How to load balance ingress traffic to UDP-based application
In a Kubernetes environment, an ingress object allows access to the Kubernetes services from outside the Kubernetes cluster. Standard Kubernetes ingress resources assume that all the traffic is HTTP-based and do not cater to non-HTTP based protocols such as TCP, UDP, and SSL. Hence, any non-HTTP applications such as DNS, FTP or LDAP cannot be exposed using the standard Kubernetes ingress.
NetScaler provides a solution using ingress annotations to load balance UDP-based ingress traffic. When you specify these annotations in the ingress resource definition, NetScaler Ingress Controller configures NetScaler to load balance UDP-based ingress traffic.
You can use the following annotations in your Kubernetes ingress resource definition to load balance the UDP-based ingress traffic:
-
ingress.citrix.com/insecure-service-type: This annotation enables L4 load balancing with UDP or ANY as a protocol for NetScaler. -
ingress.citrix.com/insecure-port: This annotation configures the port for UDP traffic. It is helpful when micro service access is required on a non-standard port. By default, port 80 is configured.
For more information about annotations, see annotations.
You can also use the standard Kubernetes solution of creating a service of type LoadBalancer with NetScaler. You can find out more about Service Type LoadBalancer in NetScaler.
Sample: Ingress definition for UDP-based ingress.
kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
ingress.citrix.com/frontend-ip: "192.168.1.1" # If you are using IPAM then use ingress.citrix.com/ipam-range: "<IPAM Range Name>"
ingress.citrix.com/insecure-port: "5084"
ingress.citrix.com/insecure-service-type: "udp"
name: udp-ingress
spec:
defaultBackend:
service:
name: frontend
port:
name: udp-53 # Service port name defined in the service defination
EOF
<!--NeedCopy-->
Sample: Service definition where the service port name is defined as udp-53:
kubectl apply -f - <<EOF
apiVersion: v1
kind: Service
metadata:
name: bind
labels:
app: bind
spec:
ports:
- name: udp-53
port: 53
targetPort: 53
protocol: UDP
selector:
name: bind
EOF
<!--NeedCopy-->
Monitor and improve the performance of your UDP-based applications
Application developers can closely monitor the health of UDP-based applications through rich monitors (such as UDP-ECV) in NetScaler. The ECV (extended content validation) monitors help in checking whether the application returns expected content or not. NetScaler Ingress Controller provides ingress.citrix.com/monitor annotation that can be used to monitor the health of the backend service. For more information on the NetScaler built-in monitors, see Built-in monitors.
Also, the application performance can be improved by using persistence methods such as Source IP. You can use these NetScaler features through Smart Annotations in Kubernetes.
The following ingress resource example uses smart annotations:
kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
ingress.citrix.com/frontend-ip: "192.168.1.1" # If you are using IPAM then use ingress.citrix.com/ipam-range: "<IPAM Range Name>"
ingress.citrix.com/insecure-port: "80"
ingress.citrix.com/lbvserver: '{"mongodb-svc":{"lbmethod":"SRCIPDESTIPHASH"}}'
ingress.citrix.com/monitor: '{"mongodbsvc":{"type":"UDP-ECV"}}'
name: mongodb
spec:
rules:
- host: mongodb.beverages.com
http:
paths:
- backend:
service:
name: mongodb-svc
port:
number: 80
path: /
pathType: Prefix
EOF
<!--NeedCopy-->
How to expose non-standard HTTP ports in the NetScaler CPX service
Sometimes you need to expose ports other than 80 and 443 in a NetScaler CPX service for allowing UDP traffic on other ports. This section provides information on how to expose other non-standard HTTP ports on the NetScaler CPX service when you deploy it in the Kubernetes cluster.
For Helm chart deployments
To expose non-standard HTTP ports while deploying NetScaler CPX with ingress controller using Helm charts, see the Helm chart installation guide.
servicePorts:
- port: 8080
protocol: UDP
name: udp0
- port: 6798
protocol: UDP
name: udp1
- port: 6379
protocol: UDP
name: udp3
<!--NeedCopy-->
For deployments using the OpenShift Operator
For deployments using the OpenShift operator, you need to edit the YAML definition to create CPX with ingress controller as specified in the step 6 of Deploy the NetScaler Ingress Controller as a sidecar with NetScaler CPX using NetScaler Operator and specify the ports as below under service section:
service:
annotation: {}
spec:
type: NodePort # ClusterIP or LoadBalancer
ports:
- port: 6790
targetPort: 6790
protocol: UDP
name: udp1
- port: 6379
targetPort: 6379
protocol: UDP
name: udp0
<!--NeedCopy-->