L7 ingress in NodePortLocal mode is an ingress mode that leverages the integration between NSX Advanced Load Balancer and Antrea. NSX Advanced Load Balancer (NSX ALB) is a solution that provides L4 and L7 load balancing and ingress control for Kubernetes clusters5. Antrea is a Kubernetes networking solution that implements the Container Network Interface (CNI) specification and uses Open vSwitch (OVS) as the data plane6. In NodePortLocal mode, the ingress backend service must be ClusterIP mode, and Antrea assigns a unique port on each node for each pod that serves as a backend for the service. The network traffic is routed from the client to the NSX ALB Service Engine (SE), and then directly to the pods without going through the nodes or kube-proxy. This mode reduces network latency and improves performance by avoiding extra hops7.
The following diagram illustrates how the network traffic is routed in NodePortLocal mode:
!NodePortLocal mode diagram
The other options are incorrect because:
L7 ingress in NodePort mode is an ingress mode that does not leverage the integration between NSX ALB and Antrea. In this mode, the ingress backend service must be NodePort mode, and the network traffic is routed from the client to the NSX ALB SE, and then to the cluster nodes, before it reaches the pods. The NSX ALB SE routes the traffic to the nodes, and kube-proxy helps route the traffic from the nodes to the target pods. This mode requires an extra hop for kube-proxy to route traffic from node to pod7.
L7 ingress in ClusterIP mode is an ingress mode that does not leverage the integration between NSX ALB and Antrea. In this mode, the ingress backend service must be ClusterIP mode, and Antrea assigns a virtual IP (VIP) for each service. The network traffic is routed from the client to the NSX ALB SE, and then to one of the VIPs assigned by Antrea, before it reaches the pods. The NSX ALB SE routes the traffic to one of the VIPs, and kube-proxy helps route the traffic from the VIPs to the target pods. This mode requires an extra hop for kube-proxy to route traffic from VIPs to pod7.
L7 ingress in Nodelntegration mode is not a valid ingress mode for NSX ALB.
References: NSX Advanced Load Balancer, Antrea, NSX ALB as L7 Ingress Controller
