Is traffic between my Load Balancer and Kubernetes cluster over the VPC?

Question

I’m using a managed Kubernetes instance with a Load Balancer type service. I can see that all my Kubernetes nodes have an IP from the VPC subnet (10.200.0.0/16 in my case).

Looking at the control panel for my VPC resources, I can see the worker node droplets and the Load Balancer but the Load Balancer only seems to have a public IP.

My understanding is that only traffic between IPs in the VPC subnet will be “private” so it looks to me like traffic from the Load Balancer to my Kubernetes service will not be “private”.

Will the traffic be encrypted between the Load Balancer and my cluster?

Bobby · Accepted Answer

Hi there, The traffic between a managed Load Balancer and a Kubernetes cluster can indeed be within the VPC network, which is private. Basically, all resources within a VPC can communicate with each other using private networking, which doesn’t count against your bandwidth costs. A DigitalOcean Managed Load Balancer has both public and private IP addresses when used within a VPC. The public IP is used to receive traffic from the internet, while the private IP is used for communications within the VPC network. And when you create a service of type LoadBalancer in a DigitalOcean Kubernetes cluster, the managed Load Balancer is automatically configured to send traffic to your service’s nodes using their private IP addresses within the VPC. Traffic between the Load Balancer and the Kubernetes cluster is not encrypted by default. It’s worth noting that even if the Load Balancer is showing only a public IP in the control panel, that doesn’t necessarily mean it isn’t using private IPs for communication within the VPC. It’s just that the private IP may not be displayed there. You can get more information about your LoadBalancer using the kubectl CLI: kubectl describe service <LB-NAME> Hope that this helps! Best, Bobby

alexdo · Answer

Hi there, Bobby’s answer on the mechanism is right, traffic does travel over the VPC using private IPs by default, and it isn’t encrypted unless you configure it to be. Two things worth adding. On the private IP not showing in the panel: it’s not just a display gap. A related community thread has someone who asked DigitalOcean support directly about getting a Load Balancer’s private IP through the API or control panel, and the answer at the time was that there currently isn’t a documented way to retrieve it. So if you need the actual private IP for something like firewall allow-listing, don’t count on it becoming visible, DigitalOcean’s own newer answer to that same problem is to use an Internal Load Balancer instead, which is built specifically for private-only traffic and works with DOKS. On the encryption question you actually asked: if you want the traffic between the Load Balancer and your cluster genuinely encrypted rather than just private, SSL passthrough is the documented way to do that. Regular SSL termination decrypts at the Load Balancer and sends plaintext to your backends over the private network, which is what you have now. SSL passthrough instead forwards the encrypted request straight through to the Droplets’ private IPs, so the backend does its own decryption and nothing is ever plaintext, even on the private network. The tradeoff is your backends need the certificate themselves, and you lose sticky sessions and the X-Forwarded-* headers in that mode. Regards

Become a contributor for community

DigitalOcean Documentation

Resources for startups and AI-native businesses

The developer cloud

Start building today

Report this

Is traffic between my Load Balancer and Kubernetes cluster over the VPC?

Related questions

App Platform load balancing

Load Balancers dropping requests with a fixed pattern

how do i connect my account to zoiper

Is Firewall Disrupting Load Balancer Health-checks?

Load balancer: Add IP / hash based sticky sessions

What is the recommended load balancer setup for a real-time ride platform?

Regional Load Balancing to a Cloudflare DNS

how to create a global load balancer in doks

Issues with DO Kubernetes, Load Balancers and SSL

Load Balancer Sticky Cookie (Kubernetes)

How to get Client IP using DO Loadbalancer and APISIX as ingress controller

How can I clone DigitalOcean Droplets to ensure they stay identical and in sync for use in a load balancer?

Report this

Is traffic between my Load Balancer and Kubernetes cluster over the VPC?

Related questions

App Platform load balancing

Load Balancers dropping requests with a fixed pattern

how do i connect my account to zoiper

Is Firewall Disrupting Load Balancer Health-checks?

Load balancer: Add IP / hash based sticky sessions

What is the recommended load balancer setup for a real-time ride platform?

Regional Load Balancing to a Cloudflare DNS

how to create a global load balancer in doks

Issues with DO Kubernetes, Load Balancers and SSL

Load Balancer Sticky Cookie (Kubernetes)

How to get Client IP using DO Loadbalancer and APISIX as ingress controller

How can I clone DigitalOcean Droplets to ensure they stay identical and in sync for use in a load balancer?