Complete annotation reference for CLB configuration - Container Service for Kubernetes

Add annotations to a Kubernetes Service YAML file to configure Classic Load Balancer (CLB) instances, listeners, and backend server groups.

Before you begin

Annotation values are case-sensitive.
Check your Cloud Controller Manager (CCM) component version before using any annotation. To update the CCM, see Manage components. For version details, see Cloud Controller Manager.
Since September 11, 2019, the keyword alicloud in annotation keys changed to alibaba-cloud. Before: service.beta.kubernetes.io/alicloud-loadbalancer-id After: service.beta.kubernetes.io/alibaba-cloud-loadbalancer-id Annotations with the old alicloud keyword are still supported.

CLB instance annotations

Create an Internet-facing CLB instance

A Service with type: LoadBalancer creates an Internet-facing CLB instance by default. No annotation is required.

apiVersion: v1
kind: Service
metadata:
  name: nginx
  namespace: default
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    run: nginx
  type: LoadBalancer

Create an internal-facing CLB instance

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-address-type`	Address type of the CLB instance. Valid values: `internet`, `intranet`.	`internet`	1.9.3 and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-address-type: "intranet"
  name: nginx
  namespace: default
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    run: nginx
  type: LoadBalancer

Create a CLB instance with specified specifications

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-instance-charge-type`	Billing method of the CLB instance. Valid values: `PayBySpec` (by specification), `PayByCLCU` (by Loadbalancer Capacity Units). You cannot change the specification of a pay-by-LCU CLB instance. Do not specify `PayByCLCU` and the `loadbalancer-spec` annotation at the same time.	`PayBySpec`	2.4.0 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-spec`	CLB instance specification. Valid values: `slb.s1.small`, `slb.s2.small`, `slb.s2.medium`, `slb.s3.small`, `slb.s3.medium`, `slb.s3.large`. For details, see CreateLoadBalancer. If you update specifications through the CLB console, the CCM may restore them. The CLB console can only modify specifications for pay-by-specification instances.	`slb.s1.small`	1.9.3 and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-instance-charge-type: "PayBySpec"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-spec: "slb.s1.small"
  name: nginx
  namespace: default
spec:
  ports:
  - port: 443
    protocol: TCP
    targetPort: 443
  selector:
    run: nginx
  type: LoadBalancer

Use an existing CLB instance

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-id`	ID of an existing CLB instance. Listeners are not overwritten by default. To overwrite them, set `force-override-listeners` to `"true"`. The CCM does not overwrite listeners by default because: (1) Overwriting listeners associated with applications may cause service interruptions. (2) The CCM supports limited backend configurations and cannot handle complex ones. Overwrite listeners only when the ports are no longer in use. In CCM versions earlier than V2.10.0, you cannot add additional tags when using an existing CLB instance.	None	1.9.3.81-gca19cd4-aliyun and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-id: "<your-loadbalancer-id>"
  name: nginx
  namespace: default
spec:
  ports:
  - port: 443
    protocol: TCP
    targetPort: 443
  selector:
    run: nginx
  type: LoadBalancer

Use an existing CLB instance and force-overwrite listeners

If a listener port conflict occurs, the original listener is deleted.

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-id`	ID of the existing CLB instance. Listeners are not overwritten by default. To overwrite them, set `force-override-listeners` to `"true"`. This only overwrites listeners managed by the current Service. The CCM does not overwrite listeners by default because: (1) Overwriting listeners associated with applications may cause service interruptions. (2) The CCM supports limited backend configurations and cannot handle complex ones. In CCM versions earlier than V2.10.0, you cannot add additional tags when using an existing CLB instance.	None	1.9.3.81-gca19cd4-aliyun and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-force-override-listeners`	Whether to overwrite the listeners of the existing CLB instance. Valid values: `"true"`, `"false"`. Important If set to `"true"`, do not associate a listener of the CLB instance with multiple Services. Otherwise, a configuration conflict occurs when these Services overwrite the same listener.	`"false"`	1.9.3.81-gca19cd4-aliyun and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-id: "<your-loadbalancer-id>"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-force-override-listeners: "true"
  name: nginx
  namespace: default
spec:
  ports:
  - port: 443
    protocol: TCP
    targetPort: 443
  selector:
    run: nginx
  type: LoadBalancer

Specify the primary and secondary zones

After you specify the zones, they cannot be changed. Some regions do not support primary and secondary zones. Check the CLB instance creation page for availability.

