Enterprise · Edge resilience

TLS and multi-region patterns

Turn on TLS for every edge link in one change, then combine relays and bootstrap files to fit each region.

Video coming soon

Before you start

You can change the backend config and restart it.
You have a certificate for the backend's gRPC host name. A certificate from a private CA works, if every edge has the CA file.
TLS and the direct pattern are Core. Relays and bootstrap files need the edge_resilience entitlement.

Encrypt the edge link

By default the gRPC link between an edge and the backend is plaintext. The edge sends its client ID and API key on that link, and receives your targeting rules, so encrypt it in production.

In the backend config, set grpc_tls_cert_file and grpc_tls_key_file to PEM files. Set both or neither. The listener then serves TLS only. An unreadable or invalid file stops the backend at startup.
On every edge, use an https:// address for backend_grpc, such as https://backend.junipermarket.example:50051. The certificate must be valid for that host.
When the certificate comes from a private CA, set [grpc] tls_ca_file on the edge. An empty value trusts the built-in web PKI roots, not the operating system store.

Backend config.toml

grpc_addr = "0.0.0.0:50051"
grpc_tls_cert_file = "/etc/fluxgate/grpc.crt"
grpc_tls_key_file = "/etc/fluxgate/grpc.key"

Edge config.toml

backend_grpc = "https://backend.junipermarket.example:50051"

[grpc]
tls_ca_file = "/etc/fluxgate/ca.pem"

The bootstrap fetch does not use [grpc] tls_ca_file. Relay listeners have their own TLS settings, described in Relay edges.

Choose a topology

Flag changes always go through the backend. An edge far from it sees a change after one cross-region hop. During an outage, the config age grows and the fleet view shows it.

Pattern	Use it when	Settings
Direct	One region, few edges	Every edge streams from the backend and sets `snapshot.dir`
Regional relays	Several regions, or many edges in one	Two registered relays per region behind a TCP load balancer. The region's edges set `backend_grpc` to the balancer. Relays and edges set `snapshot.dir`. The backend sees two streams per region
Bootstrap from storage	A region must start during a control-plane outage	A job exports the snapshot every few minutes to a regional bucket. Edges set `bootstrap`, `trusted_keys` and `max_age_secs`
Air-gapped site	A site has no path to the backend at times	Relays or edges with `snapshot.dir`, plus a bootstrap file that you verify and move to the site, at the `bootstrap` path

The patterns combine. A large region often runs relays, plus a bootstrap bucket for the relays and for any edge that is not behind a relay.

Example: Juniper Market

Juniper Market runs its backend in eu-west and serves shoppers in Europe and North America.

Region	Topology	Why
eu-west	Direct: `edge-eu-1` and the storefront edges stream from the backend	Same region as the backend, few edges
eu-central	Two relays, `relay-eu-1` and `relay-eu-2`, behind a balancer; worker edges are children	Dozens of order workers that scale up and down
us-east	Direct edges with `bootstrap` from a bucket in us-east	A new edge must start even if the transatlantic link fails

Every edge in all three regions sets snapshot.dir, and every link uses TLS.

Good to know

Each relay serves one team. A region with edges of three teams needs relays per team.
The bootstrap file of a team is the same in every region. Publish it to a bucket in each region, so an outage of one region's storage does not affect the others.
Run the outage drill in each region after you change its topology.

Watch your edges and know what to do in an outage: Monitoring and outages.