ipset-load-balancing

IP Sets & Load Balancing

Tool availability: some MCP tools named here live in the full toolset profile — if one is not advertised on this connection, tell the user to reconnect the MCP server with ?toolsets=full (or use the cpln CLI fallback). Reads work on every profile via the generic list_resources / get_resource tools; delete_resource is on every profile except readonly.

An IP set reserves one static public IPv4 address per location and attaches it to a direct (per-workload) or dedicated (per-GVC) load balancer. The linking is bidirectional, and the recurring failure is configuring only one side: the IP set's spec.link must point at the workload/GVC AND that target's load balancer must reference the IP set back — otherwise addresses sit unbound and the IP set carries status.warning: Cross-link misconfiguration. The workload skill is primary for the LB-type picker and routing basics; this skill carries the full configuration.

Load balancer types

Type	Scope	What it adds	Cost
Default (shared)	every workload	HTTP/HTTPS on 80/443, nothing to configure	included
Direct	one workload	raw TCP/UDP on external ports 22-32768, static IPs, TLS passthrough	charged while enabled
Dedicated	whole GVC	domain custom ports and TCP routing, wildcard and accept-all hosts, redirects, trusted proxies, static IPs	per location (multiZone adds cross-zone charges)

Toggling the direct block (workload) or dedicated flag (GVC) requires the configureLoadBalancer permission on that resource — edit does not imply it (403 "Not allowed to change loadBalancer configuration"); manage covers it.

IP sets

kind: ipset
name: partner-ips
spec:
  link: //gvc/GVC/workload/WORKLOAD   # or //gvc/GVC for a dedicated LB
  locations:
    - name: //location/aws-us-west-2
      retentionPolicy: keep           # keep | free

How allocation actually works:

• IPs are allocated in the locations of the linked GVC (for a workload link, the workload's GVC). No spec.link, no allocation — spec.locations alone does nothing.
• spec.locations pins a per-location retentionPolicy; unlisted locations behave as keep while in the GVC. Workload links require the GVC segment — //workload/WORKLOAD without it is rejected.
• keep (default) allocates eagerly and holds the IP through unlinking, GVC location removal, and target deletion (state drops to unbound, billing continues until the IP set is deleted). free allocates only while bound and releases once the location leaves the GVC or the link/target goes away.
• Flipping keep to free does not release an IP whose location is still active in the GVC. To stop charges: detach the binding (update_ipset with removeLink: true) so free locations release, then delete the IP set to release the rest.
• state: bound means both sides point at each other; unbound means allocated but unused. Delete is blocked with 400 while any address is bound — remove the back-link first. Re-adding a location later does NOT return the same IP.
• Supported on AWS (Elastic IP), GCP (static external address, STANDARD network tier), and Azure (static public IPv4), including BYOK on those clouds. Other providers fail with status.error "provider not configured to use IpSets"; cloud IP-quota errors also land in status.error.