Using type LoadBalancer Service
Service Configuration Method
You can configure a LoadBalancer type Service by writing and applying a Service manifest file (example:
my-lb-svc.yaml
).
- LoadBalancer is created in the cluster Subnet by default.
- To create a LoadBalancer in a different Subnet, use the annotation service.beta.kubernetes.io/scp-load-balancer-subnet-id. For details, refer to Annotation Detailed Settings
Follow these steps to write and apply a type LoadBalancer Service.
Write a Service manifest file
my-lb-svc.yaml.Color modeapiVersion: v1 kind: Service metadata: name: my-service spec: selector: app.kubernetes.io/name: MyApp ports: - protocol: TCP port: 80 targetPort: 9376 appProtocol: tcp # Refer to LB service protocol type setting section type: LoadBalancerapiVersion: v1 kind: Service metadata: name: my-service spec: selector: app.kubernetes.io/name: MyApp ports: - protocol: TCP port: 80 targetPort: 9376 appProtocol: tcp # Refer to LB service protocol type setting section type: LoadBalancerCode block. Service manifest file my-lb-svc.yaml writing example Deploy the Service manifest using the kubectl apply command.
Color modekubectl apply -f my-lb-svc.yamlkubectl apply -f my-lb-svc.yamlCode block. Deploying Service manifest with kubectl apply command
- When a type LoadBalancer Service is created, a corresponding Load Balancer service is automatically created. It may take a few minutes for the configuration to complete.
- Do not arbitrarily modify the automatically created Load Balancer service and LB server group. Changes may be reverted or unexpected behavior may occur.
- For detailed configurable features, refer to Annotation Detailed Settings.
- Check the Load Balancer configuration using the
kubectl get servicecommand.Color mode# kubectl get service my-lb-svc NAMESPACE NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE default my-lb-svc LoadBalancer 172.20.49.206 123.123.123.123 80:32068/TCP 3m# kubectl get service my-lb-svc NAMESPACE NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE default my-lb-svc LoadBalancer 172.20.49.206 123.123.123.123 80:32068/TCP 3mCode block. Checking Load Balancer configuration with kubectl get service command
Protocol Type
You can use it by writing a Service manifest. The following is a simple example.
apiVersion: v1
kind: Service
metadata:
name: my-service
spec:
selector:
...
ports:
- port: 80
targetPort: 9376
protocol: TCP # Required (choose one of TCP, UDP)
appProtocol: tcp # Optional (leave blank or choose one of tcp, http, https)
type: LoadBalancer # Type load balancerapiVersion: v1
kind: Service
metadata:
name: my-service
spec:
selector:
...
ports:
- port: 80
targetPort: 9376
protocol: TCP # Required (choose one of TCP, UDP)
appProtocol: tcp # Optional (leave blank or choose one of tcp, http, https)
type: LoadBalancer # Type load balancerThe list of protocols (protocol and appProtocol) supported by Kubernetes Engine’s type Load Balancer Service and the settings applied to the Load Balancer service accordingly are as follows.
| Category | (k8s) protocol | (k8s) appProtocol | (LB) Service Category | (LB) LB Listener | (LB) LB Server Group | (LB) Health Check |
|---|---|---|---|---|---|---|
| L4 TCP | TCP | (tcp) | L4 | TCP {port} | TCP {nodePort} | TCP {nodePort} |
| L4 UDP | UDP | - | L4 | UDP {port} | UDP {nodePort} | TCP {nodePort} |
| L7 HTTP | TCP | http | L7 | HTTP {port} | TCP {nodePort} | TCP/HTTP {nodePort} |
| L7 HTTPS | TCP | https | L7 | HTTPS {port} | TCP {nodePort} | TCP/HTTP {nodePort} |
- According to the k8s Service manifest spec, you can specify multiple ports for a single service.
Depending on the Load Balancer service category (L4, L7), you cannot mix and use protocol layers within a single Service.
- That is, L4(TCP, UDP) and L7(HTTP, HTTPS) cannot be used together in a single Service.
