Allow Gateways to request a specific NodePort in the automatically created Service
Closed this issue · 7 comments
Several users requested for a way to enforce a specific NodePort when exposing a Gateway. This can be done by, say, adding the annotation stunner.l7mp.io/nodeport: <my-nodeport> that would the operator consider when creating the Service. Enforcing a NodePort that is already used is an error.
This issue is to track the progress in implementing this feature.
We also need to consider the case of complex-gateway with multiple listeners. Then we probably need multiple node ports.
Hmm, very good point, thx! What about a list of key-value pairs in the annotation value like stunner.l7mp.io/nodeport: ["udp-listener":32000,"tcp-listener":32001,"tls-listener":32002,"dtls-listener":32003], where each key-value pair is a name of a listener and a requested nodeport? Wdyt?
This is now implemented in l7mp/stunner-gateway-operator@b92ef6a, you can install it from the dev channel. Dear @smeng9, can you please test this and report any problem you find?
Hi @rg0now sorry for late reply
I have performed some test and seems there are some issues creating the service/complex-gateway in 0.19.0
Here is the list of what kubernetes resources originally I had in 0.18.0 . In 0.18.0 I manually used kube edit to change the node port number of service/complex-gateway after a deploy.
I used the annotation in 0.19.0 but I cannot find the service/complex-gateway anymore
Here is my config. I realized there are some changes are not very clear in the doc, first stunner.l7mp.io/enable-mixed-protocol-lb type seems gets changed from boolean to a string. Second I have to add escapes to the stunner.l7mp.io/nodeport.
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: complex-gateway
namespace: stunner
annotations:
stunner.l7mp.io/enable-mixed-protocol-lb: "true"
stunner.l7mp.io/nodeport: "{\"udp-listener\":31478,\"tcp-listener\":31479}"
service.beta.kubernetes.io/do-loadbalancer-healthcheck-port: "8086"
service.beta.kubernetes.io/do-loadbalancer-healthcheck-protocol: "http"
service.beta.kubernetes.io/do-loadbalancer-healthcheck-path: "/live"
spec:
gatewayClassName: stunner-gatewayclass
listeners:
- name: udp-listener
port: 31478
protocol: TURN-UDP
allowedRoutes:
namespaces:
from: All
- name: tcp-listener
port: 31479
protocol: TURN-tcp
allowedRoutes:
namespaces:
from: All
Is there way I can troubleshoot the service/complex-gateway not showing up?
Please ignore previous message. Ah finally I used a completely clean setup seems the annotation is successfully applied. Maybe due to some outdated CRDs when upgrading.
Unfortunately, if there's a nodeport conflict (some other Service is already using the same nodeport) then the Service will fail to update and you won't see any Service at all. That's one of the reasons we advise against using NodePorts. Happy you made it work!