diff --git a/faq/loadbalancer.mdx b/faq/loadbalancer.mdx index 084cb38e57..c48dcabeed 100644 --- a/faq/loadbalancer.mdx +++ b/faq/loadbalancer.mdx @@ -27,6 +27,8 @@ Yes: Check out our documentation on: By default, each [public](/load-balancer/concepts/#accessibility) Load Balancer is created automatically with a flexible IPv4 address. This is a public IP that can be held in your account even after you delete your Load Balancer. You can optionally also add an IPv6 address. +**This IP address is fixed and does not risk changing once attached to your Load Balancer**. + Your frontend listens to your Load Balancer's public flexible IP address. In case of a failure of the Load Balancer, a replica Load Balancer is immediately spawned and deployed, and the IP address is automatically rerouted to this replica. This is done automatically, by the Load Balancer control subsystems. When you delete a Load Balancer, you can choose to keep its flexible IP(s) in your account, to reuse later with a new Load Balancer. These flexible IPs are not compatible with other Scaleway products (e.g. Instances, Elastic Metal servers, Public Gateways): each resource has its own set of flexible IPs. @@ -35,6 +37,12 @@ When you delete a Load Balancer, you can choose to keep its flexible IP(s) in yo Each Load Balancer can have one public IPv4 address and one public IPv6 address. Currently, it is not possible to assign more than one of each type of IP to a given Load Balancer. +## How can I move my Instance's flexible IP address to my Load Balancer? + +This is not possible: flexible IPs are scoped to the resource-type that they were created for. You can move a flexible IP between different Instances, but not move it to a Load Balancer. + +Watch this space for resource-agnostic flexible IPs in the future. + ## Do Load Balancers support external IPv6 connections? Yes, Load Balancer supports both IPv4 and IPv6 addresses at the frontend. IPv6 can also be used to communicate between the Load Balancer and your backend servers. @@ -60,6 +68,8 @@ To take advantage of multi-cloud, you must choose a compatible Load Balancer off All protocols based on `TCP` are supported. This includes `database`, `HTTP`, `LDAP`, `IMAP` and so on. You can also specify `HTTP` to benefit from support and features that are exclusive to this protocol. +Scaleway Load Balancer does not currently support `UDP`. + ## Is it possible to add security to restrict access to a URL or port on the Load Balancer? Yes, you can restrict the use of a `TCP` port or `HTTP` URL using ACLs. Find more information in our [ACL documentation](/load-balancer/how-to/create-manage-acls/). @@ -78,4 +88,8 @@ A health check is one of the core concepts for a well-functioning Load Balancer. ## Can I set up a caching service for my load balanced application? -Yes, this is possible with Scaleway's [Edge Services](/edge-services/) product, currently in Public Beta. By creating an Edge Services pipeline for your Load Balancer, you can access Edge Services caching service reduce load on your origin. \ No newline at end of file +Yes, this is possible with Scaleway's [Edge Services](/edge-services/) product, currently in Public Beta. By creating an Edge Services pipeline for your Load Balancer, you can access Edge Services caching service reduce load on your origin. + +## How can I add extra security such as a firewall or anti-DDOS to my Load Balancer? + +This will be available soon via [Edge Services](/edge-services/), watch this space. \ No newline at end of file diff --git a/menu/navigation.json b/menu/navigation.json index 113aff08b7..07439d986f 100644 --- a/menu/navigation.json +++ b/menu/navigation.json @@ -3597,6 +3597,22 @@ }, { "items": [ + { + "label": "I am having problems configuring my Load Balancer", + "slug": "configuration" + }, + { + "label": "I am experiencing connection problems and HTTP errors with my Load Balancer", + "slug": "http-connection-errors" + }, + { + "label": "I am having problems with my Load Balancer's certificate", + "slug": "certificates" + }, + { + "label": "I am experiencing problems with my Kubernetes Load Balancer", + "slug": "k8s-errors" + }, { "label": "Load Balancer Limitations", "slug": "load-balancer-limitations" diff --git a/pages/load-balancer/how-to/add-certificate.mdx