kubernetes-sigs / kubernetes-sigs/aws-load-balancer-controller

Allow multiple controller deployment per cluster

Open
#2,185 41 comments 44 reactions 0 assignees View on GitHub
kind/feature lifecycle/frozen
Dominant language
Go
Stars
4.3k
Forks
1.6k
Avg merge
1d 15h
Merged PRs (30d)
6

Description

**Is your feature request related to a problem?**
Currently We only support a single controller deployment per cluster if worker node SG rules is managed by the controller.
Since the controller assumes it's the solo owner of worker node security group rules with `elbv2.k8s.aws/targetGroupBinding=shared` description, running multiple controller deployment will cause these controllers compete with each other updating worker node security group rules.

See also:
1. https://github.com/kubernetes-sigs/aws-load-balancer-controller/issues/2178
2. https://github.com/kubernetes-sigs/aws-load-balancer-controller/issues/2183

**Describe the solution you'd like**
We could leverage the new tagging support for security groups, and add a flag(e.g. --controller-instance=instance-a) to identify the controller deployment.
So that each controller will do following
1. when a worker node SG rule is needed:
a. if the rule don't exists, and tag the rule with controller-specific tags like "elbv2.k8s.aws/targetGroupBinding/instance-a": "shared"
b. if the rule already exists, add additional tags to the rule like "elbv2.k8s.aws/targetGroupBinding/instance-a": "shared"
2. when a worker node SG rule is not needed:
a. if the rule already exists and there are multiple tags with prefix "elbv2.k8s.aws/targetGroupBinding", remove the controller's specific tag. e.g. "elbv2.k8s.aws/targetGroupBinding/instance-b"
b. if the rule already exists and there is only one tag with prefix "elbv2.k8s.aws/targetGroupBinding, and this tag matches the controller's one, remove the rule

**Describe alternatives you've considered**
A description of any alternative solutions or features you've considered.

Contributor guide

Open the contributing guide

Research direction

The issue names no files or tests; first read the related issues #2178 and #2183, then trace the controller's worker-node security-group rule reconciliation. Done means separate controller deployments can add and remove their own tagged rules without competing or deleting rules still needed by another controller.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, go
Domain
cloud, networking
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.