kubernetes-sigs / kubernetes-sigs/aws-load-balancer-controller
Allow multiple controller deployment per cluster
- Dominant language
- Go
- Stars
- 4.3k
- Forks
- 1.6k
- Avg merge
- 1d 15h
- Merged PRs (30d)
- 6
Description
**Is your feature request related to a problem?**
Currently We only support a single controller deployment per cluster if worker node SG rules is managed by the controller.
Since the controller assumes it's the solo owner of worker node security group rules with `elbv2.k8s.aws/targetGroupBinding=shared` description, running multiple controller deployment will cause these controllers compete with each other updating worker node security group rules.
See also:
1. https://github.com/kubernetes-sigs/aws-load-balancer-controller/issues/2178
2. https://github.com/kubernetes-sigs/aws-load-balancer-controller/issues/2183
**Describe the solution you'd like**
We could leverage the new tagging support for security groups, and add a flag(e.g. --controller-instance=instance-a) to identify the controller deployment.
So that each controller will do following
1. when a worker node SG rule is needed:
a. if the rule don't exists, and tag the rule with controller-specific tags like "elbv2.k8s.aws/targetGroupBinding/instance-a": "shared"
b. if the rule already exists, add additional tags to the rule like "elbv2.k8s.aws/targetGroupBinding/instance-a": "shared"
2. when a worker node SG rule is not needed:
a. if the rule already exists and there are multiple tags with prefix "elbv2.k8s.aws/targetGroupBinding", remove the controller's specific tag. e.g. "elbv2.k8s.aws/targetGroupBinding/instance-b"
b. if the rule already exists and there is only one tag with prefix "elbv2.k8s.aws/targetGroupBinding, and this tag matches the controller's one, remove the rule
**Describe alternatives you've considered**
A description of any alternative solutions or features you've considered.
Contributor guide
Research direction
The issue names no files or tests; first read the related issues #2178 and #2183, then trace the controller's worker-node security-group rule reconciliation. Done means separate controller deployments can add and remove their own tagged rules without competing or deleting rules still needed by another controller.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, go
- Domain
- cloud, networking
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100