Issue with Creating High Availability Kubernetes Cluster in CloudStack VPC - External Load Balancer IP Configuration

[hodie-aurora]

Subject: Issue with Creating High Availability Kubernetes Cluster in CloudStack VPC - External Load Balancer IP Configuration
Hello CloudStack community,
I'm trying to set up a high availability Kubernetes cluster in a VPC on Apache CloudStack, and I'm running into an issue with the external load balancer IP address. I'd really appreciate any insights or advice from those who have experience with this setup. Here's a detailed description of what I've done and the problem I'm facing:

Setup Overview:

I created a VPC named "k8s-vpc" in the "test-cloud" zone.
Within the VPC, I added a network tier called "k8s-net" with CIDR 10.1.0.0/24, network type VLAN/888, and it's implemented with default ACL allowing all.
I acquired a public IP address: 192.168.122.43 (allocated and associated with the VPC).
On this public IP, I configured load balancing:

Name: k8s-lb
Public Port: 6443
Private Port: 6443
Algorithm: Round-robin
Protocol: TCP
AutoScale: No
No instances added yet (since the cluster isn't initialized).

For port forwarding on the public IP, I haven't set any rules yet, but the LB is configured to forward traffic on 6443.

Cluster Creation Attempt:

In the Kubernetes cluster creation wizard:

Name: k8s-cluster
Description: k8s-cluster
Zone: test-cloud
Kubernetes Version: setup-v1.33.1-calico-x86_64
Compute Offering: k8s instance
Node root disk size: 8 GB
Network: k8s-net
HA enabled: Yes (toggle on)
Control nodes: 3
External Load Balancer IP Address: 192.168.122.43 (the public IP I acquired and configured for LB)
Cluster size (Worker nodes): 3
SSH Key pair: k8s-key

When I try to create the cluster with this configuration, I get the following error:
"Request failed. (530) externalloadbalanceripaddress parameter must be specified when network type is not Shared or is ROUTED network"
This is confusing because I did specify the external load balancer IP address. From the error, it seems like the system thinks the network type requires it, but perhaps my network configuration isn't recognized as Shared or ROUTED? My network tier is set to "Kubernetes Network Tier" in the selection dropdown, but in the VPC details, it's shown as VLAN.

Screenshots for Reference:

First screenshot: The "Add Instances" dialog for the load balancer showing "No Data" since no instances are bound yet.

Second screenshot: The cluster creation form with the error popup highlighting the external load balancer IP field.

Third screenshot: VPC details page showing the "k8s-net" network tier.

Fourth screenshot: Public IP addresses page showing the acquired IP 192.168.122.43.

Fifth screenshot: Load balancing configuration on the public IP with the k8s-lb rule for port 6443.

Sixth screenshot: Another view of the public IP addresses in the VPC, with the "Acquire new IP" button.

Questions:

Is my operation correct? Did I miss something in configuring the load balancer or the network?
How should the External Load Balancer IP Address typically be obtained when creating a HA K8s cluster in CloudStack? Does it need to be a specific type of IP or configured in a particular way?
Does this require creating a separate Nginx virtual machine for load balancing, or can I use CloudStack's built-in LB features?
If I leave the External Load Balancer IP Address blank, the cluster creates successfully, but will this lead to all worker nodes pointing to a single control node, causing a single point of failure if that node goes down?

If anyone has successfully set up a HA K8s cluster in a VPC like this, could you share your steps or any gotchas? I've been following the general documentation, but it seems like there might be something specific to VPCs or network types that I'm overlooking.
Thank you so much for your help! I really appreciate the community's support. Best wishes to everyone.
Best regards

[weizhouapache]

@hodie-aurora
for isolated network and VPC, you do not need to specify the external ip address

• cloudstack will allocate a Free public IP
• lb rules, port forwarding rules, are configured with the public ip automatically by ACS.
• kubernetes config uses the public ip, no matter it is HA-enabled or not.
• You do not need to configure public IP/LB/PF rules manually.

The external public ip address is required only for HA-enabled kubernetes cluster on shared network or routed networks.

• external public ip address is needed in kubernetes configuration for HA-enabled kubernetes cluster.
• it is not needed for HA-disabled kubernetes cluster.
• users need to configure lb rules (nginx, haproxy, etc) for port 6443 (kubernetes api port), it is out of ACS. kube-vip might be used as an alternative, I have not tested it.
• port forwarding rules are not needed, as vms on shared or routed network have public access.

[hodie-aurora]

@weizhouapache
Thank you so much for your detailed and helpful response! I really appreciate your contribution to the community! Wishing you, your family, and even your pets a long and healthy life, may you all live to 200!