Flowchart 700 can be implemented at least partially with a computer or other data processing system; that is, by one or more processors configured to receive or retrieve information, process the information, store results, and transmit the results. Other implementations may perform the actions in different orders and/or with different, fewer or additional actions than those illustrated in FIG. 7. Multiple actions can be combined in some implementations. For convenience, this flowchart is described with reference to a system which includes Netskope cloud access security broker (N-CASB), load balancing in a dynamic service chain while applying security services in the cloud, and improved recovery from failure of a service instance, in a service chain of services.

The method described in this section and other sections of the technology disclosed can include one or more of the following features and/or features described in connection with additional methods disclosed. In the interest of conciseness, the combinations of features disclosed in this application are not individually enumerated and are not repeated with each base set of features.

FIG. 7 begins with action 715 for service instance BA receiving from the service instance AA a first packet in a stream for a subscriber, in which the first packet includes in an added header a stream affinity code that is consistent for packets in the stream.

Process 700 continues at action 725, with service instance BA, in a primary role specified in a service map distributed to service instances, processing the first packet by performing service B.