Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?


Create a LoadBalancer Service

SUMMARY This topic describes how to create a Load Balancer service in Cloud-Native Contrail® Networking™.

LoadBalancer Service Overview

Juniper Networks supports LoadBalancer services using Cloud-Native Contrail Networking Release 22.1 or later in a Kubernetes-orchestrated environment.

In Kubernetes, a service is an abstract way to expose an application running on a set of pods as a network service. See Kubernetes Services.

In Contrail Networking, the Kubernetes LoadBalancer service is implemented using the InstanceIP resource and FloatingIP resource, both of which are similar to the ClusterIP service.

  • The FloatingIP is used in the service implementation to expose an external IP to the LoadBalancer service. The FloatingIP resource is also associated with the pod's VirtualMachineInterfaces.
  • The InstanceIP resource is related to the VirtualNetwork. Two instanceIPs are created, one for the service network and one for the external network.

A controller service is implemented in Contrail's Kubemanger. Kubemanager is the interface between Kubernetes core resources, and the extended Contrail resources, such as the VirtualNetwork. When you create a LoadBalancer service, Kubemanager listens and allocates the IP from an external virtual network. This external virtual network exposes the LoadBalancer service on the external IPs. Any requests received through the provisioned external IP is ECMP load-balanced across the pods associated with the LoadBalancer.

Create a LoadBalancer Service

The following sections describe how to create a LoadBalancer service in Cloud-Native Contrail Networking.


Before you create a LoadBalancer service, make sure of the following:

  • You have set up a working cloud networking environment using Kubernetes orchestration, and Cloud-Native Contrail Networking is operational.

  • You configured Kubemanager to define the external networks to be used by the LoadBalancer service.

Define an External Virtual Network

Before you create a LoadBalancer service, you must define an external virtual network. You can define the virtual network two ways, by creating a NetworkAttachmentDefinition or by creating a virtual network.


A Multus deployment requires that you only use a NetworkAttachmentDefinition to define an external network.

The following example illustrates how to define an external virtual network using a NetworkAttachmentDefinition. In this example, the external IP is allocated from the subnet range

When you apply the NetworkAttachmentDefinition, Kubemanger creates a virtual network with the name ecmp-default in the namespace ecmp-project.

Specify the External Networks

By default, Kubemanager allocates the external IP for a LoadBalancer service from the default-external network. To allocate the external IP from a different network, you must define the external network using selectors.

The following is an example of the Kubemanager YAML file specifying the default-external network selector and user-defined network selectors.

The VirtualNetworks listed below match the labels defined in Kubemanager above (in relative order).

Define Service Level Annotations

Additionally, you can define the following service level annotations to control how an external network is discovered.

Annotation: externalNetwork

In this example, the externalNetwork annotation allocates an external IP from the evn virtual network in the namespace ns.

Annotation: externalNetworkSelector

In this example, the externalNetworkSelector matches the name of the externalNetworkSelector defined in Kubemanager.


You can also define service level annotations in the namespace of the Kubernetes cluster, or in the namespace of the Contrail cluster. The service-level annotations takes precedence.

Examples: External Network Selection


The virtual networks defined in Specify the External Networks are linked to the annotations in the following examples.

The external virtual network is selected from one of the following in priority order:

Example 1: Default Selector

Kubemanager first looks for the default external network. In this example no annotation is specified, so the default-external selector is used.

Matches the network contrail/default-external-vn.

Example 2: Custom namespace

Matches the network custom-namespace/external-vn-1.

Example 3: External network matching preconfigured selector in a namespace

Matches the network custom-namespace/external-vn-1.

Example 4: External network matching preconfigured selector in service namespace

Matches the network custom-namespace/external-vn-2.

Configure LoadBalancer Services without Selectors

In Kubernetes, you can expose an application running on a set of pods as a network service. The set of pods targeted by a service is usually determined by a selector. Kubernetes uses selectors to automatically create a LoadBalancer service, but only uses the default primary interface for load balancing.

Starting in Cloud-Native Contrail Networking Release 22.3, you can load balance a service across multiple secondary interfaces. You create secondary interfaces in CN2 without using a selector. Because the LoadBalancer service has no selector, you must create the endpoint manually.

To create a secondary interface for a LoadBalancer service:

  1. Create two virtual networks using a NetworkAttachmentDefinition.
    The following example shows one network for the pod's secondary interface (pod-subnet) and another network ( lb-subnet) for the LoadBalancer service external IP. These networks are connected by a common route target which routes traffic between the two networks.
  2. Create the pods you want to load balance the service on. You can create multiple pods.
    In this example, we'll create two pods in the my-lb namespace, each with their own IP address.
  3. Create a LoadBalancer service.
    In this example, we'll create a LoadBalancer service (service-lb) in the my-lb namespace. Note that this Service YAML is not using a selector.
  4. Specify the endpoints (IP addresses) that you want to load balance the service on. In this example, two pod endpoints are specified for the secondary interfaces (ip: and ip :
    Make sure that the endpoint has the same name as the LoadBalancer service.
Success! You can now load balance a service across multiple pods with the secondary interface.

In addition to creating a LoadBalancer service on the secondary interface, you can use a selector to create a LoadBalancer service on the default primary interface. The primary interface can work in tandem with the secondary interface. You can use either interface to load balance across your desired service.

Dual-Stack Networking Support

Cloud-Native Contrail Networking supports dual-stack networking. When you start a Kubernetes cluster, dual stack is enabled by default. The Cloud-Native Contrail Networking deployer then creates dual-stack (IPv4, IPv6) pod networks and service networks. If no IP family is defined, IPv4 is automatically used.