CLI LoadBalancer

CLI: LoadBalancer

add-pool-member

Kind: Write.

The members write replaces the whole list: this command reads every member first and sends back what it read plus this one change, never a caller-supplied whole list. --address must be IPv4; --port and --monitor-port are 1 to 65535, with --monitor-port 0 meaning unset. --weight 0 sends 1. Without --no-wait, waits for the pool to settle, then confirms a fresh read names exactly the members just sent; a mismatch, a timeout, or the pool reaching ERROR is NotSettled or WriteFailed, and Changed still reports whether the member list actually changed. A member already present at --address and --port with the same fields makes this a no-op: Changed false, nothing sent. One present with any different field exits 2 (InvalidUsage) naming update-pool-member instead.

Flag	Type	Required
--load-balancer-id	string	yes
--pool-id	string	yes
--address	string	yes
--port	int	yes
--name	string
--weight	int
--monitor-port	int
--backup	bool
--no-wait	bool

vngcloud loadbalancer add-pool-member --load-balancer-id <load-balancer-id> --pool-id <pool-id> --address <address> --port <port>

create-listener

Kind: Write.

--allowed-cidrs is a comma-separated list of IPv4 CIDR prefixes with no host bits set, such as 10.0.0.0/24,203.0.113.0/28; it is required, with no default, unlike VNG Cloud's own SDK, which sends 0.0.0.0/0. Any entry outside every private range (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 100.64.0.0/10) needs --yes: it may open the ports this listener names to outside the account's own network, more so on a load balancer created with a Scheme other than Internal. --protocol HTTPS requires --default-certificate-id; any other protocol refuses --default-certificate-id, --client-certificate-id, and a --cli-input-json CertificateIDs alike, refusing the command the moment any single one of them is set. CertificateIDs comes only through --cli-input-json, per the design's nested fields, as does --cli-input-json's InsertHeaders. A 0 --timeout-client, --timeout-member, or --timeout-connection sends the server's own default (50, 50, and 5 seconds). An HTTP listener on a load balancer reachable from outside the account's own network serves cleartext: nothing encrypts traffic between the client and the load balancer.

Flag	Type	Required
--load-balancer-id	string	yes
--name	string	yes
--protocol	string	yes
--port	int	yes
--default-pool-id	string
--timeout-client	int
--timeout-member	int
--timeout-connection	int
CertificateIDs (via --cli-input-json only)	[]string
--default-certificate-id	string
--client-certificate-id	string
InsertHeaders (via --cli-input-json only)	[]loadbalancer.ListenerInsertHeader
--no-wait	bool
--allowed-cidrs	string	yes

vngcloud loadbalancer create-listener --load-balancer-id <load-balancer-id> --name <name> --protocol HTTP --port <port> --allowed-cidrs 10.0.0.0/24

create-load-balancer

Kind: Write.

Run quote-create-load-balancer first, and set a billing budget with an alert before any paid create: this command orders nothing above --max-price, default 0, so a bare create-load-balancer refuses every package. A quote of 0 is refused, and --max-price must be at least the quote. --max-price NaN, Inf, or negative exits 2 (InvalidUsage) before any request. The quote and the order build from the same fields, so the order always prices what was just quoted. The order itself is never retried after a failure that may have already reached the server; list load balancers by name (list-load-balancers --name) and match it exactly before ordering again rather than repeating this command. Without --no-wait, waits up to 20 minutes for the new load balancer to reach CREATED; ERROR during that wait is WriteFailed, and a timeout is NotSettled, either way with the last-read load balancer printed alongside the error, and the write must not be repeated. Every Scheme except Internal, trimmed of surrounding space and matched case-insensitively, needs --yes: only a load balancer created with Scheme Internal is confirmed to stay off the public internet. Prices are VND totals that include VAT; the API gives no VAT breakdown.

Flag	Type	Required
--name	string	yes
--package-id	string	yes
--type	string	yes
--scheme	string	yes
--subnet-id	string	yes
--zone-id	string	yes
--max-price	float64
--no-wait	bool

vngcloud loadbalancer create-load-balancer --name <name> --package-id <package-id> --type <type> --scheme Internal --subnet-id <subnet-id> --zone-id <zone-id> --max-price 400000

create-policy

Kind: Write.

Rules comes only through --cli-input-json, a list of objects each with Type, CompareType, and Value all required, for example '{"Rules":[{"Type":"PATH","CompareType":"STARTS_WITH","Value":"/api"}]}'. --action REDIRECT_TO_POOL requires --redirect-pool-id and refuses --redirect-url, --redirect-http-code, and --keep-query-string; REDIRECT_TO_URL requires --redirect-url and refuses --redirect-pool-id. Each write sends only the redirect fields its action carries. Another --action value reaches the server as given.

