Load Balancers

AI Tools

When you create a Kubernetes Ingress or Service, Spot automatically provisions a managed load balancer that distributes traffic to your pods. This provides an externally-accessible IP address that routes traffic to the correct ports on your cluster nodes. This doc talks about gen1 LB which is applicable for Generation-1 Data-centers and gen2 LB which is applicable for Generation-2 Data-centers .

Load Balancer Pricing:

$10 per month per load balancer. This includes:

  • Simple pricing: Fixed cost regardless of traffic volume

  • Managed infrastructure: Fully managed with no manual configuration required

  • High availability: Built-in redundancy and automatic failover capabilities

  • Standard protocols: Support for HTTP, HTTPS, TCP, and other standard protocols

Prerequisites:

Before you begin, ensure you have:

Creating a Network Load Balancer Service:

Protocol Support

Rackspace Spot Load Balancers support multiple protocols. Choose the appropriate protocol based on your application needs:

  • TCP: Default protocol for most applications (HTTP, HTTPS, database connections)

  • UDP: For applications requiring UDP traffic (DNS, gaming, streaming, VoIP)

Basic HTTP/HTTPS LoadBalancer Service

To create an external load balancer for HTTP traffic, add type: LoadBalancer to your Service manifest:

apiVersion: v1
kind: Service
metadata:
name: web-app-service
annotations:
service.beta.kubernetes.io_load-balancer-source-ranges: 0.0.0.0_0
spec:
type: LoadBalancer
selector:
app: web-app
ports:
- port: 80
targetPort: 8080
protocol: TCP # TCP is used for HTTP traffic
- port: 443
targetPort: 8443
protocol: TCP # TCP is used for HTTPS traffic

UDP LoadBalancer Service

For applications that require UDP traffic (such as DNS servers, game servers, or streaming applications):

apiVersion: v1
kind: Service
metadata:
name: udp-app-service
annotations:
service.beta.kubernetes.io_load-balancer-source-ranges: 0.0.0.0_0
spec:
type: LoadBalancer
selector:
app: udp-app
ports:
- port: 53
targetPort: 5353
protocol: UDP # Specify UDP for UDP-based applications
- port: 1194
targetPort: 1194
protocol: UDP # Example: OpenVPN UDP port

Creating via kubectl

You can alternatively create a LoadBalancer service using kubectl:

kubectl expose deployment my-app --port=80 --target-port=8080 \\
--name=my-app-service --type=LoadBalancer

Deploying Your Application:

Create a deployment to work with your LoadBalancer service:

apiVersion: apps_v1
kind: Deployment
metadata:
name: my-app
spec:
replicas: 3
selector:
matchLabels:
app: my-app
template:
metadata:
labels:
app: my-app
spec:
containers:
- name: my-app
image: nginx:latest
ports:
- containerPort: 8080

Finding Your Load Balancer IP:

Once your LoadBalancer Service is created, get the external IP address:

kubectl describe services my-app-service

Look for the LoadBalancer Ingress field in the output, which contains your external IP address. It may take a few minutes for the load balancer to be provisioned and the IP address to be assigned.

You can also check the status with:

kubectl get services my-app-service

Configuration Options:

Traffic Policies

Control how traffic is distributed using externalTrafficPolicy:

apiVersion: v1
kind: Service
metadata:
name: my-app-service
spec:
type: LoadBalancer
externalTrafficPolicy: Local # or Cluster (default)
selector:
app: my-app
ports:
- port: 80
targetPort: 8080

  • Cluster (default): Traffic may be routed to any healthy pod, potentially causing an extra network hop

  • Local: Traffic is only routed to pods on the same node, preserving source IP but potentially causing uneven distribution

Generation 1 vs Generation 2 Load Balancers

Rackspace Spot offers two generations of load balancers depending on your data center region:

Feature

Gen1 Load Balancers

Gen2 Load Balancers

Protocols

HTTP, TCP, UDP

HTTP, TCP, UDP

Source IP Preservation (HTTP Only)

X-Forwarded-For

X-Forwarded-For

PROXY Protocol

❌ Not Supported

✅ Supported

Access Lists (Source Ranges)

✅ Supported

✅ Supported

HTTPS Support

✅ Supported

✅ Supported

Regions

Gen1 data centers

Gen2 data centers (SJC-1, DFW-2)


Source IP Preservation

By default, the original client source IP is obscured. To preserve client source IP, you have different options depending on your load balancer generation:

For Both Gen1 and Gen2 Load Balancers:

X-Forwarded-For Header Method:

apiVersion: v1
kind: Service
metadata:
name: my-app-service
annotations:
loadbalancer.openstack.org/x-forwarded-for: "true"
spec:
type: LoadBalancer
externalTrafficPolicy: Local # Recommended for source IP preservation
selector:
app: my-app
ports:
- port: 80
targetPort: 8080
protocol: TCP

⚠️ Note: X-Forwarded-For is limited to HTTP-based services only and does not work with HTTPS.

