Kubermatic KubeLB
Welcome to Kubermatic KubeLB, the next-generation application delivery platform designed for cloud-native architectures. As cloud-native have evolved, Kubermatic KubeLB offers a multi-tenancy approach to load balancing, providing seamless scalability, security, and management for distributed applications and teams.
Evolution of Cloud-Native Load Balancer Architectures
Monolithic Architecture Challenges
- Limited separation for multi-cluster, multi-team applications
- Difficult to adopt new technologies without network team involvement
- Inefficient scaling of individual load balancer across many clusters
- Complex, risky, and time-consuming deployments
Cloud-Native Architecture Benefits
- Rapid development and evolution of multi-tenant load balancer services
- Streamlined operation of hundreds of load balancers
- Independent deployment of services
- Efficient scaling of individual load balancers
- Utilization of Kubernetes APIs for lightweight communication
- Enhanced application scalability across teams and Kubernetes clusters
Rise of REST and Kubermatic KubeLB for Microservices Apps
Kubermatic KubeLB Overview
Kubermatic KubeLB is a software-based application delivery and load balancer platform, providing secure, scalable network services for cloud-native applications. Its distributed architecture, powered by high-performance Cilium and Envoy, offers unparalleled flexibility and scalability.
Kubermatic KubeLB introduces significant enhancements including support for Layer 7 Application load balancing through Ingress and Gateway API for advanced traffic management, automated DNS and certificate management for security and automated tenant registration. Additionally, it features the new SyncSecrets API for secure, flexible management of sensitive data alongside various other improvements and features. These upgrades streamline operations and boost performance, making Kubermatic KubeLB ideal for modern data center needs.
Key Features
Layer 4 Load Balancing
Centralized Layer 4 (TCP and UDP) Load Balancing: Provision, manage, and secure Layer 4 load balancers across traditional, hybrid, and multi-cloud environments from a single, unified control plane.
TCP/UDP
Both TCP and UDP load balancers are supported along with advanced configuration support using TCPRoute and UDPRoute from Gateway API.
Web Application Firewall
Centralized WAF protection across your multi-tenant, multi-cloud fleet. Block SQL injection, XSS, and OWASP threats without any application changes.
Management Dashboard
Centralized management dashboard for your load balancing fleet. Monitor health, performance, and security across all your load balancers and tenants from a single pane of glass.
Ingress to Gateway API Migrator
Automated migration from Ingress to Gateway API resources. Convert your existing ingress-nginx resources to Gateway API resources without any manual changes.
Agent to Agent & MCP Gateway
Kubermatic KubeLB provides support to connect, secure, and observe agent-to-agent and agent-to-tools communication using agentgateway. Routing to Model Context Protocol (MCP) servers is also supported.
Ingress
Ingress support for Layer 7 Application Load Balancing
Gateway API
Extensive Gateway API support for Application Load Balancing. Including policy-based routing, circuit breaking, rate limiting, and more.
BGP
Kubermatic KubeLB can be used with any load balancing appliance. Route advertisement protocols such as BGP, OSPF, and L2 are all supported.
Airgap & Offline Support
Kubermatic KubeLB can be deployed in airgapped and offline environments, providing secure and scalable load balancing without requiring external connectivity.
TLS
Automation to manage and provision certificates from a single control plane
DNS Automation
DNS automation for workloads distributed among a fleet of clusters
Dual-stack and IPv6 only Support
Kubermatic KubeLB supports IPv4, IPv6, and dual-stack load balancing.
Traffic Management
Advanced traffic management features like circuit breaking, rate limiting, failover, timeouts, retry policies and much more to ensure application resilience and quality of service
Centralized Security & Authentication
Manage security including mTLS, JWT-based access control, OIDC integration, and API key authorization for all your tenants from a central point, ensuring uniformity across your environment.
Multi-tenant Environment
Each tenant is isolated at namespace and network level, enabling higher segregation and preventing noisy neighbor issues.
No Vendor Lock-in for LoadBalancing appliance
Kubermatic KubeLB can be used with any cloud-based, third-party, or bare metal load-balancer appliance or implementation.
AI Gateway
Kubermatic KubeLB offers centralized AI Gateway support using Agentgateway, supporting advanced features such as:
- AI Gateway to support and secure LLM consumption
- Inference Gateway support to intelligently route to AI workloads
- Prompt Enrichment and guardrails
Why KubeLB?
Application Delivery and Load Balancing
Comprehensive Layer 4 and Layer 7 load balancing with full Gateway API support. Extensible and scalable, built for modern cloud-native environments.