Flag	Type	Required
--load-balancer-id	string	yes
--listener-id	string	yes
--name	string	yes
--action	string	yes
--redirect-pool-id	string
--redirect-url	string
--redirect-http-code	int
--keep-query-string	bool
Rules (via --cli-input-json only)	[]loadbalancer.PolicyRuleInput
--no-wait	bool

vngcloud loadbalancer create-policy --load-balancer-id <load-balancer-id> --listener-id <listener-id> --name <name> --action <action>

create-pool

Kind: Write.

Empty --algorithm sends ROUND_ROBIN; 0 --healthy-threshold, --unhealthy-threshold, --health-check-interval, or --health-check-timeout sends the server's own default (3, 3, 30, and 5). --stickiness and --tls-encryption are sent only when given, since a Layer 4 pool has no use for either. --health-check-path, --health-check-method, --health-check-http-version, --health-check-domain-name, and --health-check-success-code are only valid when --health-check-protocol is HTTP or HTTPS; giving one with any other check protocol exits 2 (InvalidUsage) before any request. No domain name is invented for HTTP/1.1: an HTTP check with none reaches the server empty, which then refuses it.

Flag	Type	Required
--load-balancer-id	string	yes
--name	string	yes
--protocol	string	yes
--algorithm	string
--stickiness	*bool
--tls-encryption	*bool
--health-check-protocol	string	yes
--health-check-path	string
--health-check-method	string
--health-check-http-version	string
--health-check-domain-name	string
--health-check-success-code	string
--healthy-threshold	int
--unhealthy-threshold	int
--health-check-interval	int
--health-check-timeout	int
--no-wait	bool

vngcloud loadbalancer create-pool --load-balancer-id <load-balancer-id> --name <name> --protocol <protocol> --health-check-protocol <health-check-protocol>

delete-certificate

Kind: Write, destructive.

Refuses, before any request, a certificate a listener still uses (error code ResourceInUse), read first with get-certificate. A deleted certificate needs its key again to re-import, and the key may no longer exist anywhere else, so this needs --yes.

Flag	Type	Required
--certificate-id	string	yes

vngcloud loadbalancer delete-certificate --certificate-id <certificate-id> --yes

delete-listener

Kind: Write, destructive.

Waits, within the pre-write bound, until the load balancer and the listener are both not busy (error code ResourceBusy, nothing sent, past that bound), then sends the DELETE.

Flag	Type	Required
--load-balancer-id	string	yes
--listener-id	string	yes
--no-wait	bool

vngcloud loadbalancer delete-listener --load-balancer-id <load-balancer-id> --listener-id <listener-id> --yes

delete-load-balancer

Kind: Write, destructive.

Reads the load balancer first: an unknown --load-balancer-id is NotFound, and one already DELETING is waited on rather than sent a second DELETE. Deleting a load balancer loses its address and its prepaid time for good; what happens to its listeners and pools, if any exist, is unverified live. Without --no-wait, waits up to 15 minutes for the load balancer to 404; ERROR during that wait is WriteFailed, and a timeout is NotSettled, but a rerun is always safe: this command reads first.

Flag	Type	Required
--load-balancer-id	string	yes
--no-wait	bool

vngcloud loadbalancer delete-load-balancer --load-balancer-id <load-balancer-id> --yes

delete-policy

Kind: Write, destructive.

Waits, within the pre-write bound, until the load balancer and the policy are both not busy (error code ResourceBusy, nothing sent, past that bound), then sends the DELETE.

Flag	Type	Required
--load-balancer-id	string	yes
--listener-id	string	yes
--policy-id	string	yes
--no-wait	bool

vngcloud loadbalancer delete-policy --load-balancer-id <load-balancer-id> --listener-id <listener-id> --policy-id <policy-id> --yes

delete-pool

Kind: Write, destructive.

Refuses, before any request, a pool a listener still names as its default pool (error code ResourceInUse), found by listing the load balancer's listeners; a policy that redirects to the pool is left to the server's own refusal, which this command maps the same way.

Flag	Type	Required
--load-balancer-id	string	yes
--pool-id	string	yes
--no-wait	bool

vngcloud loadbalancer delete-pool --load-balancer-id <load-balancer-id> --pool-id <pool-id> --yes

get-certificate

Kind: Read.

Unverified live: the test account has no certificate, so this output shape comes from GreenNode's official SDK, not a live capture.

