Skip to main content

Load Balancing Add-on

The Load Balancing add-on lets your cluster expose workloads through the VPC gateway using standard Kubernetes resources. When enabled, NetActuate installs and operates a controller that turns a LoadBalancer Service into a Layer 4 load balancer and an Ingress into a Layer 7 load balancer on the gateway, giving your pods a public entry point without you configuring the gateway by hand. This add-on is available only on in-VPC clusters, because it drives the VPC gateway.

Enable the add-on​

  1. Navigate to Infrastructure -> Kubernetes and open your in-VPC cluster.
  2. Open the Managed Add-ons tab.
  3. Enable Load Balancing and confirm.

NetActuate installs the controller and moves the add-on to ready. If it reports degraded or failed, use Repair on the same tab.

Layer 4: LoadBalancer Services​

Expose a TCP or UDP service by creating a Service of type: LoadBalancer and opting in with the NetActuate load balancer class. The class is a required opt-in: the controller only acts on Services that set spec.loadBalancerClass to netactuate.com/vpc-lb, so a plain type: LoadBalancer Service without the class is left untouched.

apiVersion: v1
kind: Service
metadata:
  name: web
spec:
  type: LoadBalancer
  loadBalancerClass: netactuate.com/vpc-lb
  selector:
    app: web
  ports:
    - port: 443
      targetPort: 8443
  loadBalancerSourceRanges:
    - 203.0.113.0/24
  • Assigned VIP. Once provisioned, the public virtual IP is reported back on the Service at status.loadBalancer.ingress[].ip. Read it with kubectl get service web and use it as the address for the service.
  • Source restrictions. Entries in loadBalancerSourceRanges are pushed to the VPC gateway firewall, so only the listed CIDRs can reach the VIP. Omit the field to allow all sources.

Layer 7: Ingress​

Expose HTTP and HTTPS routes by creating an Ingress that uses the NetActuate ingress class. Set the IngressClass to netactuate so the add-on programs a Layer 7 load balancer on the gateway for the Ingress rules.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web
spec:
  ingressClassName: netactuate
  rules:
    - host: web.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web
                port:
                  number: 80
  tls:
    - hosts:
        - web.example.com
      secretName: web-tls

TLS is supported for HTTPS routes: supply your own certificate through a TLS secret as shown, or use ACME (Let's Encrypt) to obtain and renew a certificate automatically for the Ingress hosts.

Where it appears​

Load balancers created through the add-on are provisioned on the VPC gateway and surface on the Load Balancing tab of the VPC in the portal, alongside any load balancers you created directly. This lets you see the gateway-level result of a LoadBalancer Service or an Ingress next to your other VPC load balancers. See Load Balancing for the VPC Load Balancing tab.

Need Help?​

Contact support@netactuate.com or open a support ticket from the portal.