b/pages/load-balancer/how-to/add-certificate.mdx index 5ceb5d6c04..6d8872fb29 100644 --- a/pages/load-balancer/how-to/add-certificate.mdx +++ b/pages/load-balancer/how-to/add-certificate.mdx @@ -200,4 +200,8 @@ Use the button to delete unwanted certificates. If you have more than one certificate for your Load Balancer, it will automatically use the first in the list, regardless of its expiry date. Ensure that you delete any expired certificates, and that the current certificate you want to use is first in the list. +## Troubleshooting certificate problems + +See our [dedicated troubleshooting documentation](/load-balancer/troubleshooting/certifiates/.) + diff --git a/pages/load-balancer/reference-content/kubernetes-load-balancer.mdx b/pages/load-balancer/reference-content/kubernetes-load-balancer.mdx index 0a3450bba3..5eeb947bd7 100644 --- a/pages/load-balancer/reference-content/kubernetes-load-balancer.mdx +++ b/pages/load-balancer/reference-content/kubernetes-load-balancer.mdx @@ -24,6 +24,7 @@ Full documentation for creating and configuring a Load Balancer for your cluster - [Managing Load Balancer IPs](/kubernetes/reference-content/managing-load-balancer-ips/) - [Using Load Balancer annotations](/kubernetes/reference-content/using-load-balancer-annotations/) - [Exposing a Kubernetes Kapsule ingress controller service with a Load Balancer](/kubernetes/reference-content/lb-ingress-controller/) +- [Troubleshooting Kubernetes Load Balancers](/load-balancer/troubleshooting/k8s-errors/) You may also find the following resources helpful: diff --git a/pages/load-balancer/troubleshooting/certificates.mdx b/pages/load-balancer/troubleshooting/certificates.mdx new file mode 100644 index 0000000000..d01a23f878 --- /dev/null +++ b/pages/load-balancer/troubleshooting/certificates.mdx @@ -0,0 +1,84 @@ +--- +meta: + title: I am having problems with my Load Balancer's certificate + description: Troubleshoot errors that you may experience when creating an SSL/TLS certificate, adding it to your Load Balancer frontend, or successfully handling HTTPS connections. +content: + h1: I am having problems with my Load Balancer's certificate + paragraph: Troubleshoot errors that you may experience when creating an SSL/TLS certificate, adding it to your Load Balancer frontend, or successfully handling HTTPS connections. +tags: load-balancer certificate ssl tls dns +dates: + validation: 2025-03-10 + posted: 2025-03-10 +categories: + - network +--- + +## I'm experiencing DNS errors when adding an SSL/TLS certificate + +You may be trying to [create or upload](/load-balancer/how-to/add-certificate/) a certificate for your Load Balancer, and receive the following error message: + +``` +invalid argument(s): dns_name does not respect constraint, does not resolve to your Load Balancer IP +``` + +### Cause + +The domain name specified does not resolve to the Load Balancer's public IP address. + +### Solution + +Try the following steps: + +- Ensure that a DNS record exists, pointing this domain to the Load Balancer's public IP address. +- Ensure that you have correctly typed the domain name, with no typos or errors. +- If you created the DNS record very recently, DNS propagation might not yet be complete. Wait for 30-60 minutes and try again, to see if the issue resolves itself. +- If you are trying to upload a custom certificate: + - Check the certificate's validity dates and ensure it's not expired or not yet valid. + - If the certificate has wildcards, ensure it covers the correct domain and subdomains. For example, if your certificate covers `*.example.com`, you can use it to secure `subdomain.example.com` but not `sub.subdomain.example.com`. Check the [IETF documentation](https://www.ietf.org/rfc/rfc2818.txt). +- If the error persists, check the DNS entry using a tool like `dig`, to ensure it is resolving correctly. + + +## I am experiencing HTTP errors when generating a Let's Encrypt SSL/TLS certificate + +You may be trying to [generate a Let's Encrypt certificate](/load-balancer/how-to/add-certificate/#how-to-generate-and-add-a-lets-encrypt-certificate) for your Load Balancer, and receive the following error message: + +``` +HTTP error 400: The port 80 frontend must be associated to an HTTP backend +``` + +### Cause + +Let's Encrypt certificates