Bug 1907315 - the internal load balancer annotation for AWS should use "true" instead of "0.0.0.0/0" as value
Summary: the internal load balancer annotation for AWS should use "true" instead of "0...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Networking
Version: 4.7
Hardware: Unspecified
OS: Unspecified
low
low
Target Milestone: ---
: 4.8.0
Assignee: Ryan Fredette
QA Contact: Hongan Li
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-12-14 08:24 UTC by Hongan Li
Modified: 2022-08-04 22:30 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-07-27 22:35:01 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift cluster-ingress-operator pull 543 0 None open Bug 1907315: Change AWS interal LB annotation to match documentation 2021-02-08 18:22:00 UTC
Red Hat Product Errata RHSA-2021:2438 0 None None None 2021-07-27 22:35:27 UTC

Description Hongan Li 2020-12-14 08:24:42 UTC
Description of problem:
the internal load balancer on AWS has the annotation:
service.beta.kubernetes.io/aws-load-balancer-internal: 0.0.0.0/0

The "0.0.0.0/0" is confusing and k8s documents are using:
service.beta.kubernetes.io/aws-load-balancer-internal: "true"
see: 
https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer
https://docs.aws.amazon.com/eks/latest/userguide/load-balancing.html

Version-Release number of selected component (if applicable):
4.7.0-0.nightly-2020-12-14-035110

How reproducible:
100%

Steps to Reproduce:
1. create ingresscontroller with 
   "spec.endpointPublishingStrategy.loadBalancer.scope: internal"
2. check the load balancer service
3.

Actual results:
it has the annotation:
service.beta.kubernetes.io/aws-load-balancer-internal: 0.0.0.0/0

Expected results:
it has the annotation:
service.beta.kubernetes.io/aws-load-balancer-internal: "true"

Additional info:

Comment 1 Miciah Dashiel Butler Masters 2020-12-14 21:50:43 UTC
The English documentation used to say to use "0.0.0.0/0", but it was changed to "true" on Aug 14, 2019 with this commit: https://github.com/kubernetes/website/pull/15851/commits/b0d9abf5514e7615ffcee47a216fd23ed88586b3

Some translations of the documentation still have "0.0.0.0/0":  https://github.com/kubernetes/website/search?q=service.beta.kubernetes.io%2Faws-load-balancer-internal

Anyway, as long as the value isn't "false" and isn't empty, it is treated as true:  https://github.com/kubernetes/kubernetes/blob/568cd3df0b45721f45cfaa1165fe88dfdab5b701/staging/src/k8s.io/legacy-cloud-providers/aws/aws.go#L3863-L3868

So this is more an aesthetic issue than anything.  Setting to low severity, low priority.

Comment 3 Hongan Li 2021-03-31 07:39:38 UTC
verified with 4.8.0-0.nightly-2021-03-30-160509 and passed.

$ oc -n openshift-ingress get svc/router-lb-int -oyaml
apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-healthcheck-healthy-threshold: "2"
    service.beta.kubernetes.io/aws-load-balancer-healthcheck-interval: "5"
    service.beta.kubernetes.io/aws-load-balancer-healthcheck-timeout: "4"
    service.beta.kubernetes.io/aws-load-balancer-healthcheck-unhealthy-threshold: "2"
    service.beta.kubernetes.io/aws-load-balancer-internal: "true"

Comment 5 Brandi Munilla 2021-06-24 16:51:59 UTC
Hi, does this bug require doc text? If so, please update the doc text field.

Comment 7 errata-xmlrpc 2021-07-27 22:35:01 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.8.2 bug fix and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:2438


Note You need to log in before you can comment on or make changes to this bug.