Flag	Type	Required
--certificate-id	string	yes

vngcloud loadbalancer get-certificate --certificate-id <certificate-id> --query Certificate

get-listener

Kind: Read.

Unverified live: the test account has no load balancer, so this output shape comes from GreenNode's official SDK, not a live capture.

Flag	Type	Required
--load-balancer-id	string	yes
--listener-id	string	yes

vngcloud loadbalancer get-listener --load-balancer-id <load-balancer-id> --listener-id <listener-id> --query Listener

get-load-balancer

Kind: Read.

Unverified live: the test account has no load balancer, so this output shape comes from GreenNode's official SDK, not a live capture.

Flag	Type	Required
--load-balancer-id	string	yes

vngcloud loadbalancer get-load-balancer --load-balancer-id <load-balancer-id> --query LoadBalancer

get-policy

Kind: Read.

Unverified live: the test account has no load balancer, so this output shape comes from GreenNode's official SDK, not a live capture.

Flag	Type	Required
--load-balancer-id	string	yes
--listener-id	string	yes
--policy-id	string	yes

vngcloud loadbalancer get-policy --load-balancer-id <load-balancer-id> --listener-id <listener-id> --policy-id <policy-id> --query Policy

get-pool

Kind: Read.

Unverified live: the test account has no load balancer, so this output shape comes from GreenNode's official SDK, not a live capture.

Flag	Type	Required
--load-balancer-id	string	yes
--pool-id	string	yes

vngcloud loadbalancer get-pool --load-balancer-id <load-balancer-id> --pool-id <pool-id> --query Pool

get-pool-health-monitor

Kind: Read.

Unverified live: the test account has no load balancer, so this output shape comes from GreenNode's official SDK, not a live capture.

Flag	Type	Required
--load-balancer-id	string	yes
--pool-id	string	yes

vngcloud loadbalancer get-pool-health-monitor --load-balancer-id <load-balancer-id> --pool-id <pool-id> --query HealthMonitor

import-certificate

Kind: Write.

Certificate, CertificateChain, PrivateKey, and Passphrase all come from a file: --certificate-file (required), --certificate-chain-file, --private-key-file, and --passphrase-file; none of the four has a plain string flag, and --cli-input-json refuses PrivateKey and Passphrase outright, inline or file://, though Certificate and CertificateChain may still be set that way instead of by file. Each file is read whole, at most 64 KiB, and an empty file is refused; --passphrase-file additionally drops one trailing newline. PrivateKey is required for Type TLS/SSL; for any other Type, PrivateKey, Passphrase, and CertificateChain must all be empty. GreenNode keeps the key, and the printed Certificate holds no key field. A failing import withholds the server's own error message entirely, since it could otherwise quote the rejected key or passphrase back. Keep the private key file readable only by its owner (chmod 600).

Flag	Type	Required
--name	string	yes
--type	string	yes
Certificate (via --cli-input-json only)	string	yes
CertificateChain (via --cli-input-json only)	string
--certificate-chain-file	string
--certificate-file	string	yes
--passphrase-file	string
--private-key-file	string

vngcloud loadbalancer import-certificate --name example-com --type TLS/SSL --certificate-file cert.pem --certificate-chain-file chain.pem --private-key-file key.pem

list-certificates

Kind: Read.

Flag	Type	Required
--name	string
--page	int
--size	int

vngcloud loadbalancer list-certificates

list-listeners

Kind: Read.

Unverified live: the test account has no load balancer, so this output shape comes from GreenNode's official SDK, not a live capture.

Flag	Type	Required
--load-balancer-id	string	yes

vngcloud loadbalancer list-listeners --load-balancer-id <load-balancer-id>

list-load-balancers

Kind: Read.

Flag	Type	Required
--name	string
--page	int
--size	int

vngcloud loadbalancer list-load-balancers --query 'Items[].{ID:UUID,Name:Name,Status:DisplayStatus}'

list-packages

Kind: Read.

Flag	Type	Required
--zone-id	string

vngcloud loadbalancer list-packages

list-policies

Kind: Read.

Unverified live: the test account has no load balancer, so this output shape comes from GreenNode's official SDK, not a live capture.

Flag	Type	Required
--load-balancer-id	string	yes
--listener-id	string	yes

vngcloud loadbalancer list-policies --load-balancer-id <load-balancer-id> --listener-id <listener-id>

list-pool-members

Kind: Read.

Unverified live: the test account has no load balancer, so this output shape comes from GreenNode's official SDK, not a live capture.

Flag	Type	Required
--load-balancer-id	string	yes
--pool-id	string	yes

vngcloud loadbalancer list-pool-members --load-balancer-id <load-balancer-id> --pool-id <pool-id>

list-pools

Kind: Read.

