Load Balancer Listeners

Overview

A listener defines a protocol and port combination on which a load balancer accepts inbound connections. A single load balancer supports multiple listeners simultaneously — e.g., an HTTP listener on port 80 and an HTTPS listener on port 443 can share the same load balancer VIP. Each listener routes traffic to its own default pool.

Prerequisites

An active NxtSight account with appropriate permissions
Access to the NxtSight Dashboard or CLI configured with credentials
API credentials sourced (source openrc.sh)

Supported Protocols

Protocol	Port	Use Case
`HTTP`	Typically 80	Unencrypted web application traffic
`TERMINATED_HTTPS`	Typically 443	TLS offloaded at the load balancer; backend receives plain HTTP
`HTTPS`	Typically 443	TLS passthrough; load balancer does not decrypt traffic
`TCP`	Any	Any TCP service — databases, custom protocols
`UDP`	Any	UDP-based services — DNS, game servers
`SCTP`	Any	SCTP-based telecommunications traffic

Add a Listener

Dashboard
CLI

Open listener creation

Navigate to Network > Load Balancers, select your load balancer, and click the Listeners tab. Click Create Listener.

Configure the listener

Field	Description
Name	Display name (e.g., `listener-https`)
Protocol	Select from supported protocols above
Protocol Port	Port on which the listener accepts connections
Connection Limit	Maximum concurrent connections (-1 for unlimited)
Default TLS Container	For TERMINATED_HTTPS — select the certificate from NxtSight Key Manager

Associate a pool

After creating the listener, associate it with a backend pool. Select an existing pool or create a new one from the Pools tab.

Listener is ACTIVE and routing to the associated pool.

Create HTTP listener

openstack loadbalancer listener create \
  --name listener-http \
  --protocol HTTP \
  --protocol-port 80 \
  prod-web-lb

Create HTTPS listener with TLS termination

openstack loadbalancer listener create \
  --name listener-https \
  --protocol TERMINATED_HTTPS \
  --protocol-port 443 \
  --default-tls-container-ref <key-manager-container-ref> \
  prod-web-lb

Create TCP listener

openstack loadbalancer listener create \
  --name listener-db \
  --protocol TCP \
  --protocol-port 5432 \
  prod-db-lb

TLS Termination (TERMINATED_HTTPS)

TLS termination offloads certificate processing at the load balancer and forwards plain HTTP to backend members — reducing CPU overhead on application servers.

Store certificate in Key Manager

Store your TLS certificate and private key in NxtSight Key Management:

Create secret container with certificate and key

openstack secret store \
  --name tls-cert \
  --payload-content-type "application/pkix-cert" \
  --payload "$(cat cert.pem | base64)"

openstack secret store \
  --name tls-key \
  --payload-content-type "application/octet-stream" \
  --payload "$(cat key.pem | base64)"

openstack secret container create \
  --name prod-tls-container \
  --type certificate \
  --secret "certificate=$(openstack secret list --name tls-cert -c 'Secret href' -f value)" \
  --secret "private_key=$(openstack secret list --name tls-key -c 'Secret href' -f value)"

Create listener with certificate container

Create TERMINATED_HTTPS listener

CONTAINER_REF=$(openstack secret container show prod-tls-container -c container_ref -f value)

openstack loadbalancer listener create \
  --name listener-https \
  --protocol TERMINATED_HTTPS \
  --protocol-port 443 \
  --default-tls-container-ref $CONTAINER_REF \
  prod-web-lb

Listener is ACTIVE and accepting encrypted connections on port 443.

Manage Listeners

openstack loadbalancer listener list \
  --loadbalancer prod-web-lb

openstack loadbalancer listener show listener-https

openstack loadbalancer listener set listener-http \
  --connection-limit 10000

openstack loadbalancer listener delete listener-http

Next Steps

Pools

Configure backend pools and member management for each listener.

Health Monitors

Set up health checks for pools backing your listeners.

Floating IP Assignment

Expose the load balancer VIP publicly after configuring listeners.

Troubleshooting

Resolve TLS handshake failures and protocol-specific issues.

Core Services

Other Services

Load Balancer Listeners

Overview

Supported Protocols

Add a Listener

Open listener creation

Configure the listener

Associate a pool

TLS Termination (TERMINATED_HTTPS)

Store certificate in Key Manager

Create listener with certificate container

Manage Listeners

Next Steps

Pools

Health Monitors

Floating IP Assignment

Troubleshooting

​Overview

​Supported Protocols

​Add a Listener

Open listener creation

Configure the listener

Associate a pool

​TLS Termination (TERMINATED_HTTPS)

Store certificate in Key Manager

Create listener with certificate container

​Manage Listeners

​Next Steps

Pools

Health Monitors

Floating IP Assignment

Troubleshooting

Overview

Supported Protocols

Add a Listener

TLS Termination (TERMINATED_HTTPS)

Manage Listeners

Next Steps