cannot be created for Load Balancers which have a frontend listening on port 80, but are attached to a **TCP** backend. This is because the Let's Encrypt challenge would fail. + +### Solution: + +Ensure that your Load Balancer has either: +- An HTTP-protocol-backend attached to a frontend listening on port 80, or +- A TCP-protocol-backend attached to a frontend listening on a port other than 80 + +Alternatively, create and import your own [custom certificate](/load-balancer/how-to/add-certificate/#how-to-import-a-certificate) for your Load Balancer, rather than generating a Let's Encrypt certificate via Scaleway. + +## I added a certificate to my Kubernetes Load Balancer via the Scaleway console, but it is not working correctly + +You may have used the Scaleway console attach a certificate to your Kubernetes Kapsule Load Balancer, and then find that the SSL certificate does not work as expected afterwards, with connections lost and HTTPS traffic dropped. + +### Cause + +Kubernetes Kapsule is a managed service, as are the Load Balancers created as part of the cluster. +Modifying a Kubernetes Load Balancer via the Scaleway console results in non-permanent modifications which are not known to the Kubernetes Kapsule service, and therefore end up being overwritten. + +### Solution + +Always modify Kubernetes Load Balancers via the cluster's Cloud Controller Manager (CCM), using [Load Balancer annotations](/kubernetes/reference-content/using-load-balancer-annotations/). + +The specific annotation to use can be found in the [Scaleway CCM documentation](https://github.com/scaleway/scaleway-cloud-controller-manager/blob/master/docs/loadbalancer-annotations.md#servicebetakubernetesioscw-loadbalancer-certificate-ids). + + +## I have a different problem related to my Load Balancer SSL/TLS certificate + +Check the following documentation: + +- [How to add an SSL/TLS certificate](/load-balancer/how-to/add-certificate/) +- [Setting up SSL bridging, offloading or passthrough](/load-balancer/reference-content/ssl-bridging-offloading-passthrough/) +- [Load Balancer API Documentation: Certificates](https://www.scaleway.com/en/developers/api/load-balancer/zoned-api/#path-certificate-get-an-ssltls-certificate) +- [Load Balancer Terraform Documentation: Certificates](https://registry.terraform.io/providers/scaleway/scaleway/latest/docs/resources/lb_certificate) diff --git a/pages/load-balancer/troubleshooting/configuration.mdx b/pages/load-balancer/troubleshooting/configuration.mdx new file mode 100644 index 0000000000..8e065b6007 --- /dev/null +++ b/pages/load-balancer/troubleshooting/configuration.mdx @@ -0,0 +1,97 @@ +--- +meta: + title: I am having problems configuring my Load Balancer + description: Troubleshoot problems that you may experience when configuring your Load Balancer, such as adding backend servers, setting up Private Networks and dealing with security concerns. +content: + h1: I am having problems configuring my Load Balancer + paragraph: Troubleshoot problems that you may experience when configuring your Load Balancer, such as adding backend servers, setting up Private Networks and dealing with security concerns. +tags: load-balancer configuration backend server error security ip +dates: + validation: 2025-03-06 + posted: 2025-03-06 +categories: + - network +--- + +If your problem concerns any of the following, see our specific documentation pages: + +- [Troubleshooting certificate configuration](/load-balancer/troubleshooting/certificates/) +- [Setting up SSL bridging, offloading or passthrough](/load-balancer/reference-content/ssl-bridging-offloading-passthrough/) +- [Troubleshooting connection and HTTP errors](/load-balancer/troubleshooting/http-connection-errors/) +- General advice and help for configuring [frontends](/load-balancer/reference-content/configuring-frontends/), [backends](/load-balancer/reference-content/configuring-backends/) and [health checks](/load-balancer/reference-content/configuring-health-checks/) +- [Creating and configuring a Kubernetes Load Balancer](/kubernetes/reference-content/kubernetes-load-balancer/) + +## When adding a backend server to my Load Balancer, I get the message: IP is not owned by Scaleway + +You may be trying to [add a backend