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-master-zoneid`	ID of the primary zone.	None	1.9.3.10-gfb99107-aliyun and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-slave-zoneid`	ID of the secondary zone.	None	1.9.3.10-gfb99107-aliyun and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-master-zoneid: "cn-hangzhou-k"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-slave-zoneid: "cn-hangzhou-j"
  name: nginx
  namespace: default
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    run: nginx
  type: LoadBalancer

Create a pay-by-bandwidth CLB instance

Both annotations are required.

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-charge-type`	Metering method. Valid values: `paybytraffic`, `paybybandwidth`.	`paybytraffic`	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-bandwidth`	Maximum bandwidth in Mbit/s. Applies only to Internet-facing CLB instances. For billing details, see ModifyLoadBalancerInstanceSpec.	`50`	1.9.3.10-gfb99107-aliyun and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-charge-type: "paybybandwidth"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-bandwidth: "2"
  name: nginx
  namespace: default
spec:
  ports:
  - port: 443
    protocol: TCP
    targetPort: 443
  selector:
    run: nginx
  type: LoadBalancer

Specify a vSwitch for a CLB instance

Both annotations are required.

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-address-type`	Set to `intranet` to create an internal-facing CLB instance. Valid values: `internet`, `intranet`.	`internet`	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-vswitch-id`	ID of the vSwitch. The vSwitch and the cluster must be in the same virtual private cloud (VPC). Set `address-type` to `"intranet"` when using this annotation. Query vSwitch IDs in the VPC console.	None	1.9.3 and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-address-type: "intranet"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-vswitch-id: "<your-vswitch-id>"
  name: nginx
  namespace: default
spec:
  ports:
  - port: 443
    protocol: TCP
    targetPort: 443
  selector:
    run: nginx
  type: LoadBalancer

Specify an IP address for an internal-facing CLB instance

All three annotations are required.

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-address-type`	Set to `intranet` to create an internal-facing CLB instance. Valid values: `internet`, `intranet`.	`internet`	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-vswitch-id`	ID of the vSwitch. The vSwitch and the cluster must be in the same VPC. Query vSwitch IDs in the VPC console.	None	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-ip`	IP address of the internal-facing CLB instance. Must fall within the CIDR block of the vSwitch. Only IPv4 addresses are supported. Use with the `vswitch-id` annotation. The IP address cannot be changed after it is specified.	None	2.7.0 and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-address-type: "intranet"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-vswitch-id: "<your-vswitch-id>"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-ip: "192.168.x.x"
  name: nginx
  namespace: default
spec:
  type: LoadBalancer
  ports:
  - port: 80
    targetPort: 80
    name: http
  selector:
    app: nginx

Add additional tags to a CLB instance

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-additional-resource-tags`	Tags for the CLB instance. Format: `"k1=v1,k2=v2"`. CCM 2.10.0 and later allows modifying tags of existing or reused instances. Important After adding this annotation, tag operations performed in the CLB console may be overwritten.	None	1.9.3 and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-additional-resource-tags: "Key1=Value1,Key2=Value2"
  name: nginx
  namespace: default
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    run: nginx
  type: LoadBalancer

Create an IPv6 CLB instance

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-ip-version`	IP version of the CLB instance. Cannot be changed after it is specified. Set the kube-proxy mode of the cluster to IPVS. Valid values: `ipv4`, `ipv6`. The IPv6 address can only be used in an IPv6 network.	`ipv4`	1.9.3.220-g24b1885-aliyun and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-ip-version: "ipv6"
  name: nginx
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    app: nginx
  type: LoadBalancer

Enable deletion protection for a CLB instance

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-delete-protection`	Whether to enable deletion protection. Valid values: `on`, `off`. Important Even if you manually enable deletion protection in the CLB console for a CLB instance created for a LoadBalancer Service, running `kubectl delete svc {your-svc-name}` can still delete the CLB instance.	`on`	1.9.3.313-g748f81e-aliyun and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-delete-protection: "on"
  name: nginx
spec:
  externalTrafficPolicy: Local
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    app: nginx
  type: LoadBalancer

