Help Center/ Cloud Container Engine/ User Guide/ Networking/ Services/ LoadBalancer/ Network and Backend Configuration/ Configuring an HTTP/HTTPS Header for a LoadBalancer Service
Updated on 2026-06-16 GMT+08:00
View PDF
Share

Configuring an HTTP/HTTPS Header for a LoadBalancer Service

HTTP headers are a list of strings sent and received by both the client and server on every HTTP request and response. This section describes HTTP headers supported by HTTP and HTTPS listeners.
  • HTTP/HTTPS headers rely on ELB. Before using HTTP/HTTPS headers in a Service, check whether HTTP/HTTPS headers are supported in the current region. For details, see HTTP/HTTPS Headers.
  • After HTTP or HTTPS is configured, if you delete the HTTP or HTTPS configuration on the CCE console or delete the target annotation from the YAML file, the configuration on the ELB will be retained.
Table 1 Headers

Header

Feature

Description

Supported Cluster Version

X-Forwarded-Port

Transfer Listener Port Number

If this option is enabled, the port number used by the listener will be transmitted to backend servers through the X-Forwarded-Port header.

v1.23.13-r0, v1.25.8-r0, v1.27.5-r0, v1.28.3-r0, or later

X-Forwarded-For-Port

Transfer Port Number in the Request

If this option is enabled, the port number used by the client will be transmitted to backend servers through the X-Forwarded-For-Port header.

X-Forwarded-Host

Rewrite X-Forwarded-Host

If this function is enabled, X-Forwarded-Host will be rewritten using the Host field in the client request header and transferred to backend servers.

X-Real-IP

Rewrite X-Real-IP

If this function is enabled, the source IP address of the client will be rewritten into the X-Real-IP header and transferred to backend servers.

v1.25.16-r30, v1.27.16-r30, v1.28.15-r20, v1.29.13-r0, v1.30.10-r0, v1.31.6-r0, v1.32.1-r0, or later

Prerequisites

  • A Kubernetes cluster is available and the cluster version meets the requirements in Table 1.

Creating a LoadBalancer Service and Configuring an HTTP/HTTPS Header

Use one of the following methods.

  1. Log in to the CCE console and click the cluster name to access the cluster console.
  2. In the navigation pane, choose Services & Ingresses. In the upper right corner, click Create Service.

    In this example, only mandatory parameters for configuring SNI are listed. Retain the default settings for other parameters. For details, see Using the CCE Console (New Version).

  3. Configure basic parameters.

    Parameter

    Description

    Example

    Service Type

    Select LoadBalancer.

    None

    Service Name

    Enter a name, which can be the same as the workload name.

    nginx

    Namespace

    Select the namespace that the workload belongs to.

    default

    Selector

    Add the key and value of a pod label. The Service will be associated with the workload pods based on the label and direct traffic to the pods with this label.

    You can also click Reference Workload Label to use the label of an existing workload. In the dialog box displayed, select a workload and click OK.

    app:nginx

  4. Configure load balancer parameters.

    Parameter

    Description

    Example

    Load Balancer
    Select a load balance type and how the load balancer will be created. To enable HTTP/HTTPS on the listener port of a dedicated load balancer, the type of the load balancer must be Application (HTTP/HTTPS) or Network (TCP/UDP/TLS) & Application (HTTP/HTTPS).
    • Use existing: Only the load balancers in the same VPC as the cluster can be selected. If no load balancer is available, click Create Load Balancer to create one on the ELB console.
    • Auto create: The load balancer will be created in the VPC that the cluster belongs to. For details, see Table 1.

    An existing Dedicated load balancer of the Network (TCP/UDP/TLS) & Application (HTTP/HTTPS) type

  5. Configure access parameters.

    Parameter

    Description

    Example

    Service Affinity
    Whether to route external traffic to a local node or a cluster-wide endpoint. For details, see Service Affinity (externalTrafficPolicy).
    • Cluster-level: The IP addresses and ports of all nodes in a cluster can access the workload associated with the Service. However, accessing the Service may result in decreased performance due to route redirection, and the client's source IP address may not be obtainable.
    • Node-level: Only the IP address and port of the node where the workload is located can access the workload associated with the Service. Accessing the Service will not result in a performance decrease due to route redirection, and the client's source IP address can be obtained.