server](/load-balancer/how-to/create-frontends-backends/#configuring-traffic-management) to your Load Balancer's backend, and experience the following error: + +`HTTP 404: IP not owned by Scaleway` + +### Cause + +You are trying to add the IP address of a backend server that is not owned by Scaleway (i.e. is not a Scaleway resource such as an Instance, Elastic Metal server or Managed Database). + +### Solution + +Only certain Load Balancer types (L and XL) allow you to add non-Scaleway resources as backend servers. This is indicated as "Multi-cloud provider" compatibility in the [Load Balancer creation form](https://console.scaleway.com/load-balancer/lbs/create). + +Either: + +- [Resize](/load-balancer/how-to/resize-lb/) your Load Balancer to a type that is compatible with multi-cloud backend servers, or +- Use only Scaleway resources as backend servers for your Load Balancer + +## When adding a backend server via its private IP address, I get the message: IP doesn't exist + +You may be trying to [add a backend server](/load-balancer/how-to/create-frontends-backends/#configuring-traffic-management) to your Load Balancer's backend using the server's private IP address, and experience an error message saying that the IP doesn't exist. + +### Cause + +You are entering an incorrect IP address for your resource, or using private IP address that is outside the standard range for private networks. + +### Solution + +- Check that you are entering the correct [private IP address](/vpc/how-to/attach-resources-to-pn/#how-to-view-the-resources-ip-address) for your resource, and that it is attached to the same Private Network as the Load Balancer. +- Verify that you are using a private IP address that is within the standard ranges used for private networks as described in [RFC1918](https://en.wikipedia.org/wiki/Private_network#Private_IPv4_addresses). Only IP addresses from within one of these ranges are supported by Scaleway Load Balancer. + + +## My Load Balancer's Elastic Metal backend servers added via private IPs are all down + +You may add Elastic Metal backend servers to your Load Balancer using their private IP address, and find they are marked as `DOWN` as soon as you add them. You are unable to work out why they are failing their health checks. + +### Cause + +The Load Balancer is unable to successfully communicate with the Elastic Metal backend servers over the Private Network, resulting in failed health checks. + +### Solution + +- Check that your health checks and backend servers are correctly configured to work together. +- Check that you have entered the correct [private IP address](/vpc/how-to/attach-resources-to-pn/#how-to-view-the-resources-ip-address) for your Elastic Metal server, and that it is attached to the same Private Network as the Load Balancer. +- Elastic Metal servers require additional manual configuration of their network interface, unlike Instances and other resource types. Ensure you have [followed the necessary configuration steps](/elastic-metal/how-to/use-private-networks/#how-to-configure-the-network-interface-on-your-elastic-metal-server-for-private-networks). + + +## My Load Balancer's IP address is appearing in the backend application's logs, instead of the real client IP address. + +You may find that as requests are passed from the client, through the Load Balancer, to your backend servers, that the client's original IP address is replaced with the Load Balancer's IP address in your backend application's logs. This is problematic if you need the original IP address for localization, security or other purposes. + +### Cause + +Proxy Protocol has not been activated on your Load Balancer, meaning that information about the original client's connection is not being passed through to the backend servers. + +### Solution + +Activate [Proxy Protocol](/load-balancer/reference-content/configuring-backends/#proxy-protocol) on your Load Balancer, and ensure that your backend server is [correctly configured](/tutorials/proxy-protocol-v2-load-balancer/) to handle this protocol. + +## Security rules are not being applied as expected, and I am having difficulties in filtering incoming traffic through my Load Balancer + +You may find that traffic is not being filtered as expected via your Load Balancer, and that Instances in your backend are not