View source for Oracle HYOK with CipherTrust - Using the OCI Application Load Balancer for CipherTrust High Availability

= Introduction  =

In previous articles, we explored integrating Thales CipherTrust Manager with Oracle Cloud Infrastructure (OCI) to enable Hold Your Own Key (HYOK) capabilities, both with and without an API Gateway. While clustering CipherTrust Managers provides a level of recoverability, it does not ensure accurate high availability from a networking perspective. 

The CipherTrust Manager does not natively support a virtual IP (VIP) for seamless failover between nodes.

This tutorial addresses this limitation by introducing the OCI Application Load Balancer (ALB) to provide high network availability for CipherTrust Manager instances. 
By placing the clustered CipherTrust Managers behind an OCI ALB, we can ensure continuous availability and fault tolerance for external key management services in OCI, even in the event of a node failure or data centre disruption. 

[[File:b6c494ede2fe664f74ef3de9d0b1c60d.png|800px]]

This tutorial will walk you through the architecture, the configuration, and the considerations for deploying this setup in your OCI environment.

= The steps =

* [ ] STEP 01: Review the previous OCI and Thales HYOK Architectures
* [ ] STEP 02: Creating the Application Load Balancer
* [ ] STEP 03: Oracle HYOK with CipherTrust – With API Gateway and Application Load Balancer
* [ ] STEP 04: Oracle HYOK with CipherTrust – With Application Load Balancer (only)
* [ ] STEP 05: An overview of all the OCI and Thales HYOK Architectures to make the CipherTrust Manager Highly Available

= STEP 01: Review the previous OCI and Thales HYOK Architectures =

Before introducing the OCI Application Load Balancer into the architecture, it's essential to revisit the existing OCI and Thales CipherTrust HYOK deployments. 
In earlier implementations, we covered two primary patterns:

* [[https://docs.oracle.com/en/learn/oci-hyok-cckm-with-api-gw/ '''HYOK with CipherTrust Manager and API Gateway''']]
* [[https://docs.oracle.com/en/learn/oci-hyok-cckm-without-api-gw/ '''HYOK with CipherTrust Manager without API Gateway''']]

This section will briefly summarize these two designs and highlight their strengths and limitations, setting the foundation for introducing the OCI Application Load Balancer to close the availability gap.

Both architectures relied on clustering multiple CipherTrust Managers to provide recoverability, but they lacked accurate network-level high availability due to the absence of native VIP support in CipherTrust Manager. Each deployment handled key management effectively, but introduced potential single points of failure from a network routing and service accessibility perspective.

[[File:1172079c6ca77700723f480783f2a579.png|800px]]

Before you begin, make sure you have the following in place:

* [[https://docs.oracle.com/en/learn/deploy-thales-cckm-on-oci/ Two or more Thales CipherTrust Manager instances deployed in different Availability Domains or Fault Domains (AND CLUSTERED)]].
* A VCN with appropriate subnets (private or public, depending on your architecture).
* This is where you will place the OCI Load Balancer.
* Certificates (if you're using SSL termination at the ALB).
* This is something we will explain in this tutorial.

= STEP 02: Creating the Application Load Balancer =

To achieve high availability for the Thales CipherTrust Manager at the network layer, we introduce the '''OCI Application Load Balancer (ALB)''' into the architecture. 
The ALB will be a single, resilient access point that intelligently distributes incoming requests across the clustered CipherTrust nodes.

This step will provide an OCI Application Load Balancer that fronts multiple CipherTrust Manager instances. You will configure backend sets, health checks, SSL termination (if applicable), and listener rules tailored to your HYOK deployment—whether you're using the API Gateway or not.

This load balancer setup ensures that the key management service remains reachable even if one of the CipherTrust nodes becomes unavailable, significantly improving the reliability and fault tolerance of your external key management integration with OCI.

==== 1. '''Navigate to the Load Balancers Page''' ====

* Open the '''OCI Console'''.
* Go to '''Networking > Load Balancers'''.

[[File:28fa69560322c57d8400bede97b9e290.png|800px]]

* Click '''Create Load Balancer'''.