Unverified live: the test account has no load balancer, so this output shape comes from GreenNode's official SDK, not a live capture.

Flag	Type	Required
--load-balancer-id	string	yes

vngcloud loadbalancer list-pools --load-balancer-id <load-balancer-id>

list-tags

Kind: Read.

Unverified live: the test account has no load balancer, so this output shape comes from GreenNode's official SDK, not a live capture.

Flag	Type	Required
--load-balancer-id	string	yes

vngcloud loadbalancer list-tags --load-balancer-id <load-balancer-id>

quote-create-load-balancer

Kind: Read.

Never orders anything: prices the load balancer CreateLoadBalancerInput describes without sending a create. OptimumPrice and every other price are VND a month, one prepaid period. Needs only --package-id and --zone-id, the two values that set the price; --name, --scheme, --subnet-id, and --type are optional here and required by create-load-balancer. The CLI does not send them to the billing gateway, but still checks --scheme and --subnet-id when set. Ignores MaxPrice and NoWait even when an inline --cli-input-json value sets them: both govern only an actual create. Prices are VND totals that include VAT; the API gives no VAT breakdown.

Flag	Type	Required
--name	string
--package-id	string	yes
--type	string
--scheme	string
--subnet-id	string
--zone-id	string	yes
MaxPrice (via --cli-input-json only)	float64
NoWait (via --cli-input-json only)	bool

vngcloud loadbalancer quote-create-load-balancer --package-id <package-id> --zone-id <zone-id>

quote-resize-load-balancer

Kind: Read.

Never orders anything: prices the package change ResizeLoadBalancerInput describes without sending a resize. OptimumPrice and every other price are VND a month. Ignores MaxPrice and NoWait even when an inline --cli-input-json value sets them: both govern only an actual resize. --load-balancer-id naming a load balancer that does not exist exits 1 with the server's own status 400 message, not NotFound: unlike every other load-balancer command, the server checks this request's shape before it checks the ID. Prices are VND totals that include VAT; the API gives no VAT breakdown.

Flag	Type	Required
--load-balancer-id	string	yes
--package-id	string	yes
MaxPrice (via --cli-input-json only)	float64
NoWait (via --cli-input-json only)	bool

vngcloud loadbalancer quote-resize-load-balancer --load-balancer-id <load-balancer-id> --package-id <package-id>

remove-pool-member

Kind: Write.

The members write replaces the whole list: this command reads every member first and sends back what it read plus this one change, never a caller-supplied whole list. --address must be IPv4; --port and --monitor-port are 1 to 65535, with --monitor-port 0 meaning unset. --weight 0 sends 1. Without --no-wait, waits for the pool to settle, then confirms a fresh read names exactly the members just sent; a mismatch, a timeout, or the pool reaching ERROR is NotSettled or WriteFailed, and Changed still reports whether the member list actually changed. No member at --address and --port is NotFound, nothing sent. Needs --yes on every call: removing a member stops it taking traffic immediately, though add-pool-member can restore it.

Flag	Type	Required
--load-balancer-id	string	yes
--pool-id	string	yes
--address	string	yes
--port	int	yes
--no-wait	bool

vngcloud loadbalancer remove-pool-member --load-balancer-id <load-balancer-id> --pool-id <pool-id> --address <address> --port <port>

resize-load-balancer

Kind: Write.

Reads the load balancer first: --package-id equal to its current package makes this a no-op, Changed false, quoting and sending nothing. Otherwise orders nothing above --max-price, default 0; --max-price NaN, Inf, or negative exits 2 (InvalidUsage) before any request. A downsize's quote may legitimately price below zero as a refund, which never exceeds --max-price. The resize is sent once and never resent, whatever the failure: a busy load balancer refuses the resize itself with ResourceBusy at once, rather than waiting and resending the way a free write's busy resend does. After any failure, read the load balancer with get-load-balancer and compare its package to the one just requested before running this command again, rather than rerunning it blind: a resize failure does not say whether the order reached the server. Without --no-wait, waits up to 45 minutes for the load balancer to reach CREATED with the new package; ERROR during that wait is WriteFailed, and a timeout is NotSettled, either way with the last-read load balancer printed alongside the error, and the write must not be repeated. Prices are VND totals that include VAT; the API gives no VAT breakdown.

Flag	Type	Required
--load-balancer-id	string	yes
--package-id	string	yes
--max-price	float64
--no-wait	bool

vngcloud loadbalancer resize-load-balancer --load-balancer-id <load-balancer-id> --package-id <package-id>

update-listener

Kind: Write.

