Skip to content

Load balancers

Services in a project are private: reachable from workloads on the cluster and from nowhere else. A load balancer is what publishes one.

On AWS you would choose between an Application Load Balancer and a Network Load Balancer. The same choice exists here, it is the first field on the form, and it decides which object gets created.

Prerequisites

  • A project with a service that is not already published
  • For a custom domain, the ability to add a DNS record for it

The step-by-step guide and the console walkthrough cover the operations. The rest of this page explains how it fits together.

L7 or L4

flowchart TB
    subgraph L4["L4 - load balancer"]
        direction TB
        U2["user"] -->|TCP/UDP| IP["public IP<br/>from the platform pool"]
        IP -->|forwarded untouched| S2["your Service<br/>type: LoadBalancer"]
    end
    subgraph L7["L7 - reverse proxy"]
        direction TB
        U1["user"] -->|HTTPS| ING["platform ingress<br/>terminates TLS"]
        ING -->|HTTP| RT["Route"]
        RT --> S1["your Service"]
    end
L7 L4
Object Route Service of type LoadBalancer
You get a hostname a public IP of your own
Traffic HTTP, terminated and forwarded TCP or UDP, untouched
Certificate issued for you your application's problem
Use for websites, APIs databases, game servers, anything not HTTP

Pick L7 if the service speaks HTTP. Pick L4 if it does not. The rest of the form changes with this choice, so set it first.

Hostnames

An L7 endpoint gets a subdomain of apps.grn.cloud from the label you type, and the form shows the full name as you go.

A custom domain needs a DNS record you create

Nothing creates it for you. Until the name points at the platform ingress, nothing arrives - and the endpoint looks perfectly healthy in the list the whole time.

Changing a hostname later is effectively creating a new endpoint: the old name stops working the moment it is applied.

A published service with no reachable pods

A load balancer can be created, addressed and listed as normal while no pod behind it is ready. The list gives no hint of this.

flowchart LR
    U["user"] -->|reaches| LB["load balancer<br/>looks healthy"]
    LB -->|delivers to| FW{"firewall in<br/>the project?"}
    FW -->|allow from internet| OK["service answers"]
    FW -->|only this project<br/>or cluster-only| DROP["dropped"]

A firewall set to Only this project or Anywhere in the cluster drops traffic arriving from outside, whatever the load balancer does. See Firewalls.

The other two causes are DNS for a custom domain, and a target port pointing at a port the pods do not listen on. Test from outside the cluster, not from a workload on it.

Removing a load balancer

For L7, delete the Route - it is its own object, so only the public endpoint goes.

For L4, do not delete the Service

The L4 entry is your Service. Deleting it breaks the workloads inside the cluster that were calling it too. Set its type back to ClusterIP instead: that releases the public address and leaves the service working internally.