Load Balancer
deploymentFull Name: Application Load Balancer
Definition
A load balancer is a network device or software component that distributes incoming traffic across multiple backend servers, ensuring high availability, fault tolerance, and optimal performance. In the EUDI Wallet ecosystem, load balancers sit at the entry point of credential issuance services, verification endpoints, and status registries, distributing millions of identity-related requests across server clusters to meet the demanding availability requirements of critical EU digital identity infrastructure.
Load Balancing Strategies for Identity Services
EUDI Wallet services use several load balancing strategies depending on the specific requirements. Round-robin distribution evenly distributes requests across available servers, suitable for stateless services like credential verification endpoints. Least-connections routing sends new requests to the server with the fewest active connections, beneficial for long-running operations like credential issuance that may vary in processing time.
Health checking is a critical feature for EUDI Wallet load balancers. Active health checks periodically probe backend servers with test requests, automatically removing unhealthy servers from the rotation. This ensures that if a credential issuance service instance fails, traffic is immediately redirected to healthy instances without user impact.
Geographic load balancing distributes traffic to the nearest data center, reducing latency for users across the EU. A citizen in Spain presenting credentials to a German verifier can be routed to the nearest verification service endpoint, providing responsive performance regardless of the cross-border nature of the transaction.
High Availability Architecture
Load balancers enable high availability patterns essential for EUDI Wallet infrastructure. Active-active configurations run multiple load balancer instances simultaneously, each capable of handling the full traffic load. If one load balancer fails, the others continue operating without interruption, achieving the near-100% uptime required for critical identity services.
Within Kubernetes deployments, Ingress controllers act as application-level load balancers, routing HTTP/HTTPS traffic to the appropriate microservices based on URL paths and hostnames. This integrates load balancing directly into the container orchestration platform, simplifying operations and ensuring consistent behavior across development and production environments.
Cloud providers offer managed load balancing services (AWS ALB/NLB, Google Cloud Load Balancing, Azure Load Balancer) that handle the complexity of multi-region deployment, DDoS protection, and automatic scaling. Many EU Member States deploy their EUDI Wallet infrastructure on European cloud regions to meet data sovereignty requirements while using these managed load balancing capabilities.
Security Considerations
Load balancers play a important security role in EUDI Wallet infrastructure. They serve as the first line of defense against distributed denial-of-service (DDoS) attacks, rate limiting abusive traffic before it reaches backend services. WAF (Web Application Firewall) integration at the load balancer level can filter malicious requests targeting credential issuance or verification APIs.
TLS configuration on load balancers must meet the security standards defined by the EUDI Wallet trust framework. This includes supporting only TLS 1.2 and 1.3, disabling weak cipher suites, implementing HSTS (HTTP Strict Transport Security), and properly handling certificate chains for the wallet infrastructure domains. For internal traffic, mTLS between the load balancer and backend services provides additional authentication and encryption.