At least one field must be set, checked before any request (InvalidUsage). Reads the listener, applies every set field, and sends the full body with the read values for the rest. --allowed-cidrs takes the same comma-separated value create-listener's does; leaving it unset keeps the listener's own value, and a set one needs --yes for an entry outside every private range (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 100.64.0.0/10) the same way. An explicitly empty --allowed-cidrs reaches the SDK as a non-nil, empty list, which it refuses (InvalidUsage) rather than send, since an empty list would open or close the listener to everyone depending on the server's own interpretation. The merged certificate fields are checked against the listener's own, unchangeable Protocol exactly as create-listener checks them; CertificateIDs comes only through --cli-input-json.

Flag	Type	Required
--load-balancer-id	string	yes
--listener-id	string	yes
--default-pool-id	*string
--timeout-client	*int
--timeout-member	*int
--timeout-connection	*int
CertificateIDs (via --cli-input-json only)	*[]string
--default-certificate-id	*string
--client-certificate-id	*string
InsertHeaders (via --cli-input-json only)	*[]loadbalancer.ListenerInsertHeader
--no-wait	bool
--allowed-cidrs	string

vngcloud loadbalancer update-listener --load-balancer-id <load-balancer-id> --listener-id <listener-id> --timeout-client <timeout-client>

update-policy

Kind: Write.

At least one field must be set, checked before any request (InvalidUsage). Reads the policy, applies every set field, and sends the body for the merged action with the read values for the rest. A REDIRECT_TO_POOL action sends only redirectPoolId, and REDIRECT_TO_URL sends only redirectUrl, redirectHttpCode, and keepQueryString. A --cli-input-json Rules replaces the whole rule list; leaving it unset resends the rules read, refusing the write instead if one of them reads back missing Type, CompareType, or Value. The merged --action and redirect fields are checked exactly as create-policy checks them, so --redirect-http-code on a pool policy is refused.

Flag	Type	Required
--load-balancer-id	string	yes
--listener-id	string	yes
--policy-id	string	yes
--action	*string
--redirect-pool-id	*string
--redirect-url	*string
--redirect-http-code	*int
--keep-query-string	*bool
Rules (via --cli-input-json only)	*[]loadbalancer.PolicyRuleInput
--no-wait	bool

vngcloud loadbalancer update-policy --load-balancer-id <load-balancer-id> --listener-id <listener-id> --policy-id <policy-id> --action <action>

update-pool

Kind: Write.

At least one field must be set, checked before any request (InvalidUsage). Reads the pool and its health monitor, applies every set field, and sends the full body with the read values for the rest, so a call that sets only --algorithm still resends the health monitor exactly as read. The health check protocol cannot change after create, so there is no flag for it here; the HTTP fields are refused when the pool's own check protocol is not HTTP or HTTPS, the same guard create-pool runs.

Flag	Type	Required
--load-balancer-id	string	yes
--pool-id	string	yes
--algorithm	*string
--stickiness	*bool
--tls-encryption	*bool
--health-check-path	*string
--health-check-method	*string
--health-check-http-version	*string
--health-check-domain-name	*string
--health-check-success-code	*string
--healthy-threshold	*int
--unhealthy-threshold	*int
--health-check-interval	*int
--health-check-timeout	*int
--no-wait	bool

vngcloud loadbalancer update-pool --load-balancer-id <load-balancer-id> --pool-id <pool-id> --algorithm <algorithm>

update-pool-member

Kind: Write.

The members write replaces the whole list: this command reads every member first and sends back what it read plus this one change, never a caller-supplied whole list. --address must be IPv4; --port and --monitor-port are 1 to 65535, with --monitor-port 0 meaning unset. --weight 0 sends 1. Without --no-wait, waits for the pool to settle, then confirms a fresh read names exactly the members just sent; a mismatch, a timeout, or the pool reaching ERROR is NotSettled or WriteFailed, and Changed still reports whether the member list actually changed. At least one of --name, --weight, --monitor-port, or --backup must be set, checked before any request (InvalidUsage). No member at --address and --port is NotFound, nothing sent; a change that leaves every field equal to what was read is Changed false, nothing sent.

Flag	Type	Required
--load-balancer-id	string	yes
--pool-id	string	yes
--address	string	yes
--port	int	yes
--name	*string
--weight	*int
--monitor-port	*int
--backup	*bool
--no-wait	bool

vngcloud loadbalancer update-pool-member --load-balancer-id <load-balancer-id> --pool-id <pool-id> --address <address> --port <port> --weight <weight>