[[File:2dde2c34da2dabc95cedb84627e75cec.png|800px]]


* '''Name''': Choose a descriptive name (e.g., <code>Load_Balancer_for_CCKM</code>).
* '''Type''': Choose '''private''' or '''public''', depending on your use case.
* Scroll down

[[File:4ba99bce8d1f390185b0c24a965ba51d.png|800px]]

* '''VCN and Subnet''': Select the VCN and subnet(s) where the ALB will be deployed (in the right compartment).
* Click on '''Next'''.

[[File:b93865a8c8c05e3dca4f49fa94e91ba9.png|800px]]

* '''Policy''': <code>Weighted round robin</code>.
* Leave the backend servers blank; we will configure these later.
* Scroll down.

[[File:3ddce71f0817bb583ea75fb1e738fb5a.png|800px]]

* '''Health Check Policy''': Select HTTP with port 80 for now, we will change this later.
* Scroll down.

[[File:872e1a489ec8f58bdae071f5a799c437.png|800px]]

* '''Backend set Name''': Choose a descriptive name (e.g., <code>CTM_Appliances</code>).
* Click on '''Next'''.

[[File:02582c671f35afe46d63e2c15c006d27.png|800px]]

* '''Listener Name''': Choose a descriptive name (e.g., <code>LISTENER</code>).
* '''Listener Traffic Type and Port''': TCP and port 80, we will change these later.
* Click on '''Next'''.

[[File:f8ead1a7840b8f65da0691d7992a5cdd.png|800px]]

* Leave all the logging settings at their default.
* Click on '''Next'''.

[[File:56a53facf65a64d598b91cdf5b09f9ae.png|800px]]

* Review the selected settings and click on '''Submit'''.

[[File:161d4d9e9f49e0135e1e5f4215be9e28.png|800px]]

* Notice that the Load Balancer will be created.

[[File:4905dc51897dcd04c3af115534e7e649.png|800px]]

* When the load Balancer is created, it will be '''active'''.
* Click on '''Listeners'''to review the listener we need to edit.

[[File:24cb07e7784dc25167ef653445716821.png|800px]]

* Click on '''Backend sets'''to review the Backend set that we will need to edit.
* Also, notice that the health is showing up as '''incomplete'''.
* This is because we still need to add the CTM backend servers to the set.

[[File:07500f3337f24a317b6d54b4d13b7068.png|800px]]

* We need to add a certificate before configuring the listener and the backend set (with SSL).
* Navigate to '''Certificates and ciphers'''.
* Click on '''Add certificate'''.

[[File:dcb982d73f796833c2ce908a96a063b5.png|800px]]

* Ensure you have a valid signed cert and private key created for the Load Balancer.
* In [[https://docs.oracle.com/en/learn/deploy-thales-cckm-on-oci/#task-8-create-a-csr-for-both-thales-cckm-appliances-and-sign-by-the-ca this tutorial ]], I have explained how to create a CSR and use the CTM to sign the cert with its local CA.

[[File:b71f4398e6ca9d48aafe79ea24f7ded5.png|800px]]

* Also, ensure you have the Root CA (Bundle ready).

[[File:1b4c540a9a247be7a5cdc3b421b20565.png|800px]]

* '''Certificate  Name''': Choose a descriptive name (e.g., <code>LB-CTM-CERT</code>).
* Select: '''Paste SSL certificate'''.
* Paste the (signed) SSL Certificate here.

[[File:b947561d33cf25cca0cb8b5525330e66.png|800px]]

* Select: '''Specify CA certificate'''.
* Select: '''Paste CA certificate'''.
* Paste the CA (bundle) Certificate here.

[[File:836223142307c86f5d87a9f3637dac6c.png|800px]]

* Select: '''Specify Private key'''.
* Select: '''Paste Private key'''.
* Paste the Private Key here.
* Click on '''Add certificate'''.

[[File:170e688bcef8dc6e5ccfbf9fcde850ef.png|800px]]

* Notice that the '''work request''' is accepted.
* Click on '''View all work requests'''.