L4 Service Manifest Writing Example
apiVersion: v1
kind: Service
metadata:
name: my-service
spec:
selector:
app.kubernetes.io/name: MyApp
ports:
- protocol: TCP
port: 80
targetPort: 9376
type: LoadBalancerapiVersion: v1
kind: Service
metadata:
name: my-service
spec:
selector:
app.kubernetes.io/name: MyApp
ports:
- protocol: TCP
port: 80
targetPort: 9376
type: LoadBalancerL7 Service Manifest Writing Example
apiVersion: v1
kind: Service
metadata:
annotations:
service.beta.kubernetes.io/scp-load-balancer-layer-type: "L7" # Required
service.beta.kubernetes.io/scp-load-balancer-client-cert-id: "24da35de187b450eb0cf09fb6fa146de" # Required
name: my-service
spec:
selector:
app.kubernetes.io/name: MyApp
ports:
- appProtocol: http # Required
protocol: TCP
port: 80
targetPort: 9376
- appProtocol: https # Required
protocol: TCP
port: 443
targetPort: 9898
type: LoadBalancerapiVersion: v1
kind: Service
metadata:
annotations:
service.beta.kubernetes.io/scp-load-balancer-layer-type: "L7" # Required
service.beta.kubernetes.io/scp-load-balancer-client-cert-id: "24da35de187b450eb0cf09fb6fa146de" # Required
name: my-service
spec:
selector:
app.kubernetes.io/name: MyApp
ports:
- appProtocol: http # Required
protocol: TCP
port: 80
targetPort: 9376
- appProtocol: https # Required
protocol: TCP
port: 443
targetPort: 9898
type: LoadBalancerAnnotation Detailed Settings
You can set detailed features by adding annotations to the service manifest.
apiVersion: v1
kind: Service
metatdata:
name: my-lb-svc
annotations:
service.beta.kubernetes.io/scp-load-balancer-public-ip-enabled: "true"
service.beta.kubernetes.io/scp-load-balancer-health-check-interval: "5"
service.beta.kubernetes.io/scp-load-balancer-health-check-timeout: "5"
service.beta.kubernetes.io/scp-load-balancer-health-check-count: "3"
service.beta.kubernetes.io/scp-load-balancer-session-duration-time: "300"
spec:
type: LoadBalancer
...apiVersion: v1
kind: Service
metatdata:
name: my-lb-svc
annotations:
service.beta.kubernetes.io/scp-load-balancer-public-ip-enabled: "true"
service.beta.kubernetes.io/scp-load-balancer-health-check-interval: "5"
service.beta.kubernetes.io/scp-load-balancer-health-check-timeout: "5"
service.beta.kubernetes.io/scp-load-balancer-health-check-count: "3"
service.beta.kubernetes.io/scp-load-balancer-session-duration-time: "300"
spec:
type: LoadBalancer
...- If no separate annotation is added to the service, the annotation default value is applied.
- Even if the annotation added to the service does not meet the allowed value, the annotation default value is applied.
Below is a description of all annotations available for type LoadBalancer service.
| Annotation | Protocol | Default Value | Allowed Value | Example | Description |
|---|---|---|---|---|---|
| service.beta.kubernetes.io/scp-load-balancer-source-ranges-firewall-rules | All | false | true, false | false | Automatically add firewall rules (LB source ranges → LB service IP) |
| service.beta.kubernetes.io/scp-load-balancer-snat-healthcheck-firewall-rules | All | false | true,false | false | Automatically add firewall rules (LB Source NAT IP, HealthCheck IP → member IP:Port)
|
| Annotation | Protocol | Default Value | Allowed Value | Example | Description |
|---|---|---|---|---|---|
| service.beta.kubernetes.io/scp-load-balancer-security-group-id | All | - | UUID | 92d84b44-ee71-493d-9782-3a90481ce5f3 | Automatically add rules to the Security Group corresponding to the specified ID
|
| service.beta.kubernetes.io/scp-load-balancer-security-group-name | All | - | String | security-group-1 | Automatically add rules to the Security Group corresponding to the specified Name
|
| Annotation | Protocol | Default Value | Allowed Value | Example | Description |
|---|---|---|---|---|---|
| service.beta.kubernetes.io/scp-load-balancer-layer-type | All | L4 | L4, L7 | L4 | Specify the Load Balancer service category
|
| service.beta.kubernetes.io/scp-load-balancer-subnet-id | All | - | ID | 7f05eda5e1cf4a45971227c57a6d60fa | Specify the Load Balancer Service Subnet
|
