KubeLB 1.5 has officially launched! This release introduces KubeLB Insights, a new fleet-wide configuration advisor, along with encrypted backend traffic and tenant-managed web application firewall rules for multi-tenant environments.
Here’s everything that’s new.
Configuration Advisor (Enterprise Edition)
When you’re managing load balancing across multiple tenants, the hardest problems are often the ones nobody can see: a tenant whose configuration never reached the proxy; a certificate that never renewed; or two tenants competing for the same hostname.
KubeLB 1.5 introduces KubeLB Insights, a fleet-wide configuration advisor that continuously scans the management cluster and surfaces these kinds of issues automatically. Fifteen built-in checks cover security, reliability, migration, and configuration hygiene, including failed certificate renewals, proxy synchronization issues, quota warnings, and hostname conflicts between tenants.
Insights is enabled by default, but a healthy installation reports nothing, and checks that don’t apply to your environment are skipped automatically. You can acknowledge, snooze, or dismiss findings, and each one links to guidance explaining what triggered it and how to fix it.
Encrypted Traffic Between the Management Cluster and Tenants (Enterprise Edition, Beta)
KubeLB runs its data plane in the management cluster and forwards traffic to your tenant clusters. Until now, that connection wasn’t encrypted, making it a common concern during security reviews.
KubeLB 1.5 introduces encrypted backend communication by deploying a managed proxy inside each tenant cluster and securing connections between the management cluster and that proxy. The feature includes:
- Encryption for both HTTP and TCP traffic
- Support for on-premises and NAT environments through configurable proxy endpoints
- Explicit confirmation before migrating existing installations
This feature is available as Beta, meaning it’s supported and ready to evaluate while the configuration may continue to evolve. We recommend validating it in staging before enabling it in production.
Tenant-Managed Web Application Firewall (Enterprise Edition)
In KubeLB 1.4, Web Application Firewall rules could only be managed by administrators. With KubeLB 1.5, tenants can now create WAF rules for their own Gateway API routes.
Platform administrators remain in control:
- Enable or disable the capability per tenant
- Validate tenant rules against an allowed policy set
- Ensure tenant rules extend, rather than replace, administrator-defined protections
This release also includes additional hardening. A previously identified security issue affecting policy handling has been resolved, and invalid firewall policies now fail safely instead of leaving traffic unintentionally unprotected.
More Reliable Routing and Troubleshooting
KubeLB 1.5 makes routing both more reliable and easier to troubleshoot.
When a route is rejected, KubeLB now records the reason directly on the tenant’s resource instead of failing silently. Resources created for rejected routes are cleaned up automatically, and tenants receive warnings when they reference services that don’t exist.
The release also improves connection reliability. Keepalives prevent intermittent failures after idle connections, Layer 4 session affinity keeps clients on the same backend across connections, and proper health checks remove unhealthy backends from rotation. Enterprise Edition also adds load balancer pools for failover, multiple GatewayClasses per tenant, and configurable timeouts for long-running transfers and slow-starting workloads.
Breaking Changes and Action Required
The KubeLB command line tool now ships with KubeLB and shares its version number: It moves to version 1.5.0, is distributed through the main KubeLB release assets, uses a new signing process, and its local server now listens only on localhost. Update any automation that verifies signatures or connects to it remotely.
Firewall policies can no longer target Ingress resources: They never actually protected Ingress traffic because it doesn’t pass through the filtered proxy, meaning those policies appeared valid while providing no protection. Move affected workloads to Gateway API routes for real firewall enforcement. In addition, firewall rule sets are now capped by default, enabling encrypted backend traffic on an existing installation requires explicit confirmation, and existing proxy connections are drained once when the new keepalive configuration is applied.
Deprecations
There are no new deprecations in KubeLB 1.5.
If you’re upgrading from 1.3, note that the global proxy topology was removed in 1.4, and capacity is now planned per tenant. KubeLB Insights can flag configurations that still reference the old setting.
How to Upgrade
Upgrade the management cluster first, then the tenant components.
Before starting, we recommend reviewing supporting chart upgrades, including newer certificate management and Gateway API versions.
The KubeLB documentation contains the complete installation and upgrade guide.
Get Started with KubeLB 1.5 Today!
If you’re already using KubeLB, upgrade to v1.5 and let KubeLB Insights run its first scan. That first report is often the clearest picture of your fleet’s current health, and if it reports nothing, that’s exactly the outcome you want.
- Check out the release on GitHub and give us a star! ;)
- Read the docs: Go through the detailed release notes and documentation for specific configuration guides.
We encourage all users to upgrade to v1.5 and explore the new capabilities that KubeLB has to offer. A huge thank you to our community, our customers, and all contributors who helped shape this release.
