Chapter 19: Kubernetes Services, Ingress and Volumes

19.4 LoadBalancer — when a cloud should publish it

By Ravindra Bagale · Last updated: 25 October 2026

Why: the problem

A Hotstar match starts. Millions of phones open the score page. They need one public address that works on port 80 and 443, spreads the load over many nodes, and skips dead ones. A NodePort cannot do this alone. On a cloud like AWS, you set type: LoadBalancer on the Service. The cloud controller sees it and creates a real cloud load balancer, for example an AWS Network Load Balancer, points it at your nodes or Pods, and writes its public DNS name into the Service. You do nothing in the AWS console. Delete the Service and the load balancer goes away too. Each LoadBalancer Service costs money, about 16 to 20 US dollars a month on AWS, so teams often use one Ingress behind one load balancer for many apps. In this lesson you will create a LoadBalancer Service on kind with cloud-provider-kind, then look at the exact YAML and annotations used on EKS.

What we will build

You will run cloud-provider-kind, which gives kind clusters real LoadBalancer IPs on your laptop. You will expose the whoami Pods as type LoadBalancer, get an EXTERNAL-IP, call it, and then read the EKS version that creates an internet-facing AWS NLB.

What: every term in plain English

• LoadBalancer Service — A Service type that asks the cloud for an external load balancer.
• Cloud controller manager — The Kubernetes part that talks to the cloud API and creates load balancers.
• EXTERNAL-IP — The public IP or DNS name of the load balancer, shown in kubectl get svc.
• NLB — AWS Network Load Balancer. Works at TCP level, very fast.
• ALB — AWS Application Load Balancer. Works at HTTP level; used by Ingress.
• Annotation — A key-value note on an object that controllers read for extra settings.
• AWS Load Balancer Controller — An add-on for EKS that creates NLBs and ALBs from Services and Ingresses.
• cloud-provider-kind — A small tool that makes LoadBalancer Services work on kind.

How: step by step

1. Start a lab cluster

   kind create cluster --name lab
   kubectl get nodes
   

   What it does: Creates a one-node Kubernetes cluster inside Docker. On minikube use: minikube start.

   Output

   Creating cluster "lab" ...
    ✓ Ensuring node image (kindest/node:v1.30.0)
    ✓ Preparing nodes
   Set kubectl context to "kind-lab"
   NAME                STATUS   ROLES           AGE   VERSION
   lab-control-plane   Ready    control-plane   40s   v1.30.0
   

2. Install cloud-provider-kind

   go install sigs.k8s.io/cloud-provider-kind@v0.4.0
   

   What it does: Installs the tool with Go. Run it in a second terminal and keep it open.

   Output

   go: downloading sigs.k8s.io/cloud-provider-kind v0.4.0
   

3. Start it

   sudo ~/go/bin/cloud-provider-kind
   

   What it does: Watches for LoadBalancer Services and gives them an IP.

   Output

   I1025 10:02:11 controller.go:174] probe HTTP address https://lab-control-plane:6443
   I1025 10:02:12 controller.go:84] Creating new cloud provider for cluster lab
   

4. Make a practice namespace

   kubectl create namespace practice
   kubectl config set-context --current --namespace=practice
   

   What it does: Keeps all lab objects in one folder that is easy to delete.

   Output

   namespace/practice created
   Context "kind-lab" modified.
   

5. Run the whoami Deployment

   kubectl apply -f who.yaml && kubectl rollout status deploy/who
   

   What it does: Same three Pods as lesson 19.1.

   Output

   deployment "who" successfully rolled out
   

6. Expose as LoadBalancer

   kubectl expose deploy who --type=LoadBalancer --port=80 --name=who-lb
   

   What it does: Asks for an external load balancer.

   Output

   service/who-lb exposed
   

7. Wait for the external IP

   kubectl get svc who-lb -w
   

   What it does: First pending, then an IP.

   Output

   NAME     TYPE           CLUSTER-IP    EXTERNAL-IP   PORT(S)
   who-lb   LoadBalancer   10.96.7.201   pending       80:31544/TCP
   who-lb   LoadBalancer   10.96.7.201   172.18.0.6    80:31544/TCP
   

Example 1: Call the LoadBalancer IP and see the spread

Stack. kind + cloud-provider-kind

Goal. Call the LoadBalancer IP and see the spread.

terminal

LB=$(kubectl get svc who-lb -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
echo $LB
for i in 1 2 3 4 5 6; do curl -s $LB | grep Hostname; done

What each line does

• jsonpath ...ingress[0].ip — Reads the external IP from the Service status.
• curl -s $LB — Calls port 80 directly, no odd port.
• the loop — Shows different Pods answering.

Green output

172.18.0.6
Hostname: who-6c8f7d9b5-9xw7m
Hostname: who-6c8f7d9b5-4kq2x
Hostname: who-6c8f7d9b5-tm2zr
Hostname: who-6c8f7d9b5-9xw7m
Hostname: who-6c8f7d9b5-tm2zr
Hostname: who-6c8f7d9b5-4kq2x

Expected result. A clean IP on port 80. On a cloud this would be a public address.

Example 2: The EKS version: an internet-facing NLB with IP targets

Stack. EKS 1.30, AWS Load Balancer Controller v2.8

Goal. The EKS version: an internet-facing NLB with IP targets.

who-nlb.yaml

apiVersion: v1
kind: Service
metadata:
  name: who-nlb
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-type: external
    service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
    service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
spec:
  type: LoadBalancer
  selector:
    app: who
  ports:
  - port: 80
    targetPort: 80

terminal (EKS cluster with AWS Load Balancer Controller)

kubectl apply -f who-nlb.yaml
kubectl get svc who-nlb
curl -s http://$(kubectl get svc who-nlb -o jsonpath='{.status.loadBalancer.ingress[0].hostname}') | grep Hostname

What each line does

• aws-load-balancer-type: external — Let the AWS Load Balancer Controller handle it (not the old built-in code).
• nlb-target-type: ip — The NLB sends traffic straight to Pod IPs, skipping NodePorts.
• scheme: internet-facing — A public NLB. Use internal for a private one.
• hostname — On AWS you get a DNS name, not an IP.