[[File:8349169a028c2834c73539a2e0fcfe7b.png|800px]]

* Notice that the request has succeeded.

[[File:dfc1a499cbacdc88037b5ef5717b2b64.png|800px]]

* Navigate to '''Certificates and ciphers'''.
* Notice that the certificate is added.

[[File:9a295b72f6782d306928b429e4242e7a.png|800px]]

* Navigate to '''Backend sets'''.
* Click on the '''three dots''' to open the menu of the created backend set.
* Click on '''Edit'''.

[[File:7fec33a0b7ec88b3d56d6d9ad1731da7.png|800px]]

* Enable SSL.
* '''Certificate resource:''' Load Balancer managed certificate
* Select the Certificate that you added earlier.
* Click on '''Save changes'''.

[[File:15ccc473a48ec629af4c0ea5f84ed1ca.png|800px]]

* Click on '''Close'''.

[[File:630ad03082fa8ee595abb2358dd64e5e.png|800px]]

* Navigate to '''Listeners'''.
* Click on the '''three dots''' to open the menu of the created backend set.
* Click on '''Edit'''.

[[File:bef9d3cd6c9242b50ce2158c712f280b.png|800px]]

* Change the '''Protocol''' to TCP.
* Change the '''Port''' to 443.
* Enable SSL.
* '''Certificate resource:''' Load Balancer managed certificate
* Select the Certificate that you added earlier.
* Click on '''Save changes'''.- Enable SSL.
* '''Certificate resource:''' Load Balancer managed certificate
* Select the Certificate that you added earlier.
* Click on '''Save changes'''.

[[File:5a7213bbdce7737945c8e38574c97a5d.png|800px]]

* Click on '''Close'''.

[[File:3181e7bcaf9d69796f93f34b8f3b5142.png|800px]]

* Notice that the listener is now listening on TCP port 443.

[[File:c57689022146a1ae604712934bd4dc8b.png|800px]]

* Navigate to '''Backend sets'''.
* Notice that the health is still incomplete.
* This is because we have not added any servers as a backend to the set.

[[File:1eaaf9c7a2fcc20550263cac267b6765.png|800px]]

* Click on the '''three dots''' to open the menu of the created backend set.
* Click on '''Update health check'''.

[[File:2870882a7394f334b84641bed4d52d13.png|800px]]

* Change the '''Protocol''' to TCP.
* Change the '''Port''' to 443.
* Click on '''Save changes'''.

[[File:8350e9acc67de27acbd40c796d400480.png|800px]]

* Click on '''Close'''.

[[File:cd61e867f968b819c21bdb42258fc9bc.png|800px]]

* Click on the backend set you created earlier.

[[File:e24af498cff339becfc20be11386ac68.png|800px]]

* Click on '''Backends'''.
* Click on '''Add backends'''.

[[File:0268222123680ad8d66d47382d96a117.png|800px]]

* '''Backend Type:''' IP addresses.
* Add the following '''backends''' (IP addresses of the CTMs):
* CTM 1 (AMS)
* '''IP address''': 10.111.10.32
* '''Port:''' 443
* Weight: 1
* CTM 2 (ASH)
* '''IP address:''' 10.222.10.111
* '''Port''': 443
* '''Weight:''' 2
* Click on '''Add'''.

[[File:ade428cc3001d1822c827424fd56b45e.png|800px]]

* Notice that the health will show up as '''Critical'''.
* Performing the health check on the CTM servers might take a minute.

[[File:970b02b74a33ee057dbb243faf922375.png|800px]]

* Notice that the health is now changed to '''OK'''.
* Navigate back to the Backend set overview.

[[File:c36288bbb99c5b8b1e6ed8193342ec04.png|800px]]

* Notice that the overall health of the backend set is also '''OK''' here.
* Navigate back to the Load Balancer overview.

[[File:54c4d7531a1438b1015d99ada4830145.png|800px]]

* Notice that the Load balancer is active, the overall health is OK, and the load balancer has an IP address.

