ServiceLB / Klipper
k3s includes a built-in load balancer so LoadBalancer Services work without a cloud provider.
On cloud Kubernetes, a Service of type LoadBalancer asks the cloud for a real load balancer. On a bare-metal or edge box there is no cloud to ask. k3s solves this with a built-in controller called ServiceLB (also known as Klipper LB).
How it works
ServiceLB runs a tiny DaemonSet Pod on each node that forwards the Service's port from the node's own IP into the cluster. The result: your LoadBalancer Service gets the node IPs as its external addresses, with no extra software.
Example
apiVersion: v1
kind: Service
metadata:
name: web-service
spec:
type: LoadBalancer
selector:
app: web
ports:
- port: 80
targetPort: 8080
# On k3s the EXTERNAL-IP column fills with the node IPs
# kubectl get svc web-serviceWhen to use it
- An on-prem team uses ServiceLB so a LoadBalancer Service gets the node's real IP as its external IP without a cloud load balancer.
- A developer tests a LoadBalancer Service locally on k3d, where ServiceLB exposes the service on the host port without additional infrastructure.
- An operator pins which nodes handle LoadBalancer traffic using the svccontroller.k3s.cattle.io/enablelb node label.
More examples
Create a LoadBalancer Service
Defines a LoadBalancer Service; ServiceLB assigns an external IP from the node's host network automatically.
apiVersion: v1
kind: Service
metadata:
name: web
spec:
type: LoadBalancer
selector:
app: web
ports:
- port: 80
targetPort: 8080Check external IP assignment
Shows the external IP assigned by ServiceLB and the svclb DaemonSet pods that forward traffic on the host.
kubectl get svc web
kubectl get pods -n kube-system | grep svclbRestrict ServiceLB to specific nodes
Labels a node so ServiceLB only deploys load-balancer forwarder pods there, limiting which IPs are advertised.
kubectl label node worker-01 svccontroller.k3s.cattle.io/enablelb=true
kubectl get pods -n kube-system -o wide | grep svclb
Discussion