Enable the configuration read-only mode for a CLB instance

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-modification-protection`	Whether to enable the configuration read-only mode. Valid values: `ConsoleProtection`, `NonProtection`.	`ConsoleProtection`	1.9.3.313-g748f81e-aliyun and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-modification-protection: "ConsoleProtection"
  name: nginx
spec:
  externalTrafficPolicy: Local
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    app: nginx
  type: LoadBalancer

Specify the name of a CLB instance

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-name`	Name of the CLB instance. Must be 2 to 128 characters. Can contain letters, digits, periods (.), underscores (_), and hyphens (-). Must start with a letter.	None	1.9.3.313-g748f81e-aliyun and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-name: "your-svc-name"
  name: nginx
spec:
  externalTrafficPolicy: Local
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    app: nginx
  type: LoadBalancer

Specify the resource group for a CLB instance

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-resource-group-id`	ID of the resource group. Cannot be changed after it is specified. Query resource group IDs in the Resource Management console.	None	1.9.3.313-g748f81e-aliyun and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-resource-group-id: "rg-xxxx"
  name: nginx
spec:
  externalTrafficPolicy: Local
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    app: nginx
  type: LoadBalancer

Specify a hostname for a Service

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-protocol-port`	Protocol and port mapping. Format: `https:443,http:80`.	None	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-hostname`	Hostname for the Service. Must comply with domain name naming conventions. After adding this annotation, the external IP address of the Service changes from the CLB IP address to the hostname. If you access the CLB IP address from within the cluster, requests are first forwarded to the corresponding CLB instance. Note (1) If the listener protocol is TCP or UDP, a loop occurs when requests from within the cluster are forwarded to the CLB IP address. For details, see Why am I unable to access an SLB instance?. (2) This annotation does not automatically associate a domain name with the CLB instance. Purchase and associate a domain name separately. For details, see Purchase a domain name.	None	2.3.0 and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-protocol-port: "http:80"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-hostname: "<your-service-hostname>"
  name: nginx-svc
  namespace: default
spec:
  ports:
  - name: http
    port: 80
    protocol: TCP
    targetPort: 80
  selector:
    app: nginx
  type: LoadBalancer

Expected output:

NAME         TYPE           CLUSTER-IP       EXTERNAL-IP            PORT(S)                      AGE
nginx-svc    LoadBalancer   47.100.XX.XX     www.example.com        80:30248/TCP,443:32670/TCP   10s

Create a pay-by-LCU CLB instance

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-instance-charge-type`	Billing method. Valid values: `PayBySpec` (by specification), `PayByCLCU` (by Loadbalancer Capacity Units, or LCUs). Important You cannot change the specification of a pay-by-LCU CLB instance. Do not specify `PayByCLCU` and the `loadbalancer-spec` annotation at the same time.	`PayBySpec`	2.4.0 and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-instance-charge-type: "PayByCLCU"
  name: nginx
  namespace: default
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    run: nginx
  type: LoadBalancer

Retain automatically created CLB instances on Service deletion

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-preserve-lb-on-delete`	Retains CLB instances created by the Service when the Service is deleted. When retained, the `kubernetes.do.not.delete` and `ack.aliyun.com` tags are removed from the CLB instance and server groups. Existing servers in the server group are retained. A Warning event of the `PreservedOnDelete` type is generated during Service synchronization. Check for this event to confirm the feature is enabled. Any non-empty value enables retention. Important Delete the Service instead of modifying the Service type. Otherwise, the Service may be incorrectly re-associated with the retained CLB instances.	Not enabled	2.10.0 and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-preserve-lb-on-delete: "true"
  name: nginx
  namespace: default
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    run: nginx
  type: LoadBalancer

Listener annotations

Specify the session persistence period for a TCP listener

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-persistence-timeout`	Session persistence period in seconds. Applies only to TCP listeners. If a CLB instance has multiple TCP listeners, this setting applies to all of them. Valid values: 0 to 3600. A value of 0 disables session persistence. For details, see CreateLoadBalancerTCPListener.	`0`	1.9.3 and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-persistence-timeout: "1800"
  name: nginx
  namespace: default
spec:
  ports:
  - port: 443
    protocol: TCP
    targetPort: 443
  selector:
    run: nginx
  type: LoadBalancer

Enable session persistence for HTTP or HTTPS listeners

These annotations apply only to HTTP and HTTPS listeners. If a CLB instance has multiple HTTP or HTTPS listeners, the configuration applies to all of them.