dropping unauthorized traffic as expected. + +### Cause + +Instance security groups and/or Load Balancer ACLs are incorrectly configured. + +### Solution + +Instance [security groups](instances/how-to/use-security-groups/) should still filter public traffic arriving on your backend server Instances, as long as that traffic is arriving over the public interface. This means the Instance in question must be attached to the Load Balancer via its public IP and not any private IP. +- Ensure that your Instance is attached via its public IP address. If your Instance behind a Load Balancer is attached via a private IP address, the security group rules will not be applied. +- Double check your [security group rules](/instances/how-to/use-security-groups/#how-to-choose-security-group-settings), to verify that they correspond to the required ports, protocols, and IP addresses configured for your Load Balancer +- To filter incoming traffic to your backend servers **as it passes through the Load Balancer**, use [Load Balancer ACLs](/load-balancer/how-to/create-manage-acls/). \ No newline at end of file diff --git a/pages/load-balancer/troubleshooting/http-connection-errors.mdx b/pages/load-balancer/troubleshooting/http-connection-errors.mdx new file mode 100644 index 0000000000..32bc318b56 --- /dev/null +++ b/pages/load-balancer/troubleshooting/http-connection-errors.mdx @@ -0,0 +1,75 @@ +--- +meta: + title: I am experiencing connection problems and HTTP errors with my Load Balancer + description: Troubleshoot connection problems and HTTP errors that you may experience when accessing applications served via your Load Balancer. Learn how to resolve common problems and get your application back up and running. +content: + h1: I am experiencing connection problems and HTTP errors with my Load Balancer + paragraph: Troubleshoot connection problems and HTTP errors that you may experience when accessing applications served via your Load Balancer. Learn how to resolve common problems and get your application back up and running. +tags: load-balancer http-errors bad-request +dates: + validation: 2025-03-06 + posted: 2025-03-06 +categories: + - network +--- + +You may experience connection problems and HTTP errors when attempting to connect to an application served via your Load Balancer. + +This page helps you find solutions to some of these most common errors. + +## I am getting a 400 Bad Request error when accessing my application through my Load Balancer + +You may find that when attempting to connect to the domain linked to your Load Balancer / the application being served by your backend servers, you receive a `400 Bad Request` error. + +### Cause + +400 Bad Request errors occur when the backend servers cannot process a request due to client-side issues, or an incompatibility in the way that requests are passed through the Load Balancer and received by the backend server. + +### Solutions + +- Try accessing your application directly, and not through your Load Balancer, to eliminate the possibility that the problem does not come from the Load Balancer. Use a tool such as `cURL` or Postman to compare headers and body content to check how the Load Balancer is modifying requests. +- Check your Load Balancer's [Grafana dashboard](/load-balancer/how-to/monitor-lb-cockpit/) for any additional information about the way the request was handled. +- Verify your certificate and [SSL bridging/offloading/passthrough](/load-balancer/reference-content/ssl-bridging-offloading-passthrough/) settings. For example, if SSL is terminated at the Load Balancer, but the backend expects HTTPS, requests may be rejected. +- Check if [Proxy Protocol](load-balancer/reference-content/configuring-backends/#proxy-protocol) is enabled on your Load Balancer. If your backend server is not configured to handle Proxy Protocol headers correctly, it may reject the requests. Try [disabling Proxy Protocol](/load-balancer/how-to/manage-frontends-and-backends/#how-to-edit-backends-and-health-checks) on your Load Balancer to see if it resolves the issue. If the issue is resolved when Proxy Protocol is disabled, [ensure your backend server is correctly configured for Proxy Protocol](/tutorials/proxy-protocol-v2-load-balancer/) before re-enabling. + +## I am getting a 503 Service