[[File:d4135263a80d02343b062bf7060dd8bd.png|800px]]


Make sure you create a DNS record for the load balancer.
I have created an A record in the Private DNS Listener inside the OCI VCN.

[[File:6ac9b4ebd357169ad5d99053161b024f.png|800px]]

= STEP 03: Oracle HYOK with CipherTrust – With API Gateway and Application Load Balancer =

In this step, we integrate the ALB into your existing API Gateway–based HYOK deployment, ensuring a seamless and highly available architecture.

In this architecture, we combine the strengths of the '''OCI API Gateway''' and the '''OCI Application Load Balancer (ALB)''' to enhance the reliability and security of the Oracle HYOK integration with Thales CipherTrust Manager.

The API Gateway continues to serve as the secure public-facing entry point, enforcing authentication, authorization, and routing policies. Behind it, the Application Load Balancer distributes requests across multiple CipherTrust Manager nodes, ensuring high availability and fault tolerance at the network layer.

This layered design maintains a secure access model through the API Gateway. It addresses the lack of native VIP support in CipherTrust Manager by introducing a resilient backend through the ALB.

[[File:de35ca765e1989e5238eee6399aa6c74.png|800px]]


* Navigate to the API Gateway created in this tutorial: ''''HYOK with CipherTrust Manager and API Gateway

[[File:a4a7e01aa2e2bc6f99cf3efcdf9b0c8b.png|800px]]

* Click on '''Deployments'''.
* Click on the '''Deployment'''.

[[File:1ec767296f055eb4203940fe2df27268.png|800px]]

* Click on '''Edit'''.

[[File:86dad807e0de85cafbc7d6aec091c104.png|800px]]

Click on '''Routes'''.

[[File:63dc9ef3ecce6b4629681436e3c49c3d.png|800px]]

* Notice that the URL points to the <code>ctm1.oci-thales.lab</code> FQDN, which is the AMS CTM.

[[File:5579db9048ac9e4b91e180f52f276c45.png|800px]]

* Change the URL to now point to <code>lb-ctm.oci-thales.lab</code> FQDN, the ALB we just created.
* Click on '''Next''' and make sure to '''save''' the changes.

[[File:ecf046ca5ecb6a5b132dc07c40f3565c.png|800px]]

The following illustration shows the end-to-end traffic flow with the OCI API Gateway and the OCI ALB integrated into the architecture.

[[File:0064c02b2c3a5bee348cd92690a5c15e.png|800px]]

= STEP 04: Oracle HYOK with CipherTrust – With Application Load Balancer (only) =

In this step, you'll learn how to configure and use the OCI ALB as the sole access point for CipherTrust Manager in an Oracle HYOK deployment, enabling a clean, performant, and highly available architecture.

In this architecture, we simplify the deployment by removing the API Gateway and placing the '''OCI Application Load Balancer (ALB)''' directly in front of the Thales CipherTrust Manager cluster. This approach is ideal for private integrations where public access is not required and the goal is to ensure high availability within a secure, internal network.

By routing requests through the ALB, we can distribute traffic across multiple CipherTrust nodes while maintaining session resilience and failover capabilities, even in the event of a node or availability domain failure. This setup addresses the key limitation of the CipherTrust Manager's lack of native VIP support, without the additional complexity of API Gateway policies and authentication flows.

Follow the steps in the [[https://docs.oracle.com/en/learn/oci-hyok-cckm-without-api-gw/ '''HYOK with CipherTrust Manager without API Gateway''']] tutorial.
But now, all the (AMS) CTM1 IP addresses have been changed to the LB IP address.
* The (OCI) Integrated Applications Resource app.
* The CTM1 External Vault Endpoint URL Hostname.
* This change will also be synced to the (ASH) CTM2 when the CTM is in a cluster.
* The OCI Private Endpoint (the OCI External Ley Management Service will use that.)

This is the detailed integration flow for the OCI with Thales Integration (HYOK) with only the LB in the path.

[[File:dadfad9296c725ac4d78771227cf3fa2.png|800px]]

The following illustration shows the end-to-end traffic flow with only the OCI ALB integrated into the architecture.