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-sticky-session`	Whether to enable session persistence. Valid values: `on`, `off`. For details, see CreateLoadBalancerHTTPListener and CreateLoadBalancerHTTPSListener.	`off`	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-sticky-session-type`	Cookie handling method. Required when `sticky-session` is `on`. Valid values: `insert` (inserts the cookie), `server` (rewrites the cookie). For details, see CreateLoadBalancerHTTPListener and CreateLoadBalancerHTTPSListener.	None	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-cookie-timeout`	Cookie timeout period in seconds. Required when `sticky-session` is `on` and `sticky-session-type` is `insert`. Valid values: 1 to 86400. For details, see CreateLoadBalancerHTTPListener and CreateLoadBalancerHTTPSListener.	None	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-cookie`	Name of a cookie configured on a backend server. Must be 1 to 200 characters. Can contain only ASCII letters and digits. Cannot contain commas (,), semicolons (;), or spaces. Cannot start with a dollar sign ($). Required when `sticky-session` is `on` and `sticky-session-type` is `server`. For details, see CreateLoadBalancerHTTPListener and CreateLoadBalancerHTTPSListener.	None	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-protocol-port`	Protocol and port mapping. Format: `https:443,http:80`.	None	1.9.3 and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-sticky-session: "on"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-sticky-session-type: "insert"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-cookie-timeout: "1800"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-protocol-port: "http:80"
  name: nginx
  namespace: default
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    run: nginx
  type: LoadBalancer

Configure an access control list (ACL) for a CLB instance

Create an ACL in the CLB console and record the ACL ID before using these annotations. You can configure only one ACL per listener.

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-acl-status`	Whether to enable access control. Valid values: `on`, `off`.	`off`	1.9.3.164-g2105d2e-aliyun and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-acl-id`	ID of the ACL to associate with a listener. Required when `acl-status` is `"on"`.	None	1.9.3.164-g2105d2e-aliyun and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-acl-type`	ACL type. Valid values: `white` (whitelist -- only requests from listed IP addresses are forwarded; if empty, all requests are forwarded), `black` (blacklist -- requests from listed IP addresses are blocked; if empty, all requests are forwarded). Required when `acl-status` is `"on"`. Important Risks may arise if a whitelist is improperly configured. If you enable a whitelist but do not add an IP address to the ACL, all requests are forwarded.	None	1.9.3.164-g2105d2e-aliyun and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-acl-status: "on"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-acl-id: "<your-acl-id>"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-acl-type: "white"
  name: nginx
  namespace: default
spec:
  ports:
  - port: 443
    protocol: TCP
    targetPort: 443
  selector:
    run: nginx
  type: LoadBalancer

Configure port forwarding for a CLB instance

Port forwarding redirects requests from an HTTP port to an HTTPS port. All three annotations are required.

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-protocol-port`	Protocol and port mapping. Format: `https:443,http:80`.	None	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-cert-id`	Certificate ID for the CLB instance. View certificate IDs on the Certificates page of the CLB console. For details, see Use a certificate from Alibaba Cloud SSL Certificates Service.	None	1.9.3.164-g2105d2e-aliyun and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-forward-port`	Forward requests from an HTTP port to the specified HTTPS port. Format: `80:443`.	None	1.9.3.164-g2105d2e-aliyun and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-protocol-port: "https:443,http:80"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-cert-id: "<your-cert-id>"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-forward-port: "80:443"
  name: nginx
  namespace: default
spec:
  ports:
  - name: https
    port: 443
    protocol: TCP
    targetPort: 80
  - name: http
    port: 80
    protocol: TCP
    targetPort: 80
  selector:
    run: nginx
  type: LoadBalancer