Unavailable error when trying to access my application through my Load Balancer + +You may find that when attempting to connect to the domain linked to your Load Balancer / the application being served by your backend servers, you receive a `503 Service Unavailable` error. + +### Cause + +503 Service Unavailable errors occur when backend servers are unable to handle requests due to overload or maintenance issues. It indicates that the server cannot currently fulfill the request, but may be able to in the future. + +### Solutions + +- Check the health of your backend servers. If the servers are failing their health checks, this is likely to be the reason for the error. Investigate the reason for the failing health check, and reconfigure your server or [health check settings](/load-balancer/reference-content/configuring-health-checks/) as necessary. +- Check that your Load Balancer is not exceeding its bandwidth. Each Load Balancer type has a [maximum bandwidth](https://www.scaleway.com/en/pricing/network/#load-balancer) it can handle. If you are exceeding this bandwidth, a 503 error is likely. [Check your Load Balancer's metrics](/load-balancer/how-to/monitor-lb-cockpit/), and [resize your Load Balancer](/load-balancer/how-to/resize-lb/) if necessary. +- Check your Load Balancer's [backend protection settings](/load-balancer/reference-content/configuring-backends/#backend-protection), and compare with [Cockpit data](/load-balancer/how-to/monitor-lb-cockpit/). If backend protection compared to request/connection volume is set in such a way that all backend servers are becoming overloaded, you may need to add additional backend servers or adjust your backend protection settings. + + +## I am getting SSL protocol errors when trying to access my application through my Load Balancer + +You may find that when attempting to connect to the domain linked to your Load Balancer / the application being served by your backend servers, you receive an error similar to one of the following + +``` +ERR_SSL_PROTOCOL_ERROR +``` + +``` +SSL_ERROR_PROTOCOL_VERSION_ALERT +``` + +``` +This site can't provide a secure connection +OpenSSL/3.0.14: error:0A00010B:SSL routines::wrong version number +``` + +### Cause + +There is a mismatch between the SSL/TLS protocol versions or configurations between the client and the Load Balancer / its backend servers. This can prevent you from being able to establish a secure connection to your application. + +### Solution + +- Check that the client or backend servers are not using older SSL protocols such as SSLv2 or SSLv3, which are considered insecure. +- Ensure that you have correctly configured [SSL bridging, offloading or passthrough](/load-balancer/reference-content/ssl-bridging-offloading-passthrough/) on your Load Balancer, depending on your use case. +- Ensure that you have not confused activation of the [Proxy Protocol](/load-balancer/reference-content/configuring-backends/#proxy-protocol) setting as anything to do with SSL bridging, offloading or passthrough, as it is unrelated. \ No newline at end of file diff --git a/pages/load-balancer/troubleshooting/index.mdx b/pages/load-balancer/troubleshooting/index.mdx index 6256d357ce..9ad9c65b08 100644 --- a/pages/load-balancer/troubleshooting/index.mdx +++ b/pages/load-balancer/troubleshooting/index.mdx @@ -1,8 +1,70 @@ --- meta: - title: Load Balancers - Troubleshooting - description: Load Balancers Troubleshooting + title: Load Balancer - Troubleshooting + description: Find troubleshooting resources for resolving issues with Scaleway Load Balancers. content: - h1: Load Balancers - Troubleshooting - paragraph: Load Balancers Troubleshooting + h1: Load Balancer - Troubleshooting + paragraph: Find troubleshooting resources for resolving issues with Scaleway Load Balancers. +dates: + posted: 2025-03-14 + validation: 2025-03-14 +categories: + - network --- + + + +## Featured Pages + + + + + + + + + + + + +## Load Balancer troubleshooting pages + +- [I am having problems with my Load Balancer's certificate](/load-balancer/troubleshooting/certificates/) +- [I am having problems configuring my Load Balancer](/load-balancer/troubleshooting/configuration/) +- [I am experiencing connection problems and HTTP errors with my Load