Skip to main content
Version: Weekly Build

Gateway and Load Balancing

Codesphere exposes two gateway services, each backed by a Kubernetes Service:

  • gateway-controller — the platform gateway, serving <base-domain> and <dc-id>.<base-domain>.
  • public-gateway-controller — the workspace gateway, serving *.<dc-id>.<base-domain>.

A third service, ssh-workspace-proxy, serves SSH traffic to workspaces at <dc-id>.ssh.<base-domain>. See Requirements and sizing and Networking, firewalls, and DNS for how these three addresses fit into the overall topology.

cluster.gateway and cluster.publicGateway​

Both are configured independently in config.yaml under cluster.gateway (platform gateway) and cluster.publicGateway (workspace gateway):

cluster:
  gateway:
    serviceType: LoadBalancer # or ExternalIP
    ipAddresses:
      - <reserved-platform-gateway-ip>
    annotations: {}
  publicGateway:
    serviceType: LoadBalancer # or ExternalIP
    ipAddresses:
      - <reserved-workspace-gateway-ip>
    annotations: {}

serviceType defaults to LoadBalancer. Use ExternalIP where the infrastructure has no native Kubernetes load-balancer integration and addresses are assigned to nodes directly instead. Use only annotations supported by the selected load-balancer implementation, or omit annotations when the implementation honors ipAddresses directly.

MetalLB​

On bare metal or other infrastructure without a native cloud load-balancer integration, enable MetalLB and define an address pool containing the reserved addresses:

metallb:
  enabled: true
  pools:
    - name: codesphere-pool
      ipAddresses:
        - <reserved-platform-gateway-ip>/32
        - <reserved-workspace-gateway-ip>/32
  l2:
    - name: codesphere-l2
      pools:
        - codesphere-pool

MetalLB also supports BGP advertisement (bgp, with myASN/peerASN/peerAddress per pool) instead of, or in addition to, layer 2 (l2) advertisement. MetalLB is disabled by default; enable it only when there is no cloud-provider load-balancer integration.

Next​

See Cluster ingress CA options for the certificates served through these gateways, and Complete the infrastructure integration for confirming the services receive their addresses after installation.