Specify the scheduling algorithm for a CLB instance

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-scheduler`	Scheduling algorithm. Valid values: `wrr` (weighted round-robin -- backend servers with higher weights receive more requests), `rr` (round-robin -- requests are distributed to backend servers in sequence), `sch` (consistent hashing based on source IP), `tch` (consistent hashing based on four-tuple: source IP, destination IP, source port, destination port). For details, see the `Scheduler` field in CreateLoadBalancerTCPListener.	`rr`	1.9.3 and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-scheduler: "wrr"
  name: nginx
  namespace: default
spec:
  ports:
  - port: 443
    protocol: TCP
    targetPort: 443
  selector:
    run: nginx
  type: LoadBalancer

Create a UDP listener

No annotation is required. Set the protocol field to UDP in the Service spec.

apiVersion: v1
kind: Service
metadata:
  name: nginx
  namespace: default
spec:
  ports:
  - port: 80
    protocol: UDP
    targetPort: 80
  selector:
    run: nginx
  type: LoadBalancer

Create an HTTP listener

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-protocol-port`	Protocol and port mapping. Format: `https:443,http:80`.	None	1.9.3 and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-protocol-port: "http:80"
  name: nginx
  namespace: default
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    run: nginx
  type: LoadBalancer

Create an HTTPS listener

HTTPS listeners on the CLB instance decrypt HTTPS requests into HTTP requests and forward them to pods on the backend servers.

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-protocol-port`	Protocol and port mapping. Format: `https:443,http:80`.	None	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-cert-id`	Certificate ID for the CLB instance. View certificate IDs on the Certificates page of the CLB console. For details, see Use a certificate from Alibaba Cloud SSL Certificates Service.	None	1.9.3.164-g2105d2e-aliyun and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-protocol-port: "https:443"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-cert-id: "<your-cert-id>"
  name: nginx
  namespace: default
spec:
  ports:
  - port: 443
    protocol: TCP
    targetPort: 80
  selector:
    run: nginx
  type: LoadBalancer

Configure health checks

Enable TCP health checks

Health checks are enabled for TCP listeners by default.

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-switch`	Whether to enable health checks for a TCP or UDP listener. Valid values: `on`, `off`.	`on`	2.6.0 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-type`	Health check type. Valid values: `tcp`, `http`. For details, see CreateLoadBalancerTCPListener.	`tcp`	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-connect-timeout`	Health check timeout period in seconds. If a backend server does not return a response within this period, the server fails the health check. Valid values: 1 to 300. If the timeout value is smaller than the interval value, the timeout does not take effect. For details, see CreateLoadBalancerTCPListener.	`5`	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-healthy-threshold`	Consecutive successful health checks required before an unhealthy backend server is declared healthy (from `fail` to `success`). Valid values: 2 to 10. For details, see CreateLoadBalancerTCPListener.	`3`	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-unhealthy-threshold`	Consecutive failed health checks required before a healthy backend server is declared unhealthy. Valid values: 2 to 10. For details, see CreateLoadBalancerTCPListener.	`3`	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-interval`	Interval between health checks in seconds. Valid values: 1 to 50. For details, see CreateLoadBalancerTCPListener.	`2`	1.9.3 and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-switch: "on"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-type: "tcp"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-connect-timeout: "8"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-healthy-threshold: "4"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-unhealthy-threshold: "4"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-interval: "3"
  name: nginx
  namespace: default
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    run: nginx
  type: LoadBalancer

Enable UDP health checks

Health checks are enabled for UDP listeners by default.

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-switch`	Whether to enable health checks for a TCP or UDP listener. Valid values: `on`, `off`.	`on`	2.6.0 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-connect-timeout`	Health check timeout period in seconds. If a backend server does not return a response within this period, the server fails the health check. Valid values: 1 to 300. If the timeout value is smaller than the interval value, the timeout does not take effect. For details, see CreateLoadBalancerUDPListener.	`5`	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-healthy-threshold`	Consecutive successful health checks required before an unhealthy backend server is declared healthy. Valid values: 2 to 10. For details, see CreateLoadBalancerUDPListener.	`3`	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-unhealthy-threshold`	Consecutive failed health checks required before a healthy backend server is declared unhealthy. Valid values: 2 to 10. For details, see CreateLoadBalancerUDPListener.	`3`	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-interval`	Interval between health checks in seconds. Valid values: 1 to 50. For details, see CreateLoadBalancerUDPListener.	`2`	1.9.3 and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-switch: "on"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-interval: "5"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-connect-timeout: "10"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-healthy-threshold: "3"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-unhealthy-threshold: "3"
  name: nginx
  namespace: default
spec:
  ports:
  - port: 80
    protocol: UDP
    targetPort: 80
  selector:
    run: nginx
  type: LoadBalancer

