External LB should point to k8s workers or control plane (master) nodes?

I'm planning to set up cluster on my bare metal servers and are doing research about k8s networking options in HA cluster.

So far I'm getting mixed info. One article is clearly showing that external LB should point to master nodes and other that it needs to land on workers.

I see both options to have its positives and negatives. Can someone point me to right direction here?


It's not usually a matter of "opinion" -- it's a matter of the workload one is trying to make highly available, and highly available to which audience

One will wish to have a load balancer for the control-plane Nodes in order to stop having to update every kubeconfig in the universe when a control-plane Node goes out of service, as well as providing a uniform way for the peer control-plane Nodes to reach each other. It's incoming CIDR(s) can be very restricted, if you don't want anyone outside of the cluster to reach the kubernetes API, although that will make kubectl usage awkward

One will wish to have a load balancer -- or even several of them, depending on access pattern needs -- pointed at the worker Nodes in order to consume Services of type: NodePort (since you're bare metal, without some hoop-jumpery you will not be able to use type: LoadBalancer as that requires coordination with an external entity to provision those LBs).

While the kubernetes cluster will open NodePorts on the control-plane Nodes, it's not advisable to send workload traffic through your control-plane instances since they're already going to be busy enough with cluster accounting and management tasks. That may be the "opinion" part that you've mentioned -- whether to have control-plane instances involved in doing any of the work of the cluster is for sure a philosophical difference and part of risk management