LoadBalancer IPAM

Documentation Index

Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt

Use this file to discover all available pages before exploring further.

• In cloud providers (for example, EKS on AWS) creating a Service of type LoadBalancer usually triggers the cloud provider to provision a load balancer and return an external IP or DNS name (for example, an AWS ELB DNS entry).
• On-premise clusters typically use components like MetalLB to provide external IPs.
• Cilium’s LoadBalancer IPAM eliminates the need for separate tooling by allocating external IPs directly from configured pools and exposing them as the Service EXTERNAL-IP.

user1@control-plane:~$ kubectl get svc
NAME              TYPE           CLUSTER-IP     EXTERNAL-IP   PORT(S)          AGE
kubernetes        ClusterIP      10.96.0.1      <none>        443/TCP          36d
myapp-service     LoadBalancer   10.98.13.153   10.0.10.1     80:30699/TCP     170m

apiVersion: cilium.io/v2alpha1
kind: CiliumLoadBalancerIPPool
metadata:
  name: blue-pool
spec:
  blocks:
    - cidr: "10.0.10.0/24"
    - cidr: "2004::0/64"
    - start: "20.0.20.100"
      stop: "20.0.20.200"
    - start: "1.2.3.4"
  serviceSelector:
    matchLabels:
      color: red

• apiVersion / kind / metadata.name: standard Kubernetes CR metadata.
• spec.blocks: one or more blocks from which external IPs are allocated.
• spec.serviceSelector: (optional) restricts allocation to Services matching the provided labels.

• If you include spec.serviceSelector, only Services that match those labels will be eligible for external IP allocation from this pool.
• In the example above, only Services labeled color: red will be assigned IPs from blue-pool.

• Verify the pool CR exists:
  • kubectl get ciliumloadbalancerippool -A
  • kubectl describe ciliumloadbalancerippool blue-pool
• Check Service allocation:
  • kubectl get svc myapp-service -o wide
  • kubectl describe svc myapp-service
• Confirm network reachability:
  • From outside the cluster, ping or curl the EXTERNAL-IP.
  • Use network tools on upstream routers to verify routes or BGP advertisements.
• Logs and Cilium status:
  • Check Cilium agent logs on nodes for IPAM-related messages.
  • Inspect Cilium control plane status (see Cilium documentation for cluster-specific commands).

• Only include pool ranges that your network fabric can route to the cluster.
• Use selectors to separate pools by environment (prod/staging) or by tenant.
• Prefer advertising the entire pool prefix via BGP when possible — it simplifies routing and scales better than per-IP static routes.

• Cilium LoadBalancer IPAM documentation
• Kubernetes Service types
• MetalLB project
• AWS Elastic Load Balancing (ELB)
• BGP overview

• BGP advertisements from the cluster (peering with a router or BGP speaker).
• L2 (ARP/NDP) announcements so the cluster responds to neighbor discovery for the IPs.