Disable health checks for a TCP or UDP listener

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-switch`	Whether to enable health checks for a TCP or UDP listener. Valid values: `on`, `off`.	`on`	2.6.0 and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-switch: "off"
  name: nginx
  namespace: default
spec:
  ports:
  - port: 443
    protocol: TCP
    targetPort: 443
  selector:
    run: nginx
  type: LoadBalancer

Enable HTTP health checks

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-flag`	Whether to enable health checks. For TCP listeners, this is always `on` and cannot be changed. For HTTP listeners, the default is `off`. Valid values: `on`, `off`.	`off`	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-type`	Health check type. Valid values: `tcp`, `http`. For details, see CreateLoadBalancerHTTPListener.	`tcp`	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-uri`	URI for health checks. Not required for TCP health checks.	None	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-httpcode`	HTTP status code for a successful health check. Separate multiple codes with commas. Valid values: `http_2xx`, `http_3xx`, `http_4xx`, `http_5xx`. For details, see CreateLoadBalancerHTTPListener.	`http_2xx`	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-domain`	Domain name for health checks. `$_ip` uses the private IP address of the backend server. Or specify a custom domain (1 to 80 characters, can contain letters, digits, periods, and hyphens). For details, see CreateLoadBalancerHTTPListener.	None	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-timeout`	Health check timeout period in seconds. Applies to HTTP health checks. If a backend server does not respond within this period, the server fails the health check. Valid values: 1 to 300. If the timeout value is smaller than the interval value, the timeout does not take effect. For details, see CreateLoadBalancerHTTPListener.	None	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-healthy-threshold`	Consecutive successful health checks required before an unhealthy backend server is declared healthy. Valid values: 2 to 10. For details, see CreateLoadBalancerHTTPListener.	`3`	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-unhealthy-threshold`	Consecutive failed health checks required before a healthy backend server is declared unhealthy. Valid values: 2 to 10. For details, see CreateLoadBalancerHTTPListener.	`3`	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-interval`	Interval between health checks in seconds. Valid values: 1 to 50. For details, see CreateLoadBalancerHTTPListener.	`2`	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-protocol-port`	Protocol and port mapping. Format: `https:443,http:80`.	None	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-method`	Health check method for HTTP listeners. Valid values: `head`, `get`.	None	2.3.0 and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-flag: "on"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-type: "http"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-uri: "/test/index.html"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-healthy-threshold: "4"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-unhealthy-threshold: "4"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-timeout: "10"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-interval: "3"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-protocol-port: "http:80"
    # Optional: Specify the HTTP status codes for health checks.
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-httpcode: "http_4xx"
    # Optional: Specify the domain name for health checks.
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-domain: "www.aliyun.com"
    # Optional: Specify the health check method.
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-health-check-method: "head"
  name: nginx
  namespace: default
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    run: nginx
  type: LoadBalancer

Configure connection draining for a listener

Applies only to TCP and UDP listeners.

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-connection-drain`	Whether to enable connection draining. Valid values: `on`, `off`.	None	2.0.1 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-connection-drain-timeout`	Connection draining timeout period in seconds. Valid values: 10 to 900.	None	2.0.1 and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-connection-drain: "on"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-connection-drain-timeout: "30"
  name: nginx
  namespace: default
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    run: nginx
  type: LoadBalancer

Configure additional request headers for a listener

Applies only to HTTP and HTTPS listeners.

