bash yc alb backend-group create --help ``` 1. Create a backend group by running this command: ```bash yc alb backend-group create ``` Result: ```text id: a5dg2cv4ngne******** name: test-backend-group folder_id: aoerb349v3h4******** created_at: "2021-02-11T20:46:21.688940670Z" ``` 1. Add a backend and a health check to the group. {% note alert %} If all backends with health checks enabled in an availability zone fail those checks, traffic will no longer route to that zone, even if functional backends without health checks remain. We recommend configuring [health checks](../concepts/backend-group.md#health-checks) for all backends. {% endnote %} All backends within a group must be of the same [type](../concepts/backend-group.md#group-types): `HTTP`, `gRPC`, or `Stream`. {% cut "HTTP backend" %} Run this command: ```bash yc alb backend-group add-http-backend \ --backend-group-name \ --name \ --weight \ --port \ --target-group-id= \ --panic-threshold 90 \ --http-healthcheck port=80,healthy-threshold=10,unhealthy-threshold=15,expected-statuses=211,\ timeout=10s,interval=2s,host=,path= ``` Where: * `--name`: The name of the backend you want to add or update. * `--panic-threshold`: Panic mode threshold. * `--http-healthcheck`: Health check settings: * `port`: Port. * `healthy-threshold`: Healthy threshold. * `unhealthy-threshold`: Unhealthy threshold. * `expected-statuses`: HTTP status code deemed valid during a backend health check. You can add multiple values separated by a comma: `expected-statuses=201,expected-statuses=205,expected-statuses=302`. You can use HTTP codes in the range between `100` and `599`. If this setting is not specified, the response code will be `200`. * `timeout`: Maximum connection time. * `interval`: Interval. * `host`: Host address. * `path`: Path. Result: ```text id: a5dqkr2mk3rr******** name: folder_id: aoe197919j8e******** http: backends: - name: backend_weight: "1" load_balancing_config: panic_threshold: "90" port: "80" target_groups: target_group_ids: - a5d2iap3nue9******** healthchecks: - timeout: 10s interval: 2s healthy_threshold: "10" unhealthy_threshold: "15" healthcheck_port: "80" http: host: path: created_at: "2021-02-11T20:46:21.688940670Z" ``` {% endcut %} {% cut "gRPC backend" %} Run this command: ```bash yc alb backend-group add-grpc-backend \ --backend-group-name \ --name \ --weight \ --port \ --target-group-id= \ --panic-threshold 90 \ --grpc-healthcheck port=80,healthy-threshold=10,unhealthy-threshold=15,\ timeout=10s,interval=2s,service-name= ``` Where: * `--panic-threshold`: Panic mode threshold. * `--grpc-healthcheck`: Resource health check settings: * `port`: Port. * `healthy-threshold`: Healthy threshold. * `unhealthy-threshold`: Unhealthy threshold. * `timeout`: Maximum connection time. * `interval`: Interval. * `service-name`: Name of the gRPC service you want to check. If no service is specified, the system will check the backend overall health. Result: ```text id: a5dqkr2mk3rr******** name: folder_id: aoe197919j8e******** grpc: backends: - name: backend_weight: "12" load_balancing_config: panic_threshold: "90" port: "80" target_groups: target_group_ids: - a5d2iap3nue9******** healthchecks: - timeout: 10s interval: 2s healthy_threshold: "10" unhealthy_threshold: "15" healthcheck_port: "80" grpc: service_name: created_at: "2023-06-17T13:04:08.567141292Z" ``` {% endcut %} {% cut "Stream backend" %} Run this command: ```bash yc alb backend-group add-stream-backend \ --backend-group-name \ --name \ --weight \ --port \ --target-group-id= \ --panic-threshold 90 \ --enable-proxy-protocol \ --keep-connections-on-host-health-failure \ --stream-healthcheck port=80,healthy-threshold=10,unhealthy-threshold=15,\ timeout=10s,interval=2s,send-text=,receive-text= ``` Where: * `--panic-threshold`: Panic mode threshold. * `--enable-proxy-protocol`: With this option enabled, the load balancer will send its client connection metadata, e.g. its IP address, to the backend via [HAProxy](https://www.haproxy.org/download/1.9/doc/proxy-protocol.txt) protocol. If you do not set specific values for this option, the load balancer will only send its IP address to the backend. * `--keep-connections-on-host-health-failure`: Keeps the connection alive even if the health check fails. * `--stream-healthcheck`: Health check settings: * `port`: Port. * `healthy-threshold`: Healthy threshold. * `unhealthy-threshold`: Unhealthy threshold. * `timeout`: Maximum connection time. * `interval`: Interval. * `send-text`: Data sent to the endpoint for a health check. * `receive-text`: Data the endpoint must return to pass the health check. Result: ```text id: ds77tero4f5******** name: folder_id: b1gu6g9ielh6******** stream: backends: - name: backend_weight: "1" port: "80" target_groups: target_group_ids: - ds7eof3r2cte******** healthchecks: - timeout: 10s interval: 2s healthy_threshold: "10" unhealthy_threshold: "15" healthcheck_port: "80" stream: send: text: receive: text: enable_proxy_protocol: true created_at: "2022-04-06T09:17:57.104324513Z" ``` {% endcut %} - Terraform {#tf} With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed. Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license. For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md). If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform). To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method. 