For Gen2 Load Balancers Only:

PROXY Protocol Method (Recommended):

apiVersion: v1
kind: Service
metadata:
name: my-app-service
annotations:
loadbalancer.openstack.org/proxy-protocol: "true"
spec:
type: LoadBalancer
externalTrafficPolicy: Local
selector:
app: my-app
ports:
- port: 80
targetPort: 8080
protocol: TCP

⚠️ Note: When enabling PROXY protocol, your application must be configured to handle PROXY protocol. See NGINX example configuration for reference.

Access Lists (Source Ranges)

Both Gen1 and Gen2 Load Balancers allow you to restrict external access by specifying allowed IP address ranges. This is useful for limiting access to internal networks or specific client IPs.

Method 1: Using loadBalancerSourceRanges (Recommended)

apiVersion: v1
kind: Service
metadata:
name: restricted-service
spec:
type: LoadBalancer
selector:
app: my-app
loadBalancerSourceRanges:
- 192.168.0.0/24 # Allow internal network
- 203.0.113.5/32 # Allow specific IP
- 10.0.0.0/8 # Allow private network range
ports:
- port: 80
targetPort: 8080
protocol: TCP

Method 2: Using annotations

apiVersion: v1
kind: Service
metadata:
name: restricted-service
annotations:
service.beta.kubernetes.io/load-balancer-source-ranges: "192.168.0.0/24,203.0.113.5/32"
spec:
type: LoadBalancer
selector:
app: my-app
ports:
- port: 80
targetPort: 8080
protocol: TCP

Real-World Examples:

Example 1: Game Server (UDP)

For a multiplayer game server that uses UDP:

apiVersion: v1
kind: Service
metadata:
name: game-server-service
spec:
type: LoadBalancer
selector:
app: game-server
ports:
- name: game-port
port: 7777
targetPort: 7777
protocol: UDP
- name: query-port
port: 7778
targetPort: 7778
protocol: UDP

Example 2: DNS Server (UDP)

For a custom DNS server:

apiVersion: v1
kind: Service
metadata:
name: dns-server-service
annotations:
# Restrict access to specific networks
service.beta.kubernetes.io/load-balancer-source-ranges: "10.0.0.0/8,172.16.0.0/12"
spec:
type: LoadBalancer
selector:
app: dns-server
ports:
- name: dns-udp
port: 53
targetPort: 5353
protocol: UDP
- name: dns-tcp
port: 53
targetPort: 5353
protocol: TCP # DNS also supports TCP for large responses

Example 3: Mixed Protocol Service

For applications that need both TCP and UDP:

apiVersion: v1
kind: Service
metadata:
name: mixed-protocol-service
spec:
type: LoadBalancer
selector:
app: mixed-app
ports:
- name: web-http
port: 80
targetPort: 8080
protocol: TCP
- name: streaming
port: 8000
targetPort: 8000
protocol: UDP

Clean Up:

To avoid charges, delete LoadBalancer services when no longer needed:

kubectl delete svc my-app-service

This removes the Kubernetes service and deprovisions the load balancer.

Monitoring and Troubleshooting:

Checking Service Status

Monitor your LoadBalancer service:

# Check service details
kubectl get svc my-app-service -o wide

# View service events
kubectl describe svc my-app-service

# Check endpoints
kubectl get endpoints my-app-service

Common Issues

  1. Pending External IP: If the external IP shows as <pending>, wait a few minutes for provisioning to complete

  2. Connection timeouts: Verify your application is listening on the correct port and your Service targetPort matches the container port

  3. 503 errors: Check that your pods are running and healthy

Best Practices

  1. Use health checks: Ensure your application responds to health check requests

  2. Monitor costs: Each LoadBalancer service costs $10/month, view pricing breakdown in the Cost Explorer

  3. Use meaningful names: Choose descriptive names for your services and load balancers


Next to read:
High Availability

© 2023 RACKSPACE TECHNOLOGY

On This Page
Load BalancersLoad Balancer Pricing:Prerequisites:Creating a Network Load Balancer Service:Deploying Your Application:Finding Your Load Balancer IP:Configuration Options:Generation 1 vs Generation 2 Load BalancersReal-World Examples:Clean Up:Monitoring and Troubleshooting:Best PracticesProtocol SupportBasic HTTP/HTTPS LoadBalancer ServiceUDP LoadBalancer ServiceCreating via kubectlTraffic PoliciesSource IP PreservationAccess Lists (Source Ranges)Example 1: Game Server (UDP)Example 2: DNS Server (UDP)Example 3: Mixed Protocol ServiceChecking Service StatusCommon IssuesFor Both Gen1 and Gen2 Load Balancers:For Gen2 Load Balancers Only: