Configure a load balancer in a Managed Kubernetes cluster for Ingress

warning

After creating a Managed Kubernetes cluster, we recommend performing all actions with load balancers only via kubectl. Changes made using a different method are not saved in Kubernetes manifests. If the cluster or load balancer is recreated, or when manifests are synced, such changes will be reverted.

A load balancer in Managed Kubernetes is used to distribute incoming traffic between pods.

If you use Traefik Ingress Controller, a load balancer will be created automatically when installing Traefik Ingress Controller. To configure the load balancer during installation, follow the Install Traefik Ingress Controller instructions. All annotations for configuring a load balancer described in these instructions are applied to Traefik Ingress Controller only via the values.yaml file.

If you use another Ingress Controller without automatic load balancer creation, or if you need an additional load balancer for other applications, create a load balancer.

Create a load balancer

Connect to the cluster.
Create a YAML file with a manifest for a Service object of the LoadBalancer type.

Example of a LoadBalancer-type Service manifest:
```
apiVersion: v1
kind: Service
metadata:
  name: loadbalancer-name
  labels:
    app: my-app
  annotations:
    loadbalancer.openstack.org/keep-floatingip: "true"
spec:
  type: LoadBalancer
  selector:
    app: my-app
  ports:
  - port: 80
    protocol: TCP
```
All additional parameters for the load balancer are passed in the annotations block — the instructions list commonly used annotations that may be useful when creating a load balancer or, in some cases, for an existing load balancer.
Apply the manifest:
```
kubectl apply -f <file_name>
```
Specify <file_name> — name of the YAML file with the manifest for creating a LoadBalancer Service object. For example, loadbalancer.yaml.

The created load balancer will appear in the Control Panel: in the top menu, click Products and select Cloud Servers → Load Balancers section → Load Balancers tab.

Specify a flavor and load balancer type

By default, without specifying an annotation, a load balancer of the type Basic with redundancy is created.

To create a load balancer with a different type, use the annotation:

loadbalancer.openstack.org/flavor-id: "<flavor_id>"

Specify <flavor_id> — flavor ID. Flavors correspond to load balancer types and determine the number of vCPUs, RAM, and the number of load balancer instances. For example, ac18763b-1fc5-457d-9fa7-b0d339ffb336 is the ID for creating an Advanced with redundancy load balancer in the ru-9 pool. You can view the list of load balancer flavors in all pools in the table or view the list of load balancer flavors in a specific pool via the OpenStack CLI.

In an already created load balancer, you cannot change the type — you need to create a new manifest with the required annotation.

Create a load balancer without a public IP address

By default, an unannotated balancer with a public IP address is created.

To create a load balancer without a public IP address, use the annotation:

service.beta.kubernetes.io/openstack-internal-load-balancer: "true"

In an already created load balancer, you cannot replace the parameter — you need to create a new manifest with the required annotation.

Create a load balancer with an IP address from other subnets

By default, a load balancer is created in the same network as the cluster nodes, and a public IP address is allocated for it.

You can create a load balancer in any other subnet — public, private, or cross-project.

Add an annotation with the subnet specification to the manifest:
```
loadbalancer.openstack.org/subnet-id: "<subnet_uuid>"
```
Specify <subnet_uuid> — subnet ID, you can view it using openstack subnet list.
Disable automatic creation of a public IP address. To do this, add the annotation:
```
service.beta.kubernetes.io/openstack-internal-load-balancer: "true"
```
Specify the load balancer IP address:
```
spec:
    type: LoadBalancer
    selector:
      app: my-app
    ports:
    - port: 80
      protocol: TCP
      name: http
    loadBalancerIP: "<ip_address>"
```
Specify <ip_address> — IP address of the load balancer from the subnet you selected in step 1.

In an already created load balancer, you cannot replace the annotation — you need to create a new manifest with the required annotation.

Add connection settings

To manage connection settings between incoming requests and the load balancer or between the load balancer and servers, use the following annotations:

maximum connections;
connection timeout for incoming requests;
connection timeout for load balancer requests to servers;
inactivity timeout;
TCP timeout.

Connection settings are configured for a load balancer rule. You can view the connection settings specified in annotations in the Control Panel: in the top menu, click Products and select Cloud Servers → Load Balancers section → Load Balancers tab → load balancer page → open the rule card → open the Advanced Rule Settings block.