| service.beta.kubernetes.io/scp-load-balancer-service-ip | All | - | IP Address | 192.168.10.7 | Specify the Load Balancer Service IP
|
| service.beta.kubernetes.io/scp-load-balancer-public-ip-enabled | All | false | true, false | false | Specify whether to use Load Balancer Public NAT IP
|
| service.beta.kubernetes.io/scp-load-balancer-public-ip-id | All | - | ID | 4119894bd9614cef83db6f8dda667a20 | Specify the ID of the Public IP to use as the Load Balancer Public NAT IP
|
| Annotation | Protocol | Default Value | Allowed Value | Example | Description |
|---|---|---|---|---|---|
| service.beta.kubernetes.io/scp-load-balancer-idle-timeout | HTTP, HTTPS | - | 60 - 3600(in 60-second units) | 600 | Specify the LB Listener’s idle-timeout (seconds)
|
| service.beta.kubernetes.io/scp-load-balancer-session-duration-time | All | L4: 120L7: - | L4 TCP: 60 - 3600(in 60-second units)L4 UDP: 60 - 180(in 60-second units)L7: 0 - 120 | 120 | Specify the LB Listener’s session-duration-time (seconds)
|
| service.beta.kubernetes.io/scp-load-balancer-response-timeout | HTTP, HTTPS | - | 0 - 120 | 60 | Specify the LB Listener’s response-timeout (seconds)
|
| service.beta.kubernetes.io/scp-load-balancer-insert-client-ip | TCP | false | true, false | false | Specify the LB Listener’s Insert Client IP |
| service.beta.kubernetes.io/scp-load-balancer-x-forwarded-proto | HTTP, HTTPS | false | true, false | false | Specify whether to use the LB Listener’s X-Forwarded-Proto header |
| service.beta.kubernetes.io/scp-load-balancer-x-forwarded-port | HTTP, HTTPS | false | true, | false | Specify whether to use the LB Listener’s X-Forwarded-Port header |
| service.beta.kubernetes.io/scp-load-balancer-x-forwarded-for | HTTP, HTTPS | false | true, false | false | Specify whether to use the LB Listener’s X-Forwarded-For header |
| service.beta.kubernetes.io/scp-load-balancer-support-http2 | HTTP, HTTPS | false | true, false | false | Specify whether to support HTTP 2.0 for LB Listener |
| service.beta.kubernetes.io/scp-load-balancer-persistence | TCP, HTTP, HTTPS | "" | "", source-ip, cookie | source-ip | Specify the LB Listener’s persistence (one of none, source IP, cookie)
|
| service.beta.kubernetes.io/scp-load-balancer-client-cert-id | HTTPS | - | UUID | 78b9105e00324715b63700933125fa83 | Specify the ID of the LB Listener’s client SSL certificate
|
| service.beta.kubernetes.io/scp-load-balancer-client-cert-level | HTTPS | HIGH | HIGH, NORMAL, LOW | HIGH | Specify the security level of the LB Listener’s client SSL certificate |
| service.beta.kubernetes.io/scp-load-balancer-server-cert-level | HTTPS | - | HIGH, NORMAL, LOW | HIGH | Specify the security level of the LB Listener’s server SSL certificate |
| Annotation | Protocol | Default Value | Allowed Value | Example | Description |
|---|---|---|---|---|---|
| service.beta.kubernetes.io/scp-load-balancer-lb-method | All | ROUND_ROBIN | ROUND_ROBIN, LEAST_CONNECTION, IP_HASH | ROUND_ROBIN | Specify the LB server group load balancing policy |
| Annotation | Protocol | Default Value | Allowed Value | Example | Description |
|---|---|---|---|---|---|
| service.beta.kubernetes.io/scp-load-balancer-health-check-enabled | All | true | true, false | true | Specify whether to use LB health check |
| service.beta.kubernetes.io/scp-load-balancer-health-check-protocol | All | TCP | TCP, HTTP | TCP | Specify the LB health check protocol |
| service.beta.kubernetes.io/scp-load-balancer-health-check-port | All | {nodeport} | 1 - 65534 | 30000 | Specify the LB health check port
|
| service.beta.kubernetes.io/scp-load-balancer-health-check-count | All | 3 | 1 - 10 | 3 | Specify the LB health check detection count |
| service.beta.kubernetes.io/scp-load-balancer-health-check-interval | All | 5 | 1 - 180 | 5 | Specify the LB health check interval |
| service.beta.kubernetes.io/scp-load-balancer-health-check-timeout | All | 5 | 1 - 180 | 5 | Specify the LB health check timeout |
| service.beta.kubernetes.io/scp-load-balancer-health-check-http-method | HTTP | GET | GET, POST | GET | Specify the LB health check HTTP method |