    Cluster-level

    Port
    • Protocol: the protocol used by the Service. According to the Kubernetes implementation, if a Service uses a load balancer with a non-UDP protocol, this parameter must be set to TCP and the corresponding listener frontend protocol must be selected. For details, see Protocols for Services.
    • Container Port: the port that the workload listens on. For example, Nginx uses port 80 by default.
    • Service Port: the port used by the Service.
      • Listen on a port: The port ranges from 1 to 65535.
      • Listen on ports: ELB allows you to create listeners that listen on ports within specified ranges. Each listener can support up to 10 non-overlapping port ranges.

        To configure port ranges for load balancer listeners, ensure the following conditions are met:

        • The cluster version must be v1.23.18-r0, v1.25.13-r0, v1.27.10-r0, v1.28.8-r0, v1.29.4-r0, v1.30.1-r0, or later.
        • A dedicated load balancer must be used with TCP/UDP/TLS selected.
        • This function requires ELB. Before using this function, check whether ELB supports full-port listening and forwarding for layer-4 protocols in the current region.
    • Frontend Protocol: Set the protocol of the load balancer listener for establishing connections with clients. When a dedicated load balancer is selected, HTTP/HTTPS can be configured only when Application (HTTP/HTTPS) is selected and TLS can be configured only when Network (TCP/UDP/TLS) is selected.
    NOTE:

    When a LoadBalancer Service is created, a random node port number (NodePort) is automatically generated.
    • Protocol: TCP
    • Container Port: 80
    • Service Port: 80
    • Frontend Protocol: HTTP

  6. Configure listener parameters.

    Parameter

    Description

    Constraint

    Example

    Transfer Listener Port Number

    If this function is enabled, the listening port on the load balancer can be transferred to backend servers through the HTTP header of the packet.

    This parameter is available only if HTTP or HTTPS is used as the frontend protocol of a dedicated load balancer listener.

    Enable

    Transfer Port Number in the Request

    If this function is enabled, the source port of the client can be transferred to backend servers through the HTTP header of the packet.

    This parameter is available only if HTTP or HTTPS is used as the frontend protocol of a dedicated load balancer listener.

    Enable

    Rewrite X-Forwarded-Host

    If this function is enabled, X-Forwarded-Host will be rewritten using the Host field in the client request header and transferred to backend servers.

    This parameter is available only if HTTP or HTTPS is used as the frontend protocol of a dedicated load balancer listener.

    Enable

    Rewrite X-Real-IP

    If this function is enabled, the source IP address of the client will be rewritten into the X-Real-IP header and transferred to backend servers.

    This parameter is available only if HTTP or HTTPS is used as the frontend protocol of a dedicated load balancer listener.

    Enable

  7. Click Create.
  1. Log in to the CCE console and click the cluster name to access the cluster console.
  2. In the navigation pane, choose Services & Ingresses. In the upper right corner, click Create Service.
  3. Configure Service parameters. In this example, only mandatory parameters are listed. For details about how to configure other parameters, see Using the CCE Console (Old Version).

    • Service Name: Specify a name, which can be the same as the workload name.
    • Service Type: Select LoadBalancer.
    • Selector: Add a label and click Confirm. The Service will use this label to select pods. You can also click Reference Workload Label to use the label of an existing workload. In the dialog box that is displayed, select a workload and click OK.
    • Load Balancer: Select a load balancer type and creation mode.
      • In this example, only dedicated load balancers are supported, and the type of the load balancer must be Application (HTTP/HTTPS) or Network (TCP/UDP/TLS) & Application (HTTP/HTTPS). Otherwise, HTTP or HTTPS cannot be enabled on the listener port.
      • This section uses an existing load balancer as an example. For details about the parameters for automatically creating a load balancer, see Table 4.
    • Port
      • Protocol: Select TCP. If you select UDP, HTTP and HTTPS will be unavailable.
      • Service Port: the port used by the Service. The port ranges from 1 to 65535.
      • Container Port: the port that the workload listens on. For example, Nginx uses port 80 by default.
      • Frontend Protocol: In this example, select HTTP or HTTPS for the Service.
    • Listener
      • Advanced Options: Select a proper option.

