How Connect-Time Load Balancing Works

How Connect-Time Load Balancing Works A sequence diagram generated by Archify. SYN → VIP:80 DNAT → Pod A DATA · FIN → VIP:80 per-packet DNAT + conntrack connect(VIP:80) cgroup/connect4 hook rewrite dst → Pod B:8080 NAT Frontend/Backend Map lookup → backend Pod B selected SYN → Pod B directly DATA · FIN — no packet-level NAT Per-Packet LB (kube-proxy) — DNAT on every packet Connect-Time LB (eBPF) — backend picked once at connect() Application · process in a Pod · Sequence participant Application process in a Pod kube-proxy · iptables DNAT · Sequence participant kube-proxy iptables DNAT Pod A · backend · Sequence participant Pod A backend Socket Layer · kernel socket layer · Sequence participant Socket Layer kernel socket layer eBPF Program · cgroup connect hook · Sequence participant eBPF Program cgroup connect hook Pod B · backend · Sequence participant Pod B backend Legend request return security default message