Green output

service/who-nlb created
NAME      TYPE           EXTERNAL-IP                                                      PORT(S)
who-nlb   LoadBalancer   k8s-practice-whonlb-1a2b3c4d5e-0123456789.elb.ap-south-1.amazonaws.com   80:30912/TCP
Hostname: who-6c8f7d9b5-4kq2x

Expected result. AWS created an NLB for you. In Route 53 you would point a name like score.example.com to this hostname with an alias record.

Example 3: An internal load balancer limited to office IPs

Stack. EKS, private subnets

Goal. An internal load balancer limited to office IPs.

who-internal.yaml

apiVersion: v1
kind: Service
metadata:
  name: who-internal
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-type: external
    service.beta.kubernetes.io/aws-load-balancer-scheme: internal
spec:
  type: LoadBalancer
  loadBalancerSourceRanges:
  - 10.0.0.0/8
  selector:
    app: who
  ports:
  - port: 80
    targetPort: 80

What each line does

• scheme: internal — The NLB gets only private IPs inside the VPC.
• loadBalancerSourceRanges — Only these client ranges may connect.
• 10.0.0.0/8 — For example, the company VPN and VPC range.

Green output

$ kubectl get svc who-internal
NAME           TYPE           EXTERNAL-IP                                                          PORT(S)
who-internal   LoadBalancer   k8s-practice-whointer-9f8e7d6c5b-ab12cd34ef.elb.ap-south-1.amazonaws.com   80:31877/TCP

Expected result. Admin tools and internal APIs stay off the internet but still get a load balancer.

Verify: did it work?

1. Check the Service status

   kubectl get svc who-lb -o jsonpath="{.status.loadBalancer}"
   

   What it does: Shows the address the controller wrote.

   Output

   {"ingress":[{"ip":"172.18.0.6","ipMode":"Proxy"}]}
   

2. Check events

   kubectl describe svc who-lb | tail -3
   

   What it does: Shows the controller's work.

   Output

   Normal  EnsuringLoadBalancer  10s  service-controller  Ensuring load balancer
   Normal  EnsuredLoadBalancer   8s   service-controller  Ensured load balancer
   

When it is red 1

EXTERNAL-IP stays pending forever

Cause. No controller exists to create load balancers (plain kind or minikube).

Fix, step by step

1. On kind, run cloud-provider-kind. On minikube, run minikube tunnel.
2. On EKS, install the AWS Load Balancer Controller.
3. Check kubectl describe svc for events.

When it is red 2

Failed build model due to unable to resolve at least one subnet

Cause. On EKS the subnets are not tagged for load balancers.

Fix, step by step

1. Tag public subnets with kubernetes.io/role/elb = 1.
2. Tag private subnets with kubernetes.io/role/internal-elb = 1.
3. Delete and re-apply the Service.

When it is red 3

curl: (28) Connection timed out

Cause. Security group or loadBalancerSourceRanges blocks your IP.

Fix, step by step

1. Check loadBalancerSourceRanges.
2. Check the node or Pod security group allows the NLB.

Cleanup

1. Delete the LoadBalancer Services

   kubectl delete svc who-lb
   

   What it does: On a cloud this also deletes the load balancer, which stops the cost.

   Output

   service "who-lb" deleted
   

2. Delete the practice namespace

   kubectl delete namespace practice
   

   What it does: Deletes every object you made in this lesson in one go.

   Output

   namespace "practice" deleted
   

3. Delete the lab cluster

   kind delete cluster --name lab
   

   What it does: Removes the whole cluster container. On minikube use: minikube delete.

   Output

   Deleting cluster "lab" ...
   Deleted nodes: ["lab-control-plane"]
   

Practice tasks

Homework: try at home

Recap

• type LoadBalancer asks the cloud for a real load balancer.
• The address appears in EXTERNAL-IP.
• On kind use cloud-provider-kind; on EKS use the AWS Load Balancer Controller.
• Annotations choose NLB type, target type and scheme.
• Each LoadBalancer costs money; delete it after labs.

FAQ

Do I get a fixed IP on AWS?

You get a DNS name. Point your domain to it with a Route 53 alias.

NLB or ALB?

A LoadBalancer Service makes an NLB. For HTTP routing by host or path, use an Ingress with an ALB.

Can I keep the client IP?

Yes, with IP targets or externalTrafficPolicy Local.

How do I add HTTPS?

Add the aws-load-balancer-ssl-cert annotation with an ACM certificate ARN, or use an Ingress.

What about GKE and AKS?

Same type: LoadBalancer. Only the annotations differ.

Interview questions

1. What is a LoadBalancer Service?

   A Service type where the cloud controller provisions an external load balancer that forwards to the Service.

2. How does it work on EKS?

   The AWS Load Balancer Controller creates an NLB targeting instances or Pod IPs, based on annotations.

3. Why use Ingress instead of many LoadBalancers?

   To share one load balancer, add host/path routing and TLS, and cut cost.

4. How do you make an internal load balancer?

   Use the internal scheme annotation and private subnets.

5. Why might EXTERNAL-IP stay pending?

   No cloud controller, missing subnet tags, or missing IAM permissions.

Samajla ka?

Ravi Sir's Cards for this lesson

Revision cardInterview card

मराठी cards