oracle / oracle/oci-cloud-controller-manager

NotAuthorizedOrNotFound in NLB Kuberentes Ingress Controller

Open
#408 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
158
Forks
108
PR merge metrics
No merged PRs in 30d

Description

Is this a BUG REPORT or FEATURE REQUEST?

BUG REPORT

Versions

CCM Version: v1.24.0

What happened?

When using "loadBalancerIP" in the Nginx Ingress Controller manifest. LoadBalancer returns failure

What you expected to happen?

When specifying reserved IP in "loadBalancerIP" manifest, load balancer must be created with specified IP

How to reproduce it (as minimally and precisely as possible)?

  1. Create an Oracle Cloud Reserved IP

  2. Insert LoadBalancerIP into the manifest:
    kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.5.1/deploy/static/provider/cloud/deploy.yaml

apiVersion: v1
kind: Service
metadata:
  annotations:
    oci.oraclecloud.com/load-balancer-type: "nlb"
    service.beta.kubernetes.io/oci-load-balancer-shape: "flexible"
    service.beta.kubernetes.io/oci-load-balancer-shape-flex-min: "10"
    service.beta.kubernetes.io/oci-load-balancer-shape-flex-max: "100"
    oci-network-load-balancer.oraclecloud.com/is-preserve-source: "true" 
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/version: 1.5.1
  name: ingress-nginx-controller
  namespace: ingress-nginx
spec:
  externalTrafficPolicy: Local
  ipFamilies:
  - IPv4
  ipFamilyPolicy: SingleStack
  ports:
  - appProtocol: http
    name: http
    port: 80
    protocol: TCP
    targetPort: http
  - appProtocol: https
    name: https
    port: 443
    protocol: TCP
    targetPort: https
  selector:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  loadBalancerIP: MY-IP-RESERVED
  type: LoadBalancer
  1. It should return the error in NLB:
    (404, NotAuthorizedOrNotFound, false) Authorization failed or requested resource not found.
    image

Anything else we need to know?

I'm creating according documents:
https://docs.oracle.com/en-us/iaas/Content/ContEng/Tasks/contengcreatingloadbalancer.htm#contengcreatingloadbalancer_topic_Specifying_Load_Balancer_Reservado_IP

I have full permission on my tenancy.
The Reserved IP is on the same IP as the Cluster...
If I don't specify LoadBalancerIP, the LB is successfully created!

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing the CCM v1.24.0 handling of Service loadBalancerIP and NLB creation, using the provided ingress-nginx manifest and the OCI reserved-IP documentation as the reproduction context. Done means a Service using a reserved IP creates the NLB successfully instead of returning NotAuthorizedOrNotFound, while Services without loadBalancerIP continue to work.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.