Repository navigation
feat: Give load balancers a public IPv6 address per location - #712
Conversation
|
|
Each load balancer gets one public IPv6 address in every location where its backends run, or in the locations the customer chooses, so customers have a stable per-location address and hostname to point DNS at. Key changes: - Reserve one IPv6 address per address request and selected location - Report selected locations, addresses and per-location hostnames in status - Hold an old address until traffic and DNS for it are withdrawn - Refuse selections above the 1,024 endpoint limit before claiming addresses
ad49e8f to
9d6ed42
Compare
kevwilliams
left a comment
kevwilliams
left a comment
There was a problem hiding this comment.
Adds the allocation controller that holds one public IPv6 IPClaim per load balancer, address request, location and family, with deterministic UID-scoped claim names, UID preconditions on release, and a finalizer that waits until announced, programmed or published addresses are withdrawn before releasing them. Build, vet and the new unit tests pass, and mutating the withdrawal gate, the orphan cleanup or the per-location claim identity makes those tests fail, so they test the logic for real. Non-blocking: the controller lists NetworkLoadBalancerRoutes without a route RBAC grant (#713 in this stack adds it), and with the default Backends source a single missing route or backend NetworkService resolves the whole request to zero locations, which releases its unannounced addresses. That second point is worth keeping in mind once addresses are announced.
ecv
left a comment
ecv
left a comment
There was a problem hiding this comment.
Approve.
Ran at 9d6ed42: the NetworkLoadBalancer controller tests pass with envtest 1.31.0 and the locations CRDs rendered, and go vet is clean.
internal/controller/networkloadbalancer_controller.go:54 lists RBAC markers for networks, locations and namespaces only, but the reconciler also lists NetworkLoadBalancerRoute, NetworkService and NetworkInterface.
Route read access only arrives in #713, so this commit alone fails the default Backends source under the shipped role.
Add the three resources to the markers here so each commit in the stack runs.
internal/controller/networkloadbalancer_controller.go:308 picks the winning route without the capability filter and UID tie-break that oldestRouteForListener applies in #713.
Reuse one function so address placement and route status cannot pick different routes.
internal/controller/networkloadbalancer_controller.go:129 sets allAllocated false when no route is attached, so a new load balancer reports Allocated=False with "One or more requested addresses are pending or awaiting withdrawal" (line 220).
Report a reason such as AwaitingRoute instead, since the proposal says placement is pending with no route.
Nit: the file carries 22 comment lines and the repo CLAUDE.md asks for none.
Stack: based on #624, merge after it.
Summary
Each load balancer gets a public IPv6 address in every location where its backends run, or in the locations the customer chooses. Status lists the chosen locations, each address, and a stable hostname per location that customers can point DNS at. When an address changes or a location is dropped, the old address stays reserved until traffic and DNS for it have been withdrawn. Publishing DNS records and IPv4 addresses come later.
Test plan
One known gap: if someone deletes an address reservation directly, outside the load balancer, the address can be released before it's withdrawn.
Depends on #624. Replaces #626. Related to #611 and datum-cloud/enhancements#884