// Module included in the following assemblies:
//
// * installing/installing_openstack/installing-openstack-cloud-config-reference.adoc

:_mod-docs-content-type: REFERENCE
[id="ccm-config-lb-options_{context}"]
= Load balancer options

[role="_abstract"]
You can configure load balancer options to control how the Cloud Controller Manager (CCM) creates and manages {rh-openstack} Octavia load balancers for services in your cluster.

[NOTE]
====
Neutron-LBaaS support is deprecated.
====

|===
| Option | Description

| `enabled`
| Enables the `LoadBalancer` service type integration. The default value is `true`.

| `floating-network-id`
| Optional. The external network used to create floating IP addresses for load balancer virtual IP addresses (VIPs). If there are multiple external networks in the cloud, you must set this option or specify the `loadbalancer.openstack.org/floating-network-id` label in the service annotation.

| `floating-subnet-id`
| Optional. The external network subnet used to create floating IP addresses for the load balancer VIP. Can be overridden by the service annotation `loadbalancer.openstack.org/floating-subnet-id`.

| `floating-subnet`
| Optional. A name pattern (glob or regular expression if starting with `~`) for the external network subnet used to create floating IP addresses for the load balancer VIP. Can be overridden by the service annotation `loadbalancer.openstack.org/floating-subnet`. If multiple subnets match the pattern, the first one with available IP addresses is used.

| `floating-subnet-tags`
| Optional. Tags for the external network subnet used to create floating IP addresses for the load balancer VIP. Can be overridden by the service annotation `loadbalancer.openstack.org/floating-subnet-tags`. If multiple subnets match these tags, the first one with available IP addresses is used.

If the {rh-openstack} network is configured with sharing disabled, for example, with the `--no-share` flag used during creation, this option is unsupported. Set the network to share to use this option.

| `lb-method`
| The load balancing algorithm used to create the load balancer pool.
For the Amphora provider the value can be `ROUND_ROBIN`, `LEAST_CONNECTIONS`, or `SOURCE_IP`. The default value is `ROUND_ROBIN`.

For the OVN provider, only the `SOURCE_IP_PORT` algorithm is supported.

For the Amphora provider, if using the `LEAST_CONNECTIONS` or `SOURCE_IP` methods, configure the `create-monitor` option as `true` in the `cloud-provider-config` config map on the `openshift-config` namespace and `ETP:Local` on the load-balancer type service to allow balancing algorithm enforcement in the client to service endpoint connections.

| `lb-provider`
| Optional. Used to specify the provider of the load balancer, for example, `amphora` or `octavia`. Only the Amphora and Octavia providers are supported.

| `lb-version`
| Optional. The load balancer API version. Only `"v2"` is supported.

| `subnet-id`
| The ID of the Networking service subnet on which load balancer VIPs are created. For dual stack deployments, leave this option unset. The OpenStack cloud provider automatically selects which subnet to use for a load balancer.

// This ID is also used to create pool members if `member-subnet-id` is not set.

// | `member-subnet-id`
// | ID of the Neutron network on which to create the members of the load balancer. The load balancer gets another network port on this subnet. Defaults to `subnet-id` if not set.

| `network-id`
| The ID of the Networking service network on which load balancer VIPs are created. Unnecessary if `subnet-id` is set. If this property is not set, the network is automatically selected based on the network that cluster nodes use.

// | `manage-security-groups`
// | If the Neutron security groups should be managed separately. Default: false

| `create-monitor`
| Creates a health monitor for the service load balancer. A health monitor is required for services that declare `externalTrafficPolicy: Local`. The default value is `false`.

This option is unsupported if you use {rh-openstack} earlier than version 17 with the `ovn` provider.

| `monitor-delay`
| The interval in seconds by which probes are sent to members of the load balancer. The default value is `5`.

| `monitor-max-retries`
| The number of successful checks that are required to change the operating status of a load balancer member to `ONLINE`. The valid range is `1` to `10`, and the default value is `1`.

| `monitor-timeout`
| The time in seconds that a monitor waits to connect to the back end before it times out. The default value is `3`.

| `internal-lb`
| Whether or not to create an internal load balancer without floating IP addresses. The default value is `false`.

// | `cascade-delete`
// | Determines whether or not to perform cascade deletion of load balancers. Default: true.

// | `flavor-id`
// | The id of the loadbalancer flavor to use. Uses octavia default if not set.

// | `availability-zone`
// | The name of the loadbalancer availability zone to use. The Octavia availability zone capabilities will not be used if it is not set. The parameter will be ignored if the Octavia version does not support availability zones yet.

| `LoadBalancerClass "ClassName"`
a| This is a config section that comprises a set of options:

 * `floating-network-id`
 * `floating-subnet-id`
 * `floating-subnet`
 * `floating-subnet-tags`
 * `network-id`
 * `subnet-id`

//  * `member-subnet-id`

The behavior of these options is the same as that of the identically named options in the load balancer section of the CCM config file.

You can set the `ClassName` value by specifying the service annotation `loadbalancer.openstack.org/class`.

// | `enable-ingress-hostname`
// | Used with proxy protocol (set by annotation `loadbalancer.openstack.org/proxy-protocol: "true"`) by adding a dns suffix (nip.io) to the load balancer IP address. Default false.

//  This option is currently a workaround for the issue https://github.com/kubernetes/ingress-nginx/issues/3996, should be removed or refactored after the Kubernetes [KEP-1860](https://github.com/kubernetes/enhancements/tree/master/keps/sig-network/1860-kube-proxy-IP-node-binding) is implemented.

// | `ingress-hostname-suffix`
// | The dns suffix to the load balancer IP address when using proxy protocol. Default nip.io

//  This option is currently a workaround for the issue https://github.com/kubernetes/ingress-nginx/issues/3996, should be removed or refactored after the Kubernetes [KEP-1860](https://github.com/kubernetes/enhancements/tree/master/keps/sig-network/1860-kube-proxy-IP-node-binding) is implemented.

// | `default-tls-container-ref`
// | Reference to a tls container. This option works with Octavia, when this option is set then the cloud provider will create an Octavia Listener of type TERMINATED_HTTPS for a TLS Terminated loadbalancer.

//  Format for tls container ref: `https://{keymanager_host}/v1/containers/{uuid}`
//  Check `container-store` parameter if you want to disable validation.

// | `container-store`
// | Optional. Used to specify the store of the tls-container-ref, e.g. "barbican" or "external" - other store will cause a warning log. Default value - `barbican` - existence of tls container ref would always be performed. If set to `external` format for tls container ref will not be validated.

| `max-shared-lb`
| The maximum number of services that can share a load balancer. The default value is `2`.
|===

// [id="ccm-config-metadata-options"]
// == Metadata options

// |===
// | Option | Description

// | `search-order`
// | This configuration key affects the way that the provider retrieves metadata that relates to the instances in which it runs. The default value of `configDrive,metadataService` results in the provider retrieving metadata that relates to the instance from, if available, the config drive first,and then the metadata service. Alternative values are:
//  * `configDrive`: Only retrieve instance metadata from the configuration drive.
//  * `metadataService`: Only retrieve instance metadata from the metadata service.
//  * `metadataService,configDrive`: Retrieve instance metadata from the metadata service first if available, and then retrieve instance metadata from the configuration drive.
// |===

// ### Multi region support (alpha)

// | environment variable `OS_CCM_REGIONAL` is set to `true` - allow CCM to set ProviderID with region name `${ProviderName}://${REGION}/${instance-id}`. Default: false.
