Skip to content

Prefer LoadBalancer, then NodePort, then Host Ports for Ingress Traffic

  • Status: accepted
  • Deciders: Product Team
  • Date: 2026-09-24

Context and Problem Statement

ADR-0008 chose between a Kubernetes-managed load balancer and host networking for the Ingress Controller. It did not account for a Service of type NodePort behind a load balancer managed outside Kubernetes. Welkin now uses Traefik as its Ingress Controller. Which exposure method should be preferred across Infrastructure Providers while allowing Platform Administrators to override the default?

Decision Drivers

  • Allow Application Developers to restrict inbound traffic to their Pods with NetworkPolicies.
  • Use Kubernetes Service-based routing when the provider can support it.
  • Support providers with load balancers managed outside Kubernetes, and deployments with no load balancer.
  • Avoid disruption when changing the Ingress exposure method.

Considered Options

  • A Kubernetes Service of type LoadBalancer.
  • A Service of type NodePort behind a load balancer managed outside Kubernetes.
  • Host ports on worker Nodes.

Decision Outcome

Prefer the options in the order listed above. Use LoadBalancer when Kubernetes can provision the external load balancer. Otherwise, use NodePort when an external load balancer can forward to the worker Nodes. Use host ports when neither Service-based method is available. The Infrastructure Provider configuration selects the default; the Platform Administrator can override it.

This decision concerns how traffic reaches the Ingress Controller. It does not require a particular Ingress Controller implementation or automatic detection of provider capabilities at runtime.

Positive Consequences

  • Service-based exposure allows NetworkPolicies to distinguish traffic from the Ingress Controller more predictably than Node-originated traffic from host networking.
  • Providers with externally managed load balancers can use a Kubernetes Service without requiring a Kubernetes cloud integration.
  • Host ports remain available for deployments without a suitable load balancer.

Negative Consequences

  • Moving between methods may require changes to load-balancer targets, firewall rules, and DNS. Coordinate these with the Apps upgrade.
  • Provider configurations and operational instructions must be kept aligned with the selected method.