KubeLB

apiVersion: v1
data:
  # You can use `base64 -w0 kubelb-management-kubeconfig` to encode the
  # kubeconfig properly for inserting into this Secret.
  kubeconfig: <base64 encoded kubeconfig>
kind: Secret
metadata:
  name: kubelb-management-cluster
  namespace: kubermatic
type: Opaque

apiVersion: kubermatic.k8c.io/v1
kind: Seed
metadata:
  name: kubermatic
  namespace: kubermatic
spec:
  # these two fields are only informational
  country: FR
  location: Paris

  # KubeLB configuration
  kubelb:
    # Set to true to enable KubeLB for all the datacenters belong to this seed. This will not install KubeLB for the user clusters, has to be configured at the cluster level.
    enableForAllDatacenters: false
    kubeconfig:
      name: kubelb-management-cluster
      namespace: kubermatic

  # List of datacenters where this seed cluster is allowed to create clusters.
  datacenters:
    vsphere-de:
      country: DE
      location: Hamburg
      spec:
        vsphere:
          endpoint: "https://vsphere.hamburg.example.com"
        kubelb:
          # To enable KubeLB for this datacenter. This will not install KubeLB for the user clusters, has to be configured at the cluster level.
          enabled: true
          # Enforced is used to enforce kubeLB installation for all the user clusters belonging to this datacenter. Setting enforced to false will not uninstall kubeLB from # the user clusters and it needs to be disabled manually.
          enforced: false
          # NodeAddressType is used to configure the address type from node, used for load balancing. Optional: Defaults to ExternalIP
          nodeAddressType: InternalIP
          # Kubeconfig is reference to the Kubeconfig for the kubeLB management cluster. Kubeconfig specified at the datacenter level will have precedence over the
          # kubeconfig specified at the seed level.
          kubeconfig: nil
          # UseLoadBalancerClass is used to configure the use of load balancer class `kubelb` for kubeLB. If false, kubeLB will manage all load balancers in the
          # user cluster irrespective of the load balancer class.
          useLoadBalancerClass: false
          # EnableGatewayAPI is used to configure the use of gateway API for kubeLB.
          enableGatewayAPI: false
          # DisableGatewayAPIProtection disables the protection of the Gateway API CRDs for the user clusters of this datacenter.
          # See "Gateway API CRD Protection" below.
          disableGatewayAPIProtection: false
          # EnableSecretSynchronizer is used to configure the use of secret synchronizer for kubeLB.
          enableSecretSynchronizer: false
          # DisableIngressClass is used to disable the ingress class `kubelb` filter for kubeLB.
          disableIngressClass: false

apiVersion: kubermatic.k8c.io/v1
kind: Cluster
metadata:
  name: crh4xbxz5f
spec:
...
  kubelb:
    enabled: true
...

Gateway API CRDs in this cluster are installed and managed by KubeLB, because Gateway API support is enabled for this cluster (spec.kubelb.enableGatewayAPI). Installing or modifying them breaks the KubeLB CCM. Set spec.kubelb.disableGatewayAPIProtection to true to manage the Gateway API CRDs yourself, or disable spec.kubelb.enableGatewayAPI to stop KubeLB from using them.

apiVersion: kubermatic.k8c.io/v1
kind: KubermaticConfiguration
metadata:
  name: kubermatic
  namespace: kubermatic
spec:
  userCluster:
    kubelb:
      disableGatewayAPIProtection: true

apiVersion: kubermatic.k8c.io/v1
kind: Seed
metadata:
  name: kubermatic
  namespace: kubermatic
spec:
  datacenters:
    vsphere-de:
      spec:
        kubelb:
          enabled: true
          disableGatewayAPIProtection: true

apiVersion: kubermatic.k8c.io/v1
kind: Cluster
metadata:
  name: crh4xbxz5f
spec:
...
  kubelb:
    enabled: true
    enableGatewayAPI: true
    disableGatewayAPIProtection: true
...

apiVersion: kubermatic.k8c.io/v1
kind: Project
metadata:
  name: 2msp2ww6gw
spec:
  defaultTenantSpec:
    # Whether all annotations should propagate to the LoadBalancer service
    propagateAllAnnotations: false
    # Specific annotations to propagate to the LoadBalancer service
    propagatedAnnotations:
      service.beta.kubernetes.io/aws-load-balancer-type: "external"
    # Default annotations set on load balancing resources if not already present
    defaultAnnotations:
      service:
        service.beta.kubernetes.io/aws-load-balancer-internal: "true"
      ingress:
        nginx.ingress.kubernetes.io/ssl-redirect: "true"
    # Restrict allowed domains across all tenant components
    allowedDomains:
      - example.com