Maximum connections

To specify the maximum number of connections, use the annotation:

loadbalancer.openstack.org/connection-limit: "<value>"

Specify <value> — maximum number of connections per second. Default is -1 (unlimited).

You can update the parameter in an already created load balancer.

The parameter can be viewed in the Control Panel: in the top menu, click Products and select Cloud Servers → Load Balancers section → Load Balancers tab → load balancer page → open the rule card → open the Advanced Rule Settings block → Requests to Load Balancer block → Max connections field.

Connection timeout for incoming requests

To specify the connection timeout for incoming requests to the load balancer, use the annotation:

loadbalancer.openstack.org/timeout-client-data: "<value>"

Specify <value> — timeout value in milliseconds. Default is 50000.

You can update the parameter in an already created load balancer.

Connection timeout for balancer requests to servers

To specify the connection timeout for balancer requests to servers, use the annotation:

loadbalancer.openstack.org/timeout-member-connect: "<value>"

Specify <value> — timeout value in milliseconds. Default is 5000.

You can update the parameter in an already created load balancer.

The parameter can be viewed in the Control Panel: in the top menu, click Products and select Cloud Servers → Load Balancers section → Load Balancers tab → load balancer page → open the rule card → open the Advanced Rule Settings block → Requests from Load Balancer to Servers block → Connection timeout, ms field.

Inactivity timeout

The inactivity timeout for balancer requests to servers is the time during which the current connection is considered "alive", even if no data is being transmitted.

To specify the inactivity timeout, use the annotation:

loadbalancer.openstack.org/timeout-member-data: "<value>"

Specify <value> — timeout value in milliseconds. Default is 50000.

You can update the parameter in an already created load balancer.

The parameter can be viewed in the Control Panel: in the top menu, click Products and select Cloud Servers → Load Balancers section → Load Balancers tab → load balancer page → open the rule card → open the Advanced Rule Settings block → Requests from Load Balancer to Servers block → Inactivity timeout, ms field.

TCP waiting timeout

When establishing a new TCP session, data is sometimes not transmitted immediately. The parameter defines the time during which the load balancer waits for data transmission for inspection over an already established connection.

To specify the TCP waiting timeout for balancer requests to servers, use the annotation:

loadbalancer.openstack.org/timeout-tcp-inspect: "<value>"

Specify <value> — timeout value in milliseconds. Default is 0.

You can update the parameter in an already created load balancer.

The parameter can be viewed in the Control Panel: in the top menu, click Products and select Cloud Servers → Load Balancers section → Load Balancers tab → load balancer page → open the rule card → open the Advanced Rule Settings block → Requests from Load Balancer to Servers block → TCP timeout, ms field.

Enable rule checking

To enable or disable checking for rules, use the annotation:

loadbalancer.openstack.org/enable-health-monitor: "<value>"

Specify <value> — rule validation status: true to enable validation or false to disable validation. Default is true.

You can update the parameter in an already created load balancer.

Preserve client IP address

By default, Managed Kubernetes uses externalTrafficPolicy: Cluster. This means that the client IP address is replaced with the cluster node IP address. To receive the client IP address, add the X-Forwarded-For header or a TCP → PROXY rule.

Add the X-Forwarded-For header
Add a TCP → Proxy rule

Without specifying the annotation, the load balancer passes only the original HTTP request body to the server, replacing the client IP address with its own.

For servers to receive this information for proper operation or analysis, include the X-Forwarded-For header in the request to the server. To do this, add the annotation to the manifest:

loadbalancer.openstack.org/x-forwarded-for: "true"

The rule will use the HTTP → HTTP scheme instead of TCP → TCP. If you need to use HTTPS instead of the HTTP protocol, terminate the TLS connection.

You cannot change the type of an existing load balancer — you need to create a new load balancer with the required annotation.

Do not use with the PROXY protocol. When adding a TCP → Proxy rule, the X-Forwarded-For header is automatically forwarded to the service behind the load balancer.

Reserve a public IP address

To preserve the public IP address when the load balancer is recreated, use this annotation:

loadbalancer.openstack.org/keep-floatingip: "true"

Specify this or another public IP address in the loadBalancerIP field:

spec:
  type: LoadBalancer
  selector:
    app: my-app
  ports:
  - port: 80
    protocol: TCP
    name: http
  loadBalancerIP: "<ip_address>"

You can use the annotation for an already created load balancer.