Traffic Ingress, Load Balancing, Proxies and API Gateways

Before an HTTP request ever reaches an application service, database, or worker thread, it must traverse a sophisticated hierarchy of edge infrastructure designed for routing, security, protocol translation, and traffic distribution.

A resilient system design does not treat the network path between clients and services as an invisible wire. Engineers must understand how traffic flows through DNS geographic steering, Anycast routing, Content Delivery Networks (CDNs), Web Application Firewalls (WAFs), Layer 4 and Layer 7 load balancers, reverse proxies, and API gateways.

This module deconstructs the ingress topology of modern distributed systems:

• Anatomy of an Ingress Path: DNS resolution $\to$ CDN/WAF $\to$ L4/L7 Load Balancers $\to$ Reverse Proxy $\to$ API Gateway $\to$ Service Mesh $\to$ Application Services.
• Load Balancing Algorithms & Mechanics: Round Robin, Weighted Round Robin, Least Connections, IP Hashing, Power of Two Random Choices, active/passive health checks, outlier detection, and connection draining.
• Reverse Proxies & Connection Management: Upstream connection pooling, request/response buffering, HTTP/2 to HTTP/1.1 multiplexing, WebSocket/gRPC proxying, and timeout/retry tuning with NGINX and Envoy.
• SSL/TLS Termination Architectures: Edge termination, TLS re-encryption, TLS passthrough, Session Resumption, SNI, and mTLS.
• API Gateways & Edge Cross-Cutting Concerns: Token bucket rate limiting, JWT validation, request transformation, API version routing, circuit breakers, and developer quotas with Kong and Apache APISIX.
• Kubernetes Ingress & Service Meshes: Ingress controllers, Kubernetes Gateway API, sidecar vs. ambient data planes, and service-to-service mTLS via Envoy and Istio.
• Security & Network Operations: DDoS mitigation, request smuggling prevention, X-Forwarded-For and Proxy Protocol trust boundaries, distributed tracing (traceparent), and distributed access logging.