Kubermatic KubeLB
Most load balancers manage traffic for one cluster. KubeLB manages it for all of them. It runs as a shared service on a management cluster, serves load balancing to any number of tenant clusters, and sits on top of the load balancing appliances you already own, so nothing has to be replaced to get there.
A Load Balancer Built for Fleets, Not Single Clusters
Kubermatic KubeLB Overview
KubeLB is a software-based application delivery and load balancing platform for cloud-native applications. Its distributed architecture, powered by Cilium and Envoy, separates the control plane from the data plane so a single management cluster can serve hundreds of load balancers across a fleet.
It covers Layer 7 application load balancing through Ingress and the Gateway API for advanced traffic management, automated DNS and certificate management, and automated tenant registration. The SyncSecrets API handles sensitive data across cluster boundaries. Tenants interact only with KubeLB's APIs and never touch resources on the shared management cluster.
How KubeLB Works
A KubeLB management cluster runs the control plane and the Envoy data plane. Tenant clusters register with it and expose workloads through the Kubernetes resources their teams already use, while DNS, certificates, security, and AI routing stay centrally governed.
Why KubeLB?
Application Delivery and Load Balancing
Comprehensive Layer 4 and Layer 7 load balancing with full Gateway API support. Extensible and scalable, built for modern cloud-native environments.
Reduce Operational Complexity and Cost
One control plane for hundreds of load balancers. Automate tenant registration, DNS management, and certificate provisioning, eliminating manual configuration across your fleet of clusters.
Centralized Security and Governance
Enforce security policies uniformly across clusters with true multi-tenant isolation. Centralized Web Application Firewall, OIDC Authentication, Access Control, and more.
Environment Agnostic and Multi-Cloud Ready
Deploy anywhere; public cloud, private cloud, or bare metal. Flexible architecture with no vendor lock-in for your load balancing infrastructure.
Scalable Multi-Tenant Architecture
Strong tenant isolation with automated registration. Elastic scaling across multi-clusters and multi-teams with multiple gateways per tenant for flexibility and redundancy.
Built for High Availability
N-Way Active-Active redundancy ensures your applications stay online. Automatic scaling based on traffic patterns for consistent performance under load.
Key Features
Traffic Management
Layer 4 and Layer 7 load balancing for every protocol your tenants run, configured through standard Kubernetes APIs.
Layer 4 Load Balancing
Centralized Layer 4 (TCP and UDP) Load Balancing: Provision, manage, and secure Layer 4 load balancers across traditional, hybrid, and multi-cloud environments from a single, unified control plane.
TCP/UDP
Both TCP and UDP load balancers are supported along with advanced configuration support using TCPRoute and UDPRoute from Gateway API.
Ingress
Ingress support for Layer 7 Application Load Balancing.
Gateway API
Extensive Gateway API support for Application Load Balancing. Including policy-based routing, circuit breaking, rate limiting, and more.
Traffic Management
Advanced traffic management features like circuit breaking, rate limiting, failover, timeouts, retry policies and much more to ensure application resilience and quality of service.
BGP
Kubermatic KubeLB can be used with any load balancing appliance. Route advertisement protocols such as BGP, OSPF, and L2 are all supported.
Dual-stack and IPv6 only Support
Kubermatic KubeLB supports IPv4, IPv6, and dual-stack load balancing.
Security and Multi-Tenancy
Isolate tenants at the namespace and network level, then enforce one set of security policies across the whole fleet.
Web Application Firewall
Centralized WAF protection across your multi-tenant, multi-cloud fleet. Block SQL injection, XSS, and OWASP threats without any application changes. Platform teams set the fleet-wide rules, and tenants can be allowed to manage their own policies for their own routes.
Centralized Security & Authentication
Manage security including mTLS, JWT-based access control, OIDC integration, and API key authorization for all your tenants from a central point, ensuring uniformity across your environment.
mTLS Backend Transport
Encrypt traffic between the management cluster and tenant workloads end to end. KubeLB issues a certificate chain per tenant and rotates it automatically, so nothing crosses the cluster boundary in the clear.
Multi-tenant Environment
Each tenant is isolated at namespace and network level, enabling higher segregation and preventing noisy neighbor issues.
TLS
Automation to manage and provision certificates from a single control plane.
Airgap & Offline Support
Kubermatic KubeLB can be deployed in airgapped and offline environments, providing secure and scalable load balancing without requiring external connectivity.
Automation and Operations
The day-two work that scales badly by hand: DNS, certificates, migrations, and fleet-wide visibility.
Management Dashboard
Centralized management dashboard for your load balancing fleet. Monitor health, performance, and security across all your load balancers and tenants from a single pane of glass.
Insights
Continuous checks across the fleet surface hostname collisions between tenants, unprotected routes, certificate misconfiguration, and quota headroom before they turn into incidents. Findings are scored per tenant and can be acknowledged, snoozed, or dismissed in place.
