oracle / oracle/oci-cloud-controller-manager
NotAuthorizedOrNotFound in NLB Kuberentes Ingress Controller
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 158
- Forks
- 108
- PR merge metrics
- No merged PRs in 30d
Description
Is this a BUG REPORT or FEATURE REQUEST?
BUG REPORT
Versions
CCM Version: v1.24.0
What happened?
When using "loadBalancerIP" in the Nginx Ingress Controller manifest. LoadBalancer returns failure
What you expected to happen?
When specifying reserved IP in "loadBalancerIP" manifest, load balancer must be created with specified IP
How to reproduce it (as minimally and precisely as possible)?
-
Create an Oracle Cloud Reserved IP
-
Insert LoadBalancerIP into the manifest:
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.5.1/deploy/static/provider/cloud/deploy.yaml
apiVersion: v1
kind: Service
metadata:
annotations:
oci.oraclecloud.com/load-balancer-type: "nlb"
service.beta.kubernetes.io/oci-load-balancer-shape: "flexible"
service.beta.kubernetes.io/oci-load-balancer-shape-flex-min: "10"
service.beta.kubernetes.io/oci-load-balancer-shape-flex-max: "100"
oci-network-load-balancer.oraclecloud.com/is-preserve-source: "true"
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.5.1
name: ingress-nginx-controller
namespace: ingress-nginx
spec:
externalTrafficPolicy: Local
ipFamilies:
- IPv4
ipFamilyPolicy: SingleStack
ports:
- appProtocol: http
name: http
port: 80
protocol: TCP
targetPort: http
- appProtocol: https
name: https
port: 443
protocol: TCP
targetPort: https
selector:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
loadBalancerIP: MY-IP-RESERVED
type: LoadBalancer
- It should return the error in NLB:
(404, NotAuthorizedOrNotFound, false) Authorization failed or requested resource not found.

Anything else we need to know?
I'm creating according documents:
https://docs.oracle.com/en-us/iaas/Content/ContEng/Tasks/contengcreatingloadbalancer.htm#contengcreatingloadbalancer_topic_Specifying_Load_Balancer_Reservado_IP
I have full permission on my tenancy.
The Reserved IP is on the same IP as the Cluster...
If I don't specify LoadBalancerIP, the LB is successfully created!
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the CCM v1.24.0 handling of Service loadBalancerIP and NLB creation, using the provided ingress-nginx manifest and the OCI reserved-IP documentation as the reproduction context. Done means a Service using a reserved IP creates the NLB successfully instead of returning NotAuthorizedOrNotFound, while Services without loadBalancerIP continue to work.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100