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-protocol-port`	Protocol and port mapping. Format: `https:443,http:80`.	None	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-xforwardedfor-proto`	Whether to use the `X-Forwarded-Proto` header to retrieve the listener protocol of the CLB instance. Valid values: `on`, `off`.	`off`	2.1.0 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-xforwardedfor-slbport`	Whether to use the `XForwardedFor_SLBPORT` header to retrieve the listener ports of the CLB instance. Valid values: `on`, `off`.	`off`	2.9.1 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-xforwardedfor-clientsrcport`	Whether to use the `XForwardedFor_ClientSrcPort` header to retrieve the client source port. Valid values: `on`, `off`.	`off`	2.9.1 and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-protocol-port: "http:80"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-xforwardedfor-proto: "on"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-xforwardedfor-slbport: "on"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-xforwardedfor-clientsrcport: "on"
  name: nginx
  namespace: default
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    run: nginx
  type: LoadBalancer

Specify the idle connection timeout period for a listener

Applies only to HTTP and HTTPS listeners.

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-protocol-port`	Protocol and port mapping. Format: `https:443,http:80`.	None	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-idle-timeout`	Idle connection timeout period in seconds. Valid values: 1 to 60.	`15`	2.1.0 and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-protocol-port: "http:80"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-idle-timeout: "30"
  name: nginx
  namespace: default
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    run: nginx
  type: LoadBalancer

Disable HTTP/2 for a listener

Applies only to HTTPS listeners.

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-protocol-port`	Protocol and port mapping. Format: `https:443,http:80`.	None	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-cert-id`	Certificate ID for the CLB instance. View certificate IDs on the Certificates page of the CLB console. For details, see Use a certificate from Alibaba Cloud SSL Certificates Service.	None	1.9.3.164-g2105d2e-aliyun and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-http2-enabled`	Whether to enable HTTP/2. Valid values: `on`, `off`.	`on`	2.1.0 and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-protocol-port: "https:443"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-cert-id: "<your-cert-id>"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-http2-enabled: "off"
  name: nginx
  namespace: default
spec:
  ports:
  - port: 443
    protocol: TCP
    targetPort: 80
  selector:
    run: nginx
  type: LoadBalancer

Specify the request timeout period for a listener

Applies only to HTTP and HTTPS listeners.

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-protocol-port`	Protocol and port mapping. Format: `https:443,http:80`.	None	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-request-timeout`	Request timeout period in seconds. If the backend server does not respond within this period, the CLB instance returns an HTTP 504 error to the client. Valid values: 1 to 180.	`60`	2.3.0 and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-protocol-port: "http:80"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-request-timeout: "60"
  name: nginx
  namespace: default
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    run: nginx
  type: LoadBalancer

Specify the connection timeout period for a listener

Applies only to TCP listeners.

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-established-timeout`	Connection timeout period in seconds. Valid values: 10 to 900. For details, see CreateLoadBalancerTCPListener.	None	2.3.0 and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-established-timeout: "60"
  name: nginx
  namespace: default
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    run: nginx
  type: LoadBalancer

Configure security policies for a listener

Applies only to HTTPS listeners.

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-protocol-port`	Protocol and port mapping. Format: `https:443,http:80`.	None	1.9.3 and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-cert-id`	Certificate ID for the CLB instance. View certificate IDs on the Certificates page of the CLB console. For details, see Use a certificate from Alibaba Cloud SSL Certificates Service.	None	1.9.3.164-g2105d2e-aliyun and later
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-tls-cipher-policy`	TLS security policy. Each policy contains TLS protocol versions and cipher suites for HTTPS. Valid values: `tls_cipher_policy_1_0`, `tls_cipher_policy_1_1`, `tls_cipher_policy_1_2`, `tls_cipher_policy_1_2_strict`, `tls_cipher_policy_1_2_strict_with_1_3`. For details, see CreateLoadBalancerHTTPSListener.	`tls_cipher_policy_1_0`	2.4.0 and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-protocol-port: "https:443,http:80"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-cert-id: "<your-cert-id>"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-tls-cipher-policy: "tls_cipher_policy_1_2"
  name: nginx
  namespace: default
spec:
  ports:
  - name: https
    port: 443
    protocol: TCP
    targetPort: 443
  - name: http
    port: 80
    protocol: TCP
    targetPort: 80
  selector:
    run: nginx
  type: LoadBalancer

Configure both TCP and UDP for a listener

Requires clusters running Kubernetes 1.24 and later. To update a cluster, see Manually update ACK clusters.