[[File:765c22e3668ac664e7a0caa9bac6fbfe.png|800px]]

= STEP 05: An overview of all the OCI and Thales HYOK Architectures to make the CipherTrust Manager Highly Available =

There is no one-size-fits-all approach to deploying Thales CipherTrust Manager (CTM) for Hold Your Own Key (HYOK) in Oracle Cloud Infrastructure (OCI). Multiple architectural options are available to achieve a resilient, highly available deployment depending on your network topology, security requirements, and available infrastructure, whether cloud-based or on-premises.

This section provides a consolidated overview of all supported architecture patterns for integrating CTM with OCI HYOK, focusing on high availability. These include combinations of:

* Single or dual data center deployments
* Use of the OCI '''API Gateway'''
* Use of the OCI '''Application Load Balancer (ALB)'''
* Use of '''on-premises or data center–hosted load balancers''', both with and without high availability

Each architecture has benefits and trade-offs regarding complexity, failover capabilities, and control. Whether you're running a fully cloud-native setup, operating across hybrid environments, or leveraging legacy load balancers in your data centers, there is a model that fits.

=== The architectures covered include: ===
{| class="wikitable"
! Architecture # !! Description
|-
| '''1''' || CTM in a single data center – basic setup without API Gateway or Load Balancer
|-
| '''2''' || CTM in a single data center with OCI API Gateway – external access, no HA
|-
| '''3''' || CTMs in two data centers with OCI API Gateway and OCI ALB – full HA solution
|-
| '''4''' || CTMs in two data centers with OCI API Gateway and '''on-prem load balancer (no HA)''' – partial resilience
|-
| '''5''' || CTMs in two data centers with OCI API Gateway and '''on-prem load balancer (HA)''' – HA managed externally
|-
| '''6''' || CTM in one data center with OCI API Gateway and '''on-prem load balancer (no HA)''' – limited failover
|-
| '''7''' || CTMs in two data centers with OCI ALB only – internal access, full network-level HA without API Gateway
|}
This overview will help you compare and select the architecture that best aligns with your technical and operational requirements.

'''(1)''' The following illustration shows the end-to-end traffic flow with no OCI API Gateway and no load balancing integrated into the architecture.

[[File:ab3a2908db654a920b7b748b71340118.png|800px]]

'''(2)''' The following illustration shows the end-to-end traffic flow with only the OCI API Gateway and no load balancing integrated into the architecture.

[[File:e2883278b5d2602dd2e72523740e92c6.png|800px]]

'''(3)''' The following illustration shows the end-to-end traffic flow with the OCI API Gateway and the OCI ALB integrated into the architecture.

[[File:6679a734f1df9923850d9de0c0b8af46.png|800px]]

'''(4, 5 and 6)''' The following illustration shows the end-to-end traffic flow with the OCI API Gateway and the on-prem load balancers integrated into the architecture.

[[File:1cd2bd8b9caf0cc3f55f9990503c3dfa.png|800px]]

'''(7)''' The following illustration shows the end-to-end traffic flow with only the OCI ALB integrated into the architecture.

[[File:a642fd63122390d29a7e1703a75e419e.png|800px]]

= Conclusion =

Ensuring high availability for Thales CipherTrust Manager in an Oracle Cloud Infrastructure (OCI) HYOK deployment is essential for maintaining secure, uninterrupted access to customer-managed encryption keys. While clustering CipherTrust Managers provides recoverability, it is insufficient to meet high availability requirements at the network level.

This article demonstrated how the '''OCI Application Load Balancer''' can close that gap, either in conjunction with the '''OCI API Gateway''' or as a standalone solution for internal access. We also reviewed several real-world architecture patterns, including hybrid models that leverage on-premises load balancers, helping you choose the design that aligns with your infrastructure strategy and availability goals.

By thoughtfully integrating OCI's networking services with Thales CipherTrust, organizations can build a resilient and secure external key management solution that supports enterprise-grade compliance and operational continuity.

[[Category:Oracle Cloud]]