| service.beta.kubernetes.io/scp-load-balancer-health-check-url | HTTP | / | String | /healthz | Specify the LB health check URL |
| service.beta.kubernetes.io/scp-load-balancer-health-check-response-code | HTTP | 200 | 200 - 500 | 200 | Specify the LB health check response code |
| service.beta.kubernetes.io/scp-load-balancer-health-check-request-data | HTTP | - | String | username=admin&password=1234 | Specify the LB health check request string
|
| service.beta.kubernetes.io/scp-load-balancer-port-{port}-health-check-enabled | All | true | true, false | true | Specify whether to use LB health check for the Service’s {port} port number |
| service.beta.kubernetes.io/scp-load-balancer-port-{port}-health-check-protocol | All | TCP | TCP, HTTP | TCP | Specify the LB health check protocol for the Service’s {port} port number |
| service.beta.kubernetes.io/scp-load-balancer-port-{port}-health-check-port | All | - | 1 - 65534 | 30000 | Specify the LB health check port for the Service’s {port} port number |
| service.beta.kubernetes.io/scp-load-balancer-port-{port}-health-check-count | All | 3 | 1 - 10 | 3 | Specify the LB health check detection count for the Service’s {port} port number |
| service.beta.kubernetes.io/scp-load-balancer-port-{port}-health-check-interval | All | 5 | 1 - 180 | 5 | Specify the LB health check interval for the Service’s {port} port number |
| service.beta.kubernetes.io/scp-load-balancer-port-{port}-health-check-timeout | All | 5 | 1 - 180 | 5 | Specify the LB health check timeout for the Service’s {port} port number |
| service.beta.kubernetes.io/scp-load-balancer-port-{port}-health-check-http-method | HTTP | GET | GET, POST | GET | Specify the LB health check HTTP method for the Service’s {port} port number |
| service.beta.kubernetes.io/scp-load-balancer-port-{port}-health-check-url | HTTP | / | String | /healthz | Specify the LB health check URL for the Service’s {port} port number |
| service.beta.kubernetes.io/scp-load-balancer-port-{port}-health-check-response-code | HTTP | 200 | 200 - 500 | 200 | Specify the LB health check response code for the Service’s {port} port number |
| service.beta.kubernetes.io/scp-load-balancer-port-{port}-health-check-request-data | HTTP | - | String | username=admin&password=1234 | Specify the LB health check request string for the Service’s {port} port number
|
Constraints
The following are constraints to consider when using Kubernetes annotations.
| Constraint | Related Annotation |
|---|---|
| Rules created in existing Security Group are not automatically deleted when changing Security Group | service.beta.kubernetes.io/scp-load-balancer-security-group-id service.beta.kubernetes.io/scp-load-balancer-security-group-name |
| Cannot change Load Balancer service category (L4/L7) | service.beta.kubernetes.io/scp-load-balancer-layer-type |
| Cannot use L4 and L7 together in the same k8s Service | service.beta.kubernetes.io/scp-load-balancer-layer-type |
| Cannot change Load Balancer subnet | service.beta.kubernetes.io/scp-load-balancer-subnet-id |
| Cannot change Load Balancer Service IP | service.beta.kubernetes.io/scp-load-balancer-service-ip |
| LB Listener idle-timeout cannot be changed from used to not used | service.beta.kubernetes.io/scp-load-balancer-idle-timeout |
| LB Listener session-duration-time cannot be changed from used to not used | service.beta.kubernetes.io/scp-load-balancer-session-duration-time |
| LB Listener response-timeout cannot be changed from used to not used | service.beta.kubernetes.io/scp-load-balancer-response-timeout |
| LB Listener idle-timeout cannot be set simultaneously with session-duration-time or response-timeout | service.beta.kubernetes.io/scp-load-balancer-idle-timeout service.beta.kubernetes.io/scp-load-balancer-session-duration-time service.beta.kubernetes.io/scp-load-balancer-response-timeout |
| Cannot use TCP and UDP together with the same port number in the same k8s Service | - |
L7 Listener’s routing rules only support the default URL path of the LB server group delivery method
| - |