        Configuration

        Description

        Constraint

        Transfer Listener Port Number

        If this function is enabled, the listening port on the load balancer can be transferred to backend servers through the HTTP header of the packet.

        This parameter is available only after HTTP/HTTPS is enabled on the listener port of a dedicated load balancer.

        Transfer Port Number in the Request

        If this function is enabled, the source port of the client can be transferred to backend servers through the HTTP header of the packet.

        This parameter is available only after HTTP/HTTPS is enabled on the listener port of a dedicated load balancer.

        Rewrite X-Forwarded-Host

        If this function is enabled, X-Forwarded-Host will be rewritten using the Host field in the client request header and transferred to backend servers.

        This parameter is available only after HTTP/HTTPS is enabled on the listener port of a dedicated load balancer.

        Rewrite X-Real-IP

        If this function is enabled, the source IP address of the client will be rewritten into the X-Real-IP header and transferred to backend servers.

        This parameter is available only after HTTP/HTTPS is enabled on the listener port of a dedicated load balancer.
    Figure 1 Configuring HTTP/HTTPS headers

  4. Click OK.
This section uses an existing load balancer as an example. An example YAML file of a Service with HTTP/HTTPS header enabled is as follows: 
apiVersion: v1
kind: Service
metadata:
  name: test
  labels:
    app: nginx
  namespace: default
  annotations:
    kubernetes.io/elb.class: performance                              # Load balancer type, which can only be performance (dedicated load balancer)
    kubernetes.io/elb.id: 35cb350b-23e6-4551-ac77-10d5298f5204        # ID of an existing load balancer
    kubernetes.io/elb.protocol-port: http:80                          # The HTTP port 80 is used.
    kubernetes.io/elb.x-forwarded-port: 'true'                       # Obtain the listener port number.
    kubernetes.io/elb.x-forwarded-for-port: 'true'                   # Obtain the client port number for requests.
    kubernetes.io/elb.x-forwarded-host: 'true'                       # Rewrite X-Forwarded-Host.
    kubernetes.io/elb.x-real-ip: 'true'                              # Rewrite X-Real-IP.
spec:
  selector:
    app: nginx
  externalTrafficPolicy: Cluster
  ports:
    - name: cce-service-0
      targetPort: 80
      nodePort: 0
      port: 80
      protocol: TCP
  type: LoadBalancer
  loadBalancerIP: **.**.**.**    # IP address of the load balancer
Table 2 Key parameters

Parameter

Type

Description

kubernetes.io/elb.x-forwarded-port

String

A load balancer can obtain the port number of a listener using X-Forwarded-Port and transmit the port number to the packets of the backend server.

  • true: Enable the function of obtaining a listener port number.
  • false: Disable the function of obtaining a listener port number.

kubernetes.io/elb.x-forwarded-for-port

String

A load balancer can obtain a client port number for requests using X-Forwarded-For-Port and transmit the port number to the packets of the backend server.

  • true: Enable the function of obtaining a client port number for requests.
  • false: Disable the function of obtaining a client port number for requests.

kubernetes.io/elb.x-forwarded-host

String
  • true: Enable the function of rewriting X-Forwarded-Host. Then, the X-Forwarded-Host header will be rewritten using the Host header of the client request and transmitted to backend servers.
  • false: Disable the function of rewriting X-Forwarded-Host. Then, the X-Forwarded-Host header of the client will be transmitted to backend servers.

kubernetes.io/elb.x-real-ip

String
  • true: Enable the function of rewriting X-Real-IP. The source IP address of the client will be written into the X-Real-IP header and transmitted to the backend servers.
  • false: Disable the function of rewriting X-Real-IP. The X-Real-IP header of the client will be transmitted to the backend servers.

Verifying Configuration

  1. Log in to the CCE console and click the cluster name to access the cluster console.
  2. In the navigation pane, choose Services and Ingresses. Locate the row that contains the created Service and click the load balancer name to go to the ELB console.
  3. Switch to the Listeners tab, click the listener name of the created port, and check whether options are enabled.

Parent Topic: Network and Backend Configuration