Network Load Balancers#
Network Load Balancers (NLB) control the routing of WebRTC traffic between the external client and the instance of the streaming Omniverse Kit App running within the cluster.
You can configure the number of streams an NLB can manage, allowing for a variety of deployment options.
When deployed to AWS or Azure, the CSP native NLB is used. When deploying on-prem, you must decide which NLB best fits your needs. NVIDIA uses MetalLB for internal development and testing.
TLS Encryption#
Omniverse Kit App Streaming supports two methods of TLS encryption of the WebRTC TCP signaling channel; termination at the NLB or termination at the Pod through Envoy Proxy. For simplicity in management and deployment, the preferred method is to enable TLS termination at the NLB by attaching a valid TLS certificate.
Port Reference#
Session chart default ports. The shipped sample ApplicationProfiles override the Service-level ports (typically 31000/31001, or 443/80 in the TLS samples), so check streamingKit.service in the profile you deployed; the container-side ports are fixed by the Kit application.
Purpose |
Protocol and port |
Where configured |
|---|---|---|
WebRTC signaling (Service) |
TCP, chart default |
|
WebRTC media (Service) |
UDP, chart default |
|
Kit application stream port (container) |
UDP |
Kit application setting; the Service media port targets it |
Kit application HTTP and health (container) |
TCP |
Kit application |
Session health (Service) |
TCP |
|
Kit version stream-port defaults. The Kit application’s default stream (media) port changed between Kit 107 and Kit 108:
Kit version |
Default stream port |
Default signaling port |
|---|---|---|
106.x / 107.x |
|
|
108.x and later |
|
|
If a Kit application is upgraded across this boundary without updating the port configuration and firewall rules, streams stop connecting, because the streaming infrastructure assumes 47998 (Kit App Streaming adopted the 47998 default in release 1.11.1, alongside Kit 109 support). When streaming an application built on an earlier Kit version, either update the application per the Kit 108 migration guide or align the media port configuration and your firewall rules to the application’s configured port.
Note
In addition to the signaling and media ports, WebRTC ICE negotiation can use nearby ports: the usd-viewer container exposes TCP and UDP 47995-48012 and 49000-49007 (the signaling port 49100 is separate from these ranges). When configuring firewalls between clients and GPU worker nodes, allow the media UDP range rather than only port 47998.
Provisioning NLBs#
You are responsible for provisioning the NLBs available to be used by the Omniverse Kit App Streaming instance.
AWS NLB Manager (optional)#
In AWS, Listeners and Target Groups must be created and properly configured to enable routing to Kit Applications. The Omniverse Kit App Streaming contains an optional service, AWS NLB Manager, that automates the creation and re-binding of these components as streams are initiated and terminated.
Tags are used to identify which NLBs in the cluster are available for WebRTC routing, allowing the AWS NLB Manager to dynamically manage the appropriate resources.