Metallb load balancer

​

What is MetalLB?

• LoadBalancer service type support for bare metal clusters
• Automatic IP address assignment from configured pools
• Layer 2 (ARP/NDP) mode for simple network integration
• BGP mode for advanced routing scenarios
• Multiple IP address pools for different services or tenants
• Cloud-provider parity bringing the LoadBalancer experience to on-premises clusters

​

Prerequisites

1. Have a running Talos Kubernetes cluster (see the deployment guide)
2. Have kubectl configured to access your cluster
3. Have helm installed on your local machine
4. Know your available IP address range for load balancer services

• You need a range of IP addresses on your local network that are not used by DHCP
• These IPs must be in the same subnet as your cluster nodes

​

Configure Namespace Security

• Privileged: Unrestricted policy (required for system-level operations)
• Baseline: Minimally restrictive policy
• Restricted: Heavily restricted policy (most secure)

• Manipulates network interfaces and ARP/NDP tables
• Manages BGP sessions with network routers
• Performs low-level networking operations
• Interacts directly with the kernel networking stack

kubectl create namespace metallb-system

kubectl label namespace metallb-system \
  pod-security.kubernetes.io/enforce=privileged \
  pod-security.kubernetes.io/enforce-version=latest \
  pod-security.kubernetes.io/audit=privileged \
  pod-security.kubernetes.io/audit-version=latest \
  pod-security.kubernetes.io/warn=privileged \
  pod-security.kubernetes.io/warn-version=latest

• enforce=privileged: Pods violating this policy will be rejected
• audit=privileged: Policy violations are logged to the audit log
• warn=privileged: Users receive warnings for policy violations
• version=latest: Use the latest version of the policy standard

​

Add MetalLB Helm Repository

# Add the MetalLB Helm repository
helm repo add metallb https://metallb.github.io/metallb

# Update your local Helm chart repository cache
helm repo update

# Verify the repository was added
helm search repo metallb

NAME              CHART VERSION   APP VERSION   DESCRIPTION
metallb/metallb   0.15.3          v0.15.3       A network load-balancer implementation for Kub...

​

Install MetalLB

helm install metallb metallb/metallb \
  --namespace metallb-system \
  --version v0.15.3

​

MetalLB Controller

• Watches for Service objects with type: LoadBalancer
• Assigns IP addresses from configured pools
• Manages the overall state of load balancer assignments
• Runs as a Deployment (single instance with leader election)

​

MetalLB Speaker

• Announces assigned IP addresses to the network
• Runs as a DaemonSet (one pod per node)
• Handles Layer 2 (ARP/NDP) or BGP announcements
• Responds to ARP requests for assigned IPs

1. Create CustomResourceDefinitions (CRDs) for MetalLB objects
2. Deploy the MetalLB controller
3. Deploy the MetalLB speaker DaemonSet on each node
4. Set up RBAC permissions
5. Create webhook configurations

​

Configure MetalLB

apiVersion: metallb.io/v1beta1
kind: IPAddressPool
metadata:
  name: default-pool
  namespace: metallb-system
spec:
  addresses:
  - 192.168.1.240-192.168.1.250  # Replace with your IP range
---
apiVersion: metallb.io/v1beta1
kind: L2Advertisement
metadata:
  name: default-l2
  namespace: metallb-system
spec:
  ipAddressPools:
  - default-pool

​

IPAddressPool

• Defines a pool of IP addresses MetalLB can assign
• addresses: List of IP ranges or CIDR blocks
  • Example range: 192.168.1.240-192.168.1.250 (11 IPs)
  • Example CIDR: 192.168.1.240/28 (16 IPs)
• You can create multiple pools for different purposes
• Replace the example IPs with your actual available range

​

L2Advertisement

• Tells MetalLB to advertise IPs using Layer 2 protocols (ARP/NDP)
• ipAddressPools: Which IP pools to advertise via Layer 2
• Layer 2 mode is simpler but all traffic goes through one node
• For production, consider BGP mode for better load distribution

kubectl apply -f metallb-config.yaml

• Choose IPs in the same subnet as your nodes
• Ensure they’re outside your DHCP range
• Reserve enough IPs for your expected services
• Common practice: Use the high end of your subnet (e.g., .240-.250)

​

Verify Installation

kubectl get pods -n metallb-system

NAME                                  READY   STATUS    RESTARTS   AGE
metallb-controller-...                1/1     Running   0          2m
metallb-speaker-...                   1/1     Running   0          2m
metallb-speaker-...                   1/1     Running   0          2m

# Check IP address pools
kubectl get ipaddresspools -n metallb-system

# Check L2 advertisements
kubectl get l2advertisements -n metallb-system

NAME           AUTO ASSIGN   AVOID BUGGY IPS   ADDRESSES
default-pool   true          false             ["192.168.1.240-192.168.1.250"]

NAME        IPADDRESSPOOLS    IPADDRESSPOOL SELECTORS   INTERFACES
default-l2  ["default-pool"]

​

How to Use MetalLB

apiVersion: v1
kind: Service
metadata:
  name: my-app
spec:
  type: LoadBalancer  # This triggers MetalLB
  ports:
  - port: 80
    targetPort: 8080
  selector:
    app: my-app

1. Assign an IP from your configured pool
2. Announce that IP via Layer 2 (ARP/NDP)
3. Route traffic to your service’s pods
4. Update the service with the EXTERNAL-IP

​

Request Specific IP

apiVersion: v1
kind: Service
metadata:
  name: my-app
spec:
  type: LoadBalancer
  loadBalancerIP: 192.168.1.241  # Must be in a configured pool
  # ...