apiVersion: v1
kind: Service
metadata:
  name: nginx
  namespace: default
spec:
  ports:
  - name: tcp
    port: 80
    protocol: TCP
    targetPort: 80
  - name: udp
    port: 80
    protocol: UDP
    targetPort: 81
  selector:
    app: nginx
  sessionAffinity: None
  type: LoadBalancer

Configure Proxy Protocol for TCP and UDP listeners

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-proxy-protocol`	Whether to enable Proxy Protocol for a TCP or UDP listener. Passes client IP addresses to backend servers. Valid values: `on`, `off`. Important Enabling Proxy Protocol may cause service interruptions. Stop and update your applications before enabling Proxy Protocol.	`off`	2.6.0 and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-proxy-protocol: "on"
  name: nginx
  namespace: default
spec:
  ports:
  - port: 443
    protocol: TCP
    targetPort: 443
  selector:
    run: nginx
  type: LoadBalancer

Backend server group annotations

Add worker nodes with specified labels as backend servers

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-backend-label`	Labels of worker nodes to add as backend servers. Format: `"k1=v1,k2=v2"`. A node must have all specified labels to be added as a backend server.	None	1.9.3 and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-backend-label: "failure-domain.beta.kubernetes.io/zone=ap-southeast-5a"
  name: nginx
  namespace: default
spec:
  ports:
  - port: 443
    protocol: TCP
    targetPort: 443
  selector:
    run: nginx
  type: LoadBalancer

Add pods' host nodes as backend servers

By default, externalTrafficPolicy is set to Cluster. In Cluster mode, all nodes in the cluster are added as backend servers. In Local mode, only nodes on which pods are deployed are added.

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-scheduler`	Scheduling algorithm. In Local mode, set the scheduling algorithm to `wrr`. For CCM V1.9.3.164-g2105d2e-aliyun and later, node weights are calculated based on the number of pods running on each node when `externalTrafficPolicy` is set to Local. For details, see How does the CCM calculate node weights in Local mode? in the Service FAQ. Valid values: `wrr` (weighted round-robin), `rr` (round-robin).	`rr`	1.9.3 and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-scheduler: "wrr"
  name: nginx
  namespace: default
spec:
  externalTrafficPolicy: Local
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    run: nginx
  type: LoadBalancer

Remove unschedulable nodes from the backend server group

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-remove-unscheduled-backend`	Whether to remove unschedulable nodes from the backend server group. Valid values: `on` (removes unschedulable nodes), `off` (nodes set to unschedulable state by `kubectl cordon` or `kubectl drain` remain in the backend server group).	`off`	1.9.3.164-g2105d2e-aliyun and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-remove-unscheduled-backend: "on"
  name: nginx
spec:
  externalTrafficPolicy: Local
  ports:
  - name: http
    port: 30080
    protocol: TCP
    targetPort: 80
  selector:
    app: nginx
  type: LoadBalancer

Add pods with elastic network interfaces (ENIs) as backend servers

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/backend-type`	Type of resources to add as backend servers. Valid values: `eni` (adds pods for improved network forwarding performance; only works in Terway mode; you can switch from `"eni"` to `"ecs"`), `ecs` (adds ECS instances). Default behavior varies by network mode: Flannel defaults to `ecs`; Terway created before August 10, 2020 defaults to `ecs`; Terway created after August 10, 2020 defaults to `eni`.	Varies by mode	1.9.3.164-g2105d2e-aliyun and later

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/backend-type: "eni"
  name: nginx
spec:
  ports:
  - name: http
    port: 30080
    protocol: TCP
    targetPort: 80
  selector:
    app: nginx
  type: LoadBalancer

Reuse an existing vServer group

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-vgroup-port`	Reuses an existing vServer group. Only works when you use an existing CLB instance. For details, see Use the CCM to deploy services across clusters.	None	--

Specify weights for Services to enable weighted round robin

Annotation	Description	Default	CCM version
`service.beta.kubernetes.io/alibaba-cloud-loadbalancer-weight`	Traffic percentage distributed to the current Service when multiple Services share the same CLB instance. Only works when an existing vServer group is reused. For details, see Use the CCM to deploy services across clusters.	None	--

References

Considerations for configuring a LoadBalancer Service -- Service configuration considerations and CCM update policies for CLB resources.
Service FAQ -- troubleshooting for ACK Service issues, including annotations that do not take effect.