envoyproxy / envoyproxy/gateway

Annotations conflict between merged gateways when configuring Ip and Subnet in azure

Open
#6,501 1 comment 0 reactions 0 assignees View on GitHub
stale triage
Dominant language
Go
Stars
3k
Forks
864
Avg merge
2d 2h
Merged PRs (30d)
140

Description

I have come across a peculiar behaviour when using merged gateways:

Our project aims to deploy and expose containers and databases requested by projects within our organization.
We use multiple clusters provided by AKS with each of them utilizing envoy gateway for multiple features.
Everything happens within an intranet.
On one type of cluster there are two gateways, defined as follows:

![Image](https://github.com/user-attachments/assets/afdde3fc-06a9-42c8-9c94-ab026a5de7e9)
![Image](https://github.com/user-attachments/assets/a792e526-2d34-49da-ab51-635c1a50de2f)
The first is general purpose, the second is for database admin UIs and has a securitypolicy attached.

The envoyproxy config:

![Image](https://github.com/user-attachments/assets/8c65a11b-6dd8-4ec9-bd34-dc291742d13b)

The gatewayclass:

![Image](https://github.com/user-attachments/assets/2d7d5b7e-f40d-4979-8f6d-4754cf18e838)

As you can see we define the requested IP and subnet via the infrastructure configuration on the first gateway.
These annotations are passed to the LoadBalancer service that requests the ip assignation.

Now for the aforementioned behaviour:
The load balancer service keeps alternating between the annotations from the first gateway and no annotations. The service keeps its IP because a rule forbids unexpected public ip requests but it does request one when it has no annotations.

![Image](https://github.com/user-attachments/assets/6e727746-cf85-444d-8693-5b014d538649)
![Image](https://github.com/user-attachments/assets/2ebedd47-3dff-465e-be4b-1b55119635dd)

Now I assume that it is the other gateway which has no infrastructure config that squashes the annotations.
It may be a fringe case but I have seen no indication that this kind of conf can cause conflict between merged gateways.

Chart and gateway image : 1.4
Envoy: 1.32

Solution:
A really simple fix has been to move IP configuration from the gateway to the envoyproxy:

![Image](https://github.com/user-attachments/assets/7a1a7df0-3090-4d9f-8629-0761fe4c71c8)
![Image](https://github.com/user-attachments/assets/985211bd-33f2-409b-9e6e-17c4be36da3c)

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.