Reduce Operational Complexity and Cost
One control plane for hundreds of load balancers. Automate tenant registration, DNS management, and certificate provisioning, eliminating manual configuration across your fleet of clusters.
Centralized Security and Governance
Enforce security policies uniformly across clusters with true multi-tenant isolation. Centralized Web Application Firewall, OIDC Authentication, Access Control, and more.
Environment Agnostic and Multi-Cloud Ready
Deploy anywhere; public cloud, private cloud, or bare metal. Flexible architecture with no vendor lock-in for your load balancing infrastructure.
Scalable Multi-Tenant Architecture
Strong tenant isolation with automated registration. Elastic scaling across multi-clusters and multi-teams with multiple gateways per tenant for flexibility and redundancy.
Built for High Availability
N-Way Active-Active redundancy ensures your applications stay online. Automatic scaling based on traffic patterns for consistent performance under load.
Community vs. Enterprise: Feature Breakdown
| Feature | Enterprise Edition | Community Edition |
|---|---|---|
| Load Balancing | ||
| TCP/UDP Load Balancing |  available | available |
| Ingress | available | available |
| Gateway API | ||
| HTTPRoute, GRPCRoute | available | available |
| TCPRoute, UDPRoute, TLSRoute | available |  not available |
| Multiple Gateways per tenant | available | not available |
| Traffic Policies (Client/Backend) | available | not available |
| Security | ||
| Web Application Firewall (Beta) | available | not available |
| Airgap & Offline Support | available | not available |
| Stronger tenant isolation with network policies | available | not available |
| Management | ||
| Ingress to Gateway API Migration (Beta) | available | available |
| Bring your own certificates | available | available |
| DNS automation | available | not available |
| Certificate management | available | not available |
| Gateway/LoadBalancer limits | available | not available |
| Load Balancing Policies | available | not available |
| CLI tunneling | available | not available |
| Observability | ||
| Prometheus metrics | available | available |
| Grafana dashboards | available | available |
| Supply Chain Security | ||
| Artifact signing (Cosign) | available | available |
| SBOMs | available | available |
| Vulnerability scanning | available | available |
Kubermatic KubeLB has revolutionized our application delivery, seamlessly aligning with the evolution to microservices, providing unparalleled scalability, security, and management while simplifying operational complexities and proving to be an ideal solution for our modern data center requirements.
Frequently Asked Questions
What is Kubermatic KubeLB?
KubeLB is a Kubernetes-native tool for managing load balancing across many clusters from one place. It handles both Layer 4 (TCP/UDP) and Layer 7 (HTTP) traffic. It works across cloud, on-premise, and bare metal, and can plug into any existing load balancer appliance.
Is there a free, open-source load balancer for Kubernetes?
Yes, KubeLB’s core is fully open source under the Apache-2.0 license, so it’s free to run as the Community Edition. Kubermatic also offers a paid Enterprise Edition with extra features for larger deployments.
Does KubeLB support multi-tenant environments?
Yes, that’s its core design. Each tenant is isolated at the namespace and network level, so one team’s traffic can’t interfere with another’s. Tenants only interact through KubeLB’s own APIs , they have no access to resources on the shared management cluster.
Does KubeLB support AI or LLM traffic?
Yes. KubeLB includes an AI Gateway (built on agentgateway) that can securely route traffic to LLMs and AI workloads, including routing to Model Context Protocol (MCP) servers. It supports major providers like OpenAI, with more documented on the underlying agentgateway project.
Does KubeLB replace my existing load balancer hardware?
Not necessarily - it works with whatever you already have. KubeLB adds a Kubernetes-native control layer on top of any cloud, third-party, or bare-metal load balancer, so you’re not locked into one vendor’s appliance.
Can KubeLB run in air-gapped or offline environments?
Yes. KubeLB publishes complete image and Helm chart bundles for offline installs. This capability is part of the Enterprise Edition.
How is KubeLB different from MetalLB or Cilium's load balancer?
MetalLB and Cilium provide load balancing for one cluster at a time. KubeLB sits a level above that: it centrally manages load balancing across a whole fleet of clusters, and can even use MetalLB or Cilium underneath as its IP-announcement layer.
What's the best load balancer for Kubernetes?
Kubermatic KubeLB is a strong choice if you’re running more than one cluster. Unlike most load balancers, which only manage traffic for a single cluster, KubeLB manages load balancing for many clusters at once, from one central place. It works on any cloud, on-premise, or bare-metal setup, and supports both simple network traffic (Layer 4) and web traffic (Layer 7).
How do I migrate from Ingress to Gateway API in Kubernetes?
KubeLB includes a built-in migration tool that converts your existing Ingress-nginx setup to Gateway API automatically, no manual rework needed.
