I built zlb for clusters where:

- public IPs are scarce and routed to one machine;

- nodes have no inbound internet access ;

- there's no BGP or shared L2, so MetalLB, Cilium IPAM, and kube-vip don't fit.

A controller watches LoadBalancer Services and pushes the desired state to a small daemon on that machine. The daemon programs nftables DNAT from publicIP:port to node:NodePort, keeping the client IP.

Services are published on their NodePort , so all of them can share one IP: two Postgres Services on 5432 become IP:31543 and IP:30876. Literal ports like 80/443 come from explicit reservations (e.g Ingress Controller gets 80/443 on the public IP).

TCP/UDP/SCTP, Local/Cluster traffic policy, loadBalancerSourceRanges enforced at the edge

Atomic, verified nftables changes with rollback; forwarding survives crashes and upgrades

TLS/mTLS API, sandboxed non-root daemon, Helm chart with optional SSH bootstrap of the VM

Limits: the edge node is a single point of failure for now (active/standby with VRRP and…