KubeLB is available in two editions:
Get in touch with Kubermatic to find out more about the KubeLB Enterprise offering.
| Feature | Community Edition | Enterprise Edition |
|---|---|---|
| Load Balancing | ||
| TCP/UDP Load Balancing | ✔️ | ✔️ |
| Ingress | ✔️ | ✔️ |
| Envoy timeout configuration | ❌ | ✔️ |
| Active health checks | ❌ | ✔️ |
| Circuit breakers | ❌ | ✔️ |
| Backend TLS re-encryption (upstream TLS) | ❌ | ✔️ |
| Per-tenant Envoy resource sizing | ❌ | ✔️ |
Node address capping (maxNodeAddressCount / nodeAddressLabelSelector) | ❌ | ✔️ |
| Gateway API | ||
| HTTPRoute, GRPCRoute | ✔️ | ✔️ |
| TCPRoute, UDPRoute, TLSRoute | ❌ | ✔️ |
| Multiple Gateways per tenant | ❌ | ✔️ |
| Multiple Gateway classes per tenant (class mappings) | ❌ | ✔️ |
| Traffic Policies (Client/Backend) | ❌ | ✔️ |
| AI & MCP Gateway (agentgateway addon) | ✔️ | ✔️ |
| Security | ||
| Web Application Firewall (Beta) | ❌ | ✔️ |
| Tenant self-service WAF policies (TenantWAFPolicy) | ❌ | ✔️ |
| mTLS backend transport (Beta) | ❌ | ✔️ |
| Automated network policies | ❌ | ✔️ |
| Air-gapped and offline support | ❌ | ✔️ |
| Management | ||
| Ingress to Gateway API Migration (Beta) | ✔️ | ✔️ |
| Bring your own certificates | ✔️ | ✔️ |
| DNS automation | ✔️ ¹ | ✔️ |
| Certificate management | ✔️ ¹ | ✔️ |
| Gateway/LoadBalancer limits | ❌ | ✔️ |
| Load Balancing Policies | ❌ | ✔️ |
| Gateway API backend pools | ❌ | ✔️ |
| CLI tunneling (Beta) | ❌ | ✔️ |
| Observability | ||
| Prometheus metrics | ✔️ | ✔️ |
| Grafana dashboards | ✔️ | ✔️ |
| Insights | ❌ | ✔️ |
| Prometheus alert rules | ❌ | ✔️ |
| Supply Chain Security | ||
| Artifact signing (Cosign) | ✔️ | ✔️ |
| SBOMs | ✔️ | ✔️ |
| Vulnerability scanning | ✔️ | ✔️ |
¹ In Community Edition, DNS records and certificates for load balancer hostnames are managed by annotating the generated resources for external-dns and cert-manager (useDNSAnnotations / useCertificateAnnotations). Enterprise Edition adds managed DNS and certificates with per-tenant allowed domains, wildcard domains, and tunnel hostnames.
Supported implementations:
While other products might work for Ingress and Gateway API resources, we are not testing them and can’t guarantee the compatibility.