---
title: "Load Balancer Configuration Parameters | Hostman Docs"
description: "Reference guide to all annotations for configuring Kubernetes load balancers, including balancing algorithms, health checks, timeouts, and SSL."
---

> For the complete documentation index for AI agents, see [llms.txt](https://hostman.com/llms.txt).

This article lists all parameters available for configuring a load balancer in Kubernetes. Use them to fine-tune balancing behavior, health checks, timeouts, and more.

## Available Parameters

Below is a table summarizing the available parameters for configuring a load balancer. Each parameter is specified as an annotation in the `Service` manifest:

| **Parameter** | **Purpose** |
| --- | --- |
| `k8s.hostman.com/attached-loadbalancer-preset-id: "391"` | Specifies the load balancer configuration. The default is the minimum configuration for the zone. Get preset IDs via API. |
| `k8s.hostman.com/attached-loadbalancer-algo: "roundrobin"` | Balancing algorithm: `roundrobin` or `leastconn`. |
| `k8s.hostman.com/attached-loadbalancer-healthcheck-check-interval: "10"` | Interval between health checks (in seconds). |
| `k8s.hostman.com/attached-loadbalancer-healthcheck-timeout: "5"` | Timeout for health checks (in seconds). |
| `k8s.hostman.com/attached-loadbalancer-healthcheck-error-count: "3"` | Number of failed checks before marking an upstream as unavailable. |
| `k8s.hostman.com/attached-loadbalancer-healthcheck-recover-count: "2"` | Number of successful checks needed to recover an upstream. |
| `k8s.hostman.com/attached-loadbalancer-no-external-ip: "true"` | Disables a public external IP for the load balancer. |
| `k8s.hostman.com/ignore-hostman-loadbalancer: "true"` | Excludes the service from Hostman load balancing. Useful when operating with a different LoadBalancer, such as `kube-vip` or `MetalLB`. |
| `k8s.hostman.com/attached-loadbalancer-ddos-guard-external-ip: "true"` | Assigns an external IP with DDoS protection. |
| `k8s.hostman.com/attached-loadbalancer-proxy-enable: "true"` | Enables proxy mode for the load balancer. When using this annotation, the receiving application (for example, an ingress controller or proxy) must also be configured to accept the proxy protocol. Otherwise, requests may fail with errors (for example, HTTP 400). See configuration examples in the official documentation: [Ingress NGINX](https://kubernetes.github.io/ingress-nginx/user-guide/miscellaneous/), [Traefik](https://doc.traefik.io/traefik/master/reference/install-configuration/entrypoints/). |
| `k8s.hostman.com/attached-loadbalancer-connect-timeout: "5000"` | Timeout for establishing a TCP connection with the upstream (in milliseconds). |
| `k8s.hostman.com/attached-loadbalancer-client-timeout: "50000"` | Timeout for receiving new TCP segments from the client (in milliseconds). |
| `k8s.hostman.com/attached-loadbalancer-server-timeout: "50000"` | Timeout for waiting for a response from the backend (in milliseconds). |
| `k8s.hostman.com/attached-loadbalancer-http-request-timeout: "10000"` | Timeout for executing an HTTP request (in milliseconds). |
| `k8s.hostman.com/attached-loadbalancer-maxconn: "10000"` | Maximum number of connections the load balancer can handle on the frontend. |
| `k8s.hostman.com/attached-loadbalancer-ssl: "true"` | Enables automatic SSL certificate issuance. If set to false, the certificate will be deleted. |
| `k8s.hostman.com/attached-loadbalancer-ssl-fqdn: "example.com"` | The domain for which the SSL certificate should be issued. |
| `k8s.hostman.com/attached-loadbalancer-ssl-type: "lets_encrypt"` | Specifies the SSL certificate type for the load balancer. Supported values: `lets_encrypt` and `custom`. |
| `k8s.hostman.com/attached-loadbalancer-force-ssl: "true"` | Enables automatic HTTP to HTTPS redirection using HTTP status code `307`. Requires a valid SSL certificate configuration through both `attached-loadbalancer-ssl` and `attached-loadbalancer-ssl-fqdn`. |

## Fine-Tuning with Annotations

For more flexible load balancer configuration in Kubernetes, you can use additional parameters. These are specified as `annotations` in the `Service` manifest.

Here’s an example manifest with parameters set via `annotations`:

```shell
apiVersion: v1
kind: Service
metadata:
  name: example-balancer
  namespace: kubernetes-dashboard
  labels:
    app: nginx
  annotations:
    k8s.hostman.com/attached-loadbalancer-algo: "leastconn"    
    k8s.hostman.com/attached-loadbalancer-ddos-guard-external-ip: "true" 
spec:
  selector:
    app.kubernetes.io/name: nginx
  ports:
    - port: 80
      appProtocol: k8s.hostman.com/proto-http
      targetPort: 80
  type: LoadBalancer
```

In this example, two additional parameters are defined:

-   `k8s.hostman.com/attached-loadbalancer-algo` is the load balancing algorithm. Here: `leastconn` (selects the server with the fewest active connections).
    
-   `k8s.hostman.com/attached-loadbalancer-ddos-guard-external-ip` assigns an external IP address to the load balancer with DDoS protection.
    

> [!NOTE]
> You can also define additional parameters via `labels`, but this is a legacy approach—some parameters may not apply correctly when using `labels`. We recommend using `annotations` instead.

## Service Annotations

In addition to user-defined parameters, the system may automatically add service annotations.

For example:

```yaml
metadata:
 annotations:
   k8s.hostman.com/lb-last-config: "..."
```

The `k8s.hostman.com/lb-last-config` annotation stores the last applied load balancer configuration. The cluster management system uses it to compare the current and the new configuration in order to determine whether the load balancer needs to be updated.

There is no need to modify or add this annotation manually.

## Configuring HTTPS Redirection

To enable HTTPS redirection, add the following annotation to your Service:

```shell
metadata:
  annotations:
    k8s.hostman.com/attached-loadbalancer-force-ssl: "true"
```

Before enabling HTTP to HTTPS redirection, make sure that the domain specified in `k8s.hostman.com/attached-loadbalancer-ssl-fqdn` already resolves to the load balancer IP address. This is required for Let's Encrypt to issue a certificate.

The `k8s.hostman.com/attached-loadbalancer-force-ssl` annotation redirects all incoming HTTP requests to HTTPS using HTTP status code `307`.

If `force-ssl` is enabled without a configured certificate and domain, the annotation is ignored and the load balancer continues serving regular HTTP traffic. The following warning is logged:

```shell
force-ssl requested but no SSL certificate configured; ignoring force-ssl
```

If the domain does not yet resolve to the load balancer IP address, Let's Encrypt will be unable to issue a certificate. In this scenario, the load balancer may still start redirecting requests to HTTPS even though no valid certificate is available. As a result, clients will receive TLS errors while the Kubernetes service itself may appear healthy.

Once HTTPS redirection has been enabled, it cannot be disabled by setting:

```shell
k8s.hostman.com/attached-loadbalancer-force-ssl: "false"
```

To disable HTTPS redirection, delete and recreate the `LoadBalancer` Service.