Bug 1907315

Summary:	the internal load balancer annotation for AWS should use "true" instead of "0.0.0.0/0" as value
Product:	OpenShift Container Platform	Reporter:	Hongan Li <hongli>
Component:	Networking	Assignee:	Ryan Fredette <rfredette>
Networking sub component:	router	QA Contact:	Hongan Li <hongli>
Status:	CLOSED ERRATA	Docs Contact:
Severity:	low
Priority:	low	CC:	amcdermo, aos-bugs, bmcelvee, mmasters
Version:	4.7
Target Milestone:	---
Target Release:	4.8.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-07-27 22:35:01 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Hongan Li 2020-12-14 08:24:42 UTC

Description of problem:
the internal load balancer on AWS has the annotation:
service.beta.kubernetes.io/aws-load-balancer-internal: 0.0.0.0/0

The "0.0.0.0/0" is confusing and k8s documents are using:
service.beta.kubernetes.io/aws-load-balancer-internal: "true"
see: 
https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer
https://docs.aws.amazon.com/eks/latest/userguide/load-balancing.html

Version-Release number of selected component (if applicable):
4.7.0-0.nightly-2020-12-14-035110

How reproducible:
100%

Steps to Reproduce:
1. create ingresscontroller with 
   "spec.endpointPublishingStrategy.loadBalancer.scope: internal"
2. check the load balancer service
3.

Actual results:
it has the annotation:
service.beta.kubernetes.io/aws-load-balancer-internal: 0.0.0.0/0

Expected results:
it has the annotation:
service.beta.kubernetes.io/aws-load-balancer-internal: "true"

Additional info:

Comment 1 Miciah Dashiel Butler Masters 2020-12-14 21:50:43 UTC

The English documentation used to say to use "0.0.0.0/0", but it was changed to "true" on Aug 14, 2019 with this commit: https://github.com/kubernetes/website/pull/15851/commits/b0d9abf5514e7615ffcee47a216fd23ed88586b3

Some translations of the documentation still have "0.0.0.0/0":  https://github.com/kubernetes/website/search?q=service.beta.kubernetes.io%2Faws-load-balancer-internal

Anyway, as long as the value isn't "false" and isn't empty, it is treated as true:  https://github.com/kubernetes/kubernetes/blob/568cd3df0b45721f45cfaa1165fe88dfdab5b701/staging/src/k8s.io/legacy-cloud-providers/aws/aws.go#L3863-L3868

So this is more an aesthetic issue than anything.  Setting to low severity, low priority.

Comment 3 Hongan Li 2021-03-31 07:39:38 UTC

verified with 4.8.0-0.nightly-2021-03-30-160509 and passed.

$ oc -n openshift-ingress get svc/router-lb-int -oyaml
apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-healthcheck-healthy-threshold: "2"
    service.beta.kubernetes.io/aws-load-balancer-healthcheck-interval: "5"
    service.beta.kubernetes.io/aws-load-balancer-healthcheck-timeout: "4"
    service.beta.kubernetes.io/aws-load-balancer-healthcheck-unhealthy-threshold: "2"
    service.beta.kubernetes.io/aws-load-balancer-internal: "true"

Comment 5 Brandi Munilla 2021-06-24 16:51:59 UTC

Hi, does this bug require doc text? If so, please update the doc text field.

Comment 7 errata-xmlrpc 2021-07-27 22:35:01 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.8.2 bug fix and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:2438