BGP service advertisement — LoadBalancer IPs and BGP peers

BGP service advertisement allows Kubernetes LoadBalancer Services to be advertised to external routers via BGP. This lesson walks the use cases, the implementations (MetalLB, Cilium BGP), the configuration, and the discipline.

The BGP use case

flowchart LR
    A["Kubernetes Service: LoadBalancer"] --> B["MetalLB / Cilium BGP"]
    B -->|advertises| C["BGP peer: router"]
    C -->|routes traffic| D[External clients]

The use case:

• Bare metal / on-prem clusters do not have cloud-provider load balancers. BGP allows external routers to learn about Service IPs.
• Multi-cluster networking uses BGP to advertise Service IPs across clusters.
• Avoiding NAT by advertising the cluster’s Pod IPs directly to the network.

Without BGP, on-prem clusters must use NodePort or manual load balancing; with BGP, the Service IPs are routable.

MetalLB

apiVersion: metallb.io/v1beta1
kind: IPAddressPool
metadata:
  name: prod-pool
  namespace: metallb-system
spec:
  addresses:
    - 192.168.100.0/24
---
apiVersion: metallb.io/v1beta2
kind: BGPPeer
metadata:
  name: prod-router
  namespace: metallb-system
spec:
  peerAddress: 192.168.1.1
  peerASN: 64512
  myASN: 64513
---
apiVersion: metallb.io/v1beta1
kind: BGPAdvertisement
metadata:
  name: prod-advert
  namespace: metallb-system
spec:
  ipAddressPools:
    - prod-pool
  peers:
    - prod-router
  communities:
    - 64512:100

MetalLB components:

• IPAddressPool. The range of IPs that can be assigned to LoadBalancer Services.
• BGPPeer. The BGP peer (router) that will receive advertisements.
• BGPAdvertisement. The advertisement that binds the pool to the peer.

# On the router
show ip bgp neighbors 192.168.100.0/24

Verify the BGP session is established and the IPs are advertised.

MetalLB modes

flowchart LR
    A[MetalLB modes] --> B[L2 mode]
    A --> C[BGP mode]
    B --> B1["Layer 2 ARP/NDP"]
    B --> B2[Single-node failure]
    B --> B3[No router config]
    C --> C1[BGP route advertisement]
    C --> C2[Multi-node load balancing]
    C --> C3[Requires router config]

MetalLB has two modes:

• L2 mode. Uses ARP/NDP to advertise the Service IP. Simple, no router config, but limited to a single node’s worth of capacity.
• BGP mode. Uses BGP to advertise the Service IP to routers. Multi-node load balancing, but requires router configuration.

L2 mode is for small clusters; BGP mode is for production.

Cilium BGP

apiVersion: cilium.io/v2alpha1
kind: CiliumBGPPeerConfig
metadata:
  name: prod-router
spec:
  virtual-routers:
    - localASN: 64513
      peers:
        - peerASN: 64512
          peerAddress: 192.168.1.1
---
apiVersion: cilium.io/v2alpha1
kind: CiliumBGPAdvertisement
metadata:
  name: prod-advert
spec:
  advertisements:
    - advertisementType: Service
      service:
        addresses:
          - 192.168.100.0/24

Cilium BGP (Cilium 1.16+) integrates BGP into the Cilium agent. The configuration is similar to MetalLB but uses Cilium’s CRDs.

The configuration

flowchart LR
    A[Configuration] --> B[IP pool]
    A --> C[BGP peer]
    A --> D[Advertisement]
    A --> E[Communities]
    B --> B1[Range of IPs for Services]
    C --> C1["Router IP, ASN"]
    D --> D1[Binds pool to peer]
    E --> E1[Tags for routing policy]

The configuration pieces:

• IP pool. The range of IPs that can be assigned to LoadBalancer Services.
• BGP peer. The router’s IP and ASN.
• Advertisement. Binds the pool to the peer; selects which Services to advertise.
• Communities. BGP communities for routing policy on the router side.

The operational trade-offs

flowchart LR
    A[L2 mode] --> B["+ Simple, no router config"]
    A --> C[- Single-node load balancing]
    A --> D[- Slow failover]
    E[BGP mode] --> F[+ Multi-node load balancing]
    E --> G[+ Fast failover]
    E --> H[- Requires router config]
    E --> I[- Operational complexity]

The trade-offs:

L2 mode:

• Pros: Simple, no router config.
• Cons: Single-node load balancing; slow failover.

BGP mode:

• Pros: Multi-node load balancing; fast failover.
• Cons: Requires router config; operational complexity.

Quiz

The operational discipline

BGP service advertisement in production rests on five non-negotiable elements:

• Verify BGP sessions. Use show ip bgp summary on the router.
• Test failover. Disconnect a node; verify the BGP advertisement updates.
• Configure communities. Use BGP communities to tag routes for routing policy.
• Monitor BGP state. Alert on BGP session down.
• Document the topology. The IP pools, peers, and ASNs must be in the runbook.

BGP service advertisement is production networking. The discipline is to test the BGP configuration before relying on it.