wzzirro opened a new pull request, #112: URL: https://github.com/apache/cloudstack-kubernetes-provider/pull/112
### Description Fixes #111 For Services with `service.beta.kubernetes.io/cloudstack-load-balancer-proxy-protocol: "true"` the CCM now reports the load balancer ingress with `ipMode: Proxy`. With an empty `ipMode` (treated as `VIP`) kube-proxy short-circuits in-cluster traffic to the load balancer IP straight to the backends, so the PROXY header is never added and backends that strictly require PROXY protocol drop the connection. With `ipMode: Proxy` the traffic goes through the CloudStack load balancer, which adds the header. Services without the annotation are unchanged. Changes: - `loadBalancerIngress()` helper used by both `GetLoadBalancer` and `EnsureLoadBalancer` to build the ingress status entry. - `k8s.io/*` dependencies bumped from v0.24.17 to v0.32.5 (`LoadBalancerIngress.IPMode` appeared in v0.29); obsolete v0.24 `replace` directives removed. - `cmd/cloudstack-ccm/main.go`: `app.NewCloudControllerManagerCommand` now takes controller aliases (`names.CCMControllerAliases()`) after the bump. - Test in `TestEnsureLoadBalancer` checks `IPMode` for the PROXY protocol case. ### Types of changes - [x] Bug fix (non-breaking change which fixes an issue) - [ ] New feature - [ ] Breaking change ### How has this been tested? - `go build ./...`, `go vet ./...`, `go test ./...` pass. - Deployed in our cluster in front of Envoy Gateway with strict PROXY protocol: in-cluster clients connecting to the public IP now work; external traffic is unaffected. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
