allowedCIDRs breaks when not using the reference neutron implementation due to the api being accessed over public IP #1851
Labels
kind/bug
Categorizes issue or PR as related to a bug.
lifecycle/stale
Denotes an issue or PR has remained open with no activity and has become stale.
/kind bug
What steps did you take and what happened:
I try to implement
allowedCIDRs
for my clusters. doing this by settingallowedCIDRs
in theapiServerLoadBalancer
in the openstackcluster spec.Example:
The problem I face is that we do not use the standard neutron implementation where all nodes are using the routers IP for snat. This means when trying to bootstrap the first node it fails to start the kubelet due to connections to the API being blocked by the loadbalancer.
I could manually add all our snat pools IPs and everything works. the problem with this is that the SNAT IPs are shared between multiple customers. and even If I use the new IPAM code that is under review I would still need to manually add those IPs to the
allowedCIDRs
list.What did you expect to happen:
I expect all cluster nodes to use the internal LB endpoint for api traffic. It seems a bit odd when there is an internal endpoint to use the external IP for in-cluster traffic?
Anything else you would like to add:
Another alternative is to use the IPAM ippool, the problem for this is that we need to watch another object and trigger an lb reconcile upon. However this object contains a list of valid IPs that could simply be appended. I think it would make more sense to migrate to use the internal endpoint for in-cluster api traffic.
Environment:
git rev-parse HEAD
if manually built): latest master (commit: 5cc483b)kubectl version
): 1.29.1/etc/os-release
): ubuntu 22.04The text was updated successfully, but these errors were encountered: