title: How do you set up Azure load balancing for micro-services?
body: <p>We've got an API micro-services infrastructure hosted on Azure VMs.  Each VM will host several APIs which are separate sites running on Kestrel.  All external traffic comes in through an RP (running on IIS).</p>
  
  <p>We have some API's that are designed to accept external requests and some that are internal APIs only.</p>
  
  <p>The internal APIs are hosted on scalesets with each scaleset VM being a replica that hosts all of the internal APIs. There is an internal load balancer(ILB)/vip in front of the scaleset. The root issue is that we have internal APIs that call other internal APIs that are hosted on the same scaleset. Ideally these calls would go to the VIP (using internal DNS) and the VIP would route to one of the machines in the scaleset. But it looks like Azure doesn't allow this...per the documentation:</p>
  
  <pre><code>You cannot access the ILB VIP from the same Virtual Machines that are being load-balanced
  </code></pre>
  
  <p>So how do people set this up with micro-services?  I can see three ways, none of which are ideal:</p>
  
  <ol>
  <li>Separate out the APIs to different scalesets. Not ideal as the
  services are very lightweight and I don't want to triple my Azure VM
  expenses. </li>
  <li>Convert the internal LB to an external LB (add a public
  IP address).  Then put that LB in it's own network security
  group/subnet to only allow calls from our Azure IP range.  I would
  expect more latency here and exposing the endpoints externally in
  any way creates more attack surface area as well as more
  configuration complexity. </li>
  <li>Set up the VM to loopback if it needs a call to the ILB...meaning any requests originating from a VM will be
  handled by the same VM.  This defeats the purpose of micro-services
  behind a VIP. An internal micro-service may be down on the same
  machine for some reason and available on another...thats' the reason
  we set up health probes on the ILB for each service separately. If
  it just goes back to the same machine, you lose resiliency.</li>
  </ol>
  
  <p>Any pointers on how others have approached this would be appreciated.</p>
  
  <p>Thanks!</p>