Balancer](/load-balancer/troubleshooting/http-connection-errors/) +- [I am experiencing problems with my Kubernetes Load Balancer](/load-balancer/troubleshooting/k8s-errors/) +- [Load Balancer Limitations](/load-balancer/troubleshooting/load-balancer-limitations/) diff --git a/pages/load-balancer/troubleshooting/k8s-errors.mdx b/pages/load-balancer/troubleshooting/k8s-errors.mdx new file mode 100644 index 0000000000..c4759e86ee --- /dev/null +++ b/pages/load-balancer/troubleshooting/k8s-errors.mdx @@ -0,0 +1,67 @@ +--- +meta: + title: I am experiencing problems with my Kubernetes Load Balancer + description: Troubleshoot problems with your Kubernetes Load Balancer. Discover the solutions to common errors, and get your Load Balancer service back up and running. +content: + h1: I am experiencing problems with my Kubernetes Load Balancer + paragraph: Troubleshoot problems with your Kubernetes Load Balancer. Discover the solutions to common errors, and get your Load Balancer service back up and running. +tags: load-balancer kubernetes annotations +dates: + validation: 2025-03-06 + posted: 2025-03-06 +categories: + - network +--- + +If you are experiencing errors with your Kubernetes Kapsule Load Balancer, this page may help you find solutions to some of the most common problems. + + +You should **never** try to create or modify a Kubernetes Kapsule's Load Balancer via the Scaleway console, the API, or any other developer tools. + +This leads to unexpected and unreliable behaviour, as the cluster's **C**loud **C**ontroller **M**anager is unaware of the Load Balancer and attempts to overwrite configurations made in the console. + +Always provision and modify Kubernetes Load Balancers via the [CCM](/kubernetes/reference-content/kubernetes-load-balancer/#creating-a-load-balancer-for-your-cluster-overview). Use [annotations](/kubernetes/reference-content/kubernetes-load-balancer/#defining-your-load-balancers-configuration-via-annotations) to configure your cluster’s Load Balancer. + + +## I'm experiencing connectivity issues with my Kubernetes Load Balancer + +You may find that your Load Balancer is not connecting to nodes in your Kapsule cluster, meaning that health checks are failing and your application is inaccessible from the internet + +### Cause + +A configuration issue is preventing successful communication between your Load Balancer and the cluster's nodes. + +### Solutions + +- Ensure that you provisioned and configured your Load Balancer via Kubernetes and not via the Scaleway console, which provokes unexpected behaviors and errors. +- Verify that the required service is running on all nodes. If it is missing from some nodes, this could be causing health checks to fail. +- Check your cluster's `externalTrafficPolicy` setting. If it is set to `Local` instead of `Cluster`, this could be causing the issue. Change the policy to `Cluster`. +- Try enabling or disabling Cloudflare's Proxy Mode, which may be affecting connectivity. + + +## My certificate is not being resolved when accessing my Kubernetes Load Balancer from within the cluster + +You may be able to reach applications from outside your cluster, but when trying to reach your Load Balancer from inside your Kapsule cluster, experience the following error message: + +``` +routines:ss3_get_record:wrong version number:../ssl/record/ssl3_record.c:331 +``` + +### Cause + +The Load Balancer is not properly configured to handle requests from within the cluster. Specifically, it is not using the hostname to route requests. + +## Solution: + +Add an [annotation](/kubernetes/reference-content/kubernetes-load-balancer/#defining-your-load-balancers-configuration-via-annotations) to the Load Balancer configuration, to use the hostname to route requests: + +``` +service.beta.kubernetes.io/scw-loadbalancer-use-hostname: "true" +``` + +By adding this annotation, the Load Balancer will use the hostname to route requests from within the cluster. + +## I am experiencing a different problem + +- Check the Load Balancer troubleshooting in the [Kubernetes Kapsule documentation](/kubernetes/reference-content/kubernetes-load-balancer/#troubleshooting-kubernetes-load-balancers) +- Read the full documentation on [creating and configuring Kubernetes Load Balancers](/kubernetes/reference-content/kubernetes-load-balancer/)