Deployment Scenarios

This section provides configuration guides for integrating FortiADC with Kubernetes. These scenarios demonstrate how the FortiADC Kubernetes Controller translates cluster resources into application delivery configurations for L4/L7 load balancing and Global Load Balancing (GLB).

Implementation Prerequisites

Connectivity between FortiADC and your cluster must be established before deploying these scenarios. Verify your requirements based on the Kubernetes Service Type you intend to use:

• NodePort Type: If your services are exposed via type: NodePort, no additional network configuration is required. FortiADC will communicate with the nodes using their physical IP addresses.

• ClusterIP Type (VXLAN): If you intend to route traffic directly to Pods using type: ClusterIP, you must first establish a VXLAN overlay tunnel. If this is not yet configured, please complete the steps for your specific CNI:

  • Flannel VXLAN CNI

  • Calico VXLAN CNI

How to Select a Scenario

The implementation guides are organized by the Kubernetes Resource Type you intend to manage. Use the logic below to identify the correct path for your deployment:

1. Standard Kubernetes Ingress & Services

If your objective is to use native Kubernetes objects for portability and standard workflows:

• Ingress Deployment: Best for standard web traffic requiring path-based routing (e.g., /info, /hello) and SSL termination.

• Service Deployment and Lifecycle: Explains how the controller handles the translation of ClusterIP and NodePort services and responds to service updates.

• Handling Node Lifecycle Events: Vital for maintaining high availability when cluster nodes are added, removed, or experience failure.

2. FortiADC Custom Resources (CRDs)

If your objective is to access advanced ADC features (WAF, IPS, Antivirus) or manage non-HTTP protocols:

• Simple Fanout L7 VirtualServer: Use this for advanced L7 routing that requires FortiADC security profiles (WAF/Captcha/AV) not supported by standard Ingress.

• PostgreSQL L4 VirtualServer: Use this to securely proxy database traffic (TCP) with SSL enabled.

• Host-Based Global Load Balancing (GLB): Use this for multi-cluster or multi-region availability using DNS-based load balancing.