Ingress to Gateway API Migrator
Automated migration from Ingress to Gateway API resources. Convert your existing ingress-nginx resources to Gateway API resources without any manual changes.
DNS Automation
DNS automation for workloads distributed among a fleet of clusters.
No Vendor Lock-in for LoadBalancing appliance
Kubermatic KubeLB can be used with any cloud-based, third-party, or bare metal load-balancer appliance or implementation.
AI and Agent Gateway
Route and secure traffic to LLMs, inference workloads, and agent tooling with the same control plane.
AI Gateway
Centralized AI Gateway support built on agentgateway, to support and secure LLM consumption across your tenants, including prompt enrichment and guardrails.
Inference Gateway
Inference Gateway support to intelligently route traffic to AI workloads running across your fleet of clusters.
Agent to Agent & MCP Gateway
Kubermatic KubeLB provides support to connect, secure, and observe agent-to-agent and agent-to-tools communication using agentgateway. Routing to Model Context Protocol (MCP) servers is also supported.
Community and Enterprise Editions
The KubeLB core is open source under Apache-2.0 and free to run in production. The Enterprise Edition adds the fleet-scale automation, security, and isolation features that larger multi-tenant platforms need.
Community Edition
Apache-2.0, free to run
- TCP/UDP load balancing and Ingress
- HTTPRoute and GRPCRoute
- Ingress to Gateway API migration
- AI and MCP Gateway
- Bring your own certificates
- DNS and certificate automation via external-dns and cert-manager
- Prometheus metrics and Grafana dashboards
- Signed artifacts, SBOMs, and vulnerability scanning
Enterprise Edition
Everything in the community, plus:
- TCPRoute, UDPRoute, and TLSRoute
- Multiple gateways per tenant and traffic policies
- Web Application Firewall, including tenant self-service policies
- mTLS backend transport (Beta)
- Stronger tenant isolation with network policies
- Managed DNS and certificates with per-tenant domains
- Insights with fleet-wide posture scoring
- Gateway and load balancer limits, load balancing policies
- Airgap and offline support, CLI tunneling
Kubermatic KubeLB has revolutionized our application delivery, seamlessly aligning with the evolution to microservices, providing unparalleled scalability, security, and management while simplifying operational complexities and proving to be an ideal solution for our modern data center requirements.
Frequently Asked Questions
What is Kubermatic KubeLB?
KubeLB is a Kubernetes-native tool for managing load balancing across many clusters from one place. It handles both Layer 4 (TCP/UDP) and Layer 7 (HTTP) traffic. It works across cloud, on-premise, and bare metal, and can plug into any existing load balancer appliance.
Is there a free, open-source load balancer for Kubernetes?
Yes, KubeLB’s core is fully open source under the Apache-2.0 license, so it’s free to run as the Community Edition. Kubermatic also offers a paid Enterprise Edition with extra features for larger deployments.
Does KubeLB support multi-tenant environments?
Yes, that’s its core design. Each tenant is isolated at the namespace and network level, so one team’s traffic can’t interfere with another’s. Tenants only interact through KubeLB’s own APIs, they have no access to resources on the shared management cluster.
Does KubeLB support AI or LLM traffic?
Yes. KubeLB includes an AI Gateway (built on agentgateway) that can securely route traffic to LLMs and AI workloads, including routing to Model Context Protocol (MCP) servers. It supports major providers like OpenAI, with more documented on the underlying agentgateway project.
Does KubeLB replace my existing load balancer hardware?
Not necessarily - it works with whatever you already have. KubeLB adds a Kubernetes-native control layer on top of any cloud, third-party, or bare-metal load balancer, so you’re not locked into one vendor’s appliance.
Can KubeLB run in air-gapped or offline environments?
Yes. KubeLB publishes complete image and Helm chart bundles for offline installs. This capability is part of the Enterprise Edition.
How is KubeLB different from MetalLB or Cilium's load balancer?
MetalLB and Cilium provide load balancing for one cluster at a time. KubeLB sits a level above that: it centrally manages load balancing across a whole fleet of clusters, and can even use MetalLB or Cilium underneath as its IP-announcement layer.
What's the best load balancer for Kubernetes?
Kubermatic KubeLB is a strong choice if you’re running more than one cluster. Unlike most load balancers, which only manage traffic for a single cluster, KubeLB manages load balancing for many clusters at once, from one central place. It works on any cloud, on-premise, or bare-metal setup, and supports both simple network traffic (Layer 4) and web traffic (Layer 7).
How do I migrate from Ingress to Gateway API in Kubernetes?
KubeLB includes a built-in migration tool that converts your existing Ingress-nginx setup to Gateway API automatically, no manual rework needed.
