digitalocean / digitalocean/digitalocean-cloud-controller-manager

Prevent duplicate do-loadbalancer-name annotation from changing LB ownership

Open
#556 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
574
Forks
153
Avg merge
3d 6h
Merged PRs (30d)
3

Description

Yesterday, I created a second DOKS cluster while the first one had network-traffic issues due to a bug in the latest version after upgrading. When installing my Traefik chart on the second cluster, I forgot to first change the `service.beta.kubernetes.io/do-loadbalancer-name` annotation on the service.

What happened was that this LB, which was still connected to the (non-functioning) service on the old cluster, was moved to the new cluster service. A little while later, when the issue on the old cluster was resolved, the service on that cluster started running again and "reclaimed" ownership of the LB again.

Altough in this case it was somewhat convenient to have the LB move around so easily, so that traffic was redirected without need to alter DNS records, the sudden changes in traffic (re)direction did cause some confusion on our side.

What I expected to happen was an error preventing me from creating a service with a LB name already in use. According to the [docs about changing ownership](https://github.com/digitalocean/digitalocean-cloud-controller-manager/blob/master/docs/controllers/services/examples/README.md#changing-ownership-of-a-load-balancer-for-migration-purposes), this should only work when one first explicitly disowns the LB from the previous service and explicitly provides a `kubernetes.digitalocean.com/load-balancer-id` when installing/updating the service.

*Important note:* I do not have a `kubernetes.digitalocean.com/load-balancer-id` in my chart, so the change of ownership was caused by just the `service.beta.kubernetes.io/do-loadbalancer-name` tag being identical.

Suggested steps for reproduction:
1. Create a DOKS Cluster `foo`
2. Add a Service/LoadBalancer template to cluster `foo` with annotation `service.beta.kubernetes.io/do-loadbalancer-name: foo`
3. Create a second DOKS Cluster `bar`
4. Add a Service/LoadBalancer template to cluster `bar` with annotation `service.beta.kubernetes.io/do-loadbalancer-name: foo` (possibly requires a service malfunctioning on cluster `foo` while setting?)
5. The LoadBalancer created by the service on cluster `foo` will move to service on cluster `bar`.

Expected result (at least for me): step 4. would yield an error: "Cannot provision LoadBalancer: name `foo` already in use.".

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.