1. In the Terraform configuration file, describe the resource you want to create: ```hcl resource "yandex_alb_backend_group" "test-backend-group" { name = "" session_affinity { connection { source_ip = } } stream_backend { name = "" weight = 1 port = 80 target_group_ids = [""] load_balancing_config { panic_threshold = 90 } enable_proxy_protocol = true healthcheck { timeout = "10s" interval = "2s" healthy_threshold = 10 unhealthy_threshold = 15 keep_connections_on_host_health_failure = stream_healthcheck { send = "" receive = "" } http_healthcheck { path = "" host = "" expected_statuses = [] } } } } ``` Where: * `yandex_alb_backend_group`: Backend group settings: * `name`: Backend group name. * `session_affinity`: Optional [session affinity](../concepts/backend-group.md#session-affinity) settings. {% note info %} Currently, session affinity only works for a single active backend in a group, containing at least one target group and using the `MAGLEV_HASH` [load balancing mode](../concepts/backend-group.md#balancing-mode). {% endnote %} * `connection`: Session affinity by the `source_ip` [IP address](../../vpc/concepts/address.md). It can be either `true` or `false`. You can also use `cookie` or `header` session affinity modes, but you can only specify one mode. If the backend group is of the `Stream` type, i.e., it consists of the `stream_backend` resources, you can only use the `connection` mode for session affinity. * `http_backend`, `grpc_backend`, and `stream_backend`: [Backend type](../concepts/backend-group.md#group-types). All backends within a group must match the same type: `HTTP`, `gRPC`, or `Stream`. Backend parameters: * `name`: Backend name. * `port`: Backend port. * `weight`: Backend weight. * `target_group_ids`: [Target group](../concepts/target-group.md) ID. To get a list of available target groups, run the `yc alb target-group list` [CLI](../../cli/index.md) command. * `load_balancing_config`: Balancing parameters: * `panic_threshold`: Panic mode threshold. * `enable_proxy_protocol`: With this option enabled, the load balancer will send its client connection metadata, e.g. its IP address, to the backend via [HAProxy](https://www.haproxy.org/download/1.9/doc/proxy-protocol.txt) protocol. If you do not set specific values for this option, the load balancer will only send its IP address to the backend. This option is only available for `Stream` type backends. * `healthcheck`: Health check settings: * `timeout`: Maximum connection request timeout. * `interval`: Interval. * `healthy_threshold`: Healthy threshold. * `unhealthy_threshold`: Unhealthy threshold. * `keep_connections_on_host_health_failure`: This option maintains connections open even if the target host status changes to `Unhealthy`. * `http_healthcheck`: `HTTP` health check settings: * `path`: Path, e.g., `/health`. * `host`: Host address, e.g., `example.com`. * `expected_statuses`: List of HTTP status codes corresponding to the `Healthy` status, e.g., `[200, 201, 202]`. * `grpc_healthcheck`: `gRPC` health check settings: * `service_name`: Name of the gRPC service you want to check. If no service is specified, the system will check the backend overall health. * `stream_healthcheck`: `Stream` health check settings: * `send`: Data sent to the endpoint for a health check. * `receive`: Data the endpoint must return to pass the health check. {% note alert %} If all backends with health checks enabled in an availability zone fail those checks, traffic will no longer route to that zone, even if functional backends without health checks remain. We recommend configuring [health checks](../concepts/backend-group.md#health-checks) for all backends. {% endnote %} For more information about `yandex_alb_backend_group` properties, see [this Terraform provider guide](../../terraform/resources/alb_backend_group.md). 1. Create the resources: 1. In the terminal, navigate to the configuration file directory. 1. Make sure the configuration is correct using this command: ```bash terraform validate ``` If the configuration is valid, you will get this message: ```bash Success! The configuration is valid. ``` 1. Run this command: ```bash terraform plan ``` You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration. 1. Apply the configuration changes: ```bash terraform apply ``` 1. Type `yes` and press **Enter** to confirm the changes. Terraform will create all the required resources. You can check new resources in the [management console](https://console.yandex.cloud) or using this CLI command: ```bash yc alb backend-group list ``` {% note warning "Timeouts" %} The Terraform provider limits operations with Application Load Balancer backend groups to 10 minutes. Operations in excess of this time will be interrupted. {% cut "How do I modify these limits?" %} Add a `timeouts` section to the backend group description: ```hcl resource "yandex_alb_backend_group" "" { ... timeouts { create = "60m" update = "60m" delete = "60m" } } ``` {% endcut %} {% endnote %} - API {#api} Use the [create](../api-ref/BackendGroup/create.md) REST API method for the [BackendGroup](../api-ref/BackendGroup/index.md) resource or the [BackendGroupService/Create](../api-ref/grpc/BackendGroup/create.md) gRPC API call. {% endlist %} ### Useful links {#see-also} * [Tips for configuring Yandex Application Load Balancer health checks](../concepts/best-practices.md)