Skip to content

Update Safespring loadbalancer configuration to support kube-vip #2890

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
simonklb merged 3 commits into from
Dec 15, 2025
Merged

Update Safespring loadbalancer configuration to support kube-vip #2890

simonklb merged 3 commits into from
Dec 15, 2025

Conversation

@simonklb
Copy link
Contributor

@simonklb simonklb commented Dec 5, 2025

Warning

This is a public repository, ensure not to disclose:

  • personal data beyond what is necessary for interacting with this pull request, nor
  • business confidential information, such as customer names.

What kind of PR is this?

Required: Mark one of the following that is applicable:

  • kind/feature
  • kind/improvement
  • kind/deprecation
  • kind/documentation
  • kind/clean-up
  • kind/bug
  • kind/other

Optional: Mark one or more of the following that are applicable:

Important

Breaking changes should be marked kind/admin-change or kind/dev-change depending on type
Critical security fixes should be marked with kind/security

  • kind/admin-change
  • kind/dev-change
  • kind/security
  • [kind/adr](set-me)

What does this PR do / why do we need this PR?

Without this the kube-vip setup does not work.

Information to reviewers

  1. Not sure if we also should add some default node-selector and tolerations?
  2. This will break the Kubespray setup. Do we have any other similar situations where we can configure them differently?

Checklist

  • Proper commit message prefix on all commits
  • Change checks:
    • The change is transparent
    • The change is disruptive
    • The change requires no migration steps
    • The change requires migration steps
    • The change updates CRDs
    • The change updates the config and the schema
  • Documentation checks:
  • Metrics checks:
    • The metrics are still exposed and present in Grafana after the change
    • The metrics names didn't change (Grafana dashboards and Prometheus alerts required no updates)
    • The metrics names did change (Grafana dashboards and Prometheus alerts required an update)
  • Logs checks:
    • The logs do not show any errors after the change
  • PodSecurityPolicy checks:
    • Any changed Pod is covered by Kubernetes Pod Security Standards
    • Any changed Pod is covered by Gatekeeper Pod Security Policies
    • The change does not cause any Pods to be blocked by Pod Security Standards or Policies
  • NetworkPolicy checks:
    • Any changed Pod is covered by Network Policies
    • The change does not cause any dropped packets in the NetworkPolicy Dashboard
  • Audit checks:
    • The change does not cause any unnecessary Kubernetes audit events
    • The change requires changes to Kubernetes audit policy
  • Falco checks:
    • The change does not cause any alerts to be generated by Falco
  • Bug checks:
    • The bug fix is covered by regression tests

@simonklb simonklb requested review from Xartos, viktor-f and vomba December 5, 2025 17:15
Xartos
Xartos requested changes Dec 8, 2025
View reviewed changes
Copy link
Contributor

@Xartos Xartos left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: Also add migration for this to add the old variables as overrides. Since it might break existing clusters that are using these defaults

@simonklb
Copy link
Contributor Author

simonklb commented Dec 8, 2025 •
edited
Loading

  1. Not sure if we also should add some default node-selector and tolerations?

  2. This will break the Kubespray setup. Do we have any other similar situations where we can configure them differently?

@simonklb
Copy link
Contributor Author

simonklb commented Dec 8, 2025

Suggestion: Also add migration for this to add the old variables as overrides. Since it might break existing clusters that are using these defaults

Do we have any Safespring clusters on CAPI?

@simonklb simonklb requested review from a team and Xartos December 8, 2025 12:28
@simonklb
Copy link
Contributor Author

simonklb commented Dec 8, 2025

Added @elastisys/goto-cluster-api and @elastisys/goto-safespring as reviewers for extra eyes on this

@vomba
Copy link
Contributor

vomba commented Dec 8, 2025

Suggestion: Also add migration for this to add the old variables as overrides. Since it might break existing clusters that are using these defaults

Do we have any Safespring clusters on CAPI?

I don't think we have any now.

@Xartos
Copy link
Contributor

Xartos commented Dec 8, 2025

  1. Not sure if we also should add some default node-selector and tolerations?

Nope, that depends on how the cluster is setup and we can't know that in advance

2. This will break the Kubespray setup. Do we have any other similar situations where we can configure them differently?

This is why we need migration scripts, so that existing clusters keeps their old configuration that is currently working. This could be the default going forward, but the migration from 49 -> 50 should at least not break existing clusters.
Then you'll have to start to override if you are using kubespray, but hopefully the main clusters should use capi from here on.

@simonklb
Copy link
Contributor Author

simonklb commented Dec 8, 2025

  1. Not sure if we also should add some default node-selector and tolerations?

Nope, that depends on how the cluster is setup and we can't know that in advance

2. This will break the Kubespray setup. Do we have any other similar situations where we can configure them differently?

This is why we need migration scripts, so that existing clusters keeps their old configuration that is currently working. This could be the default going forward, but the migration from 49 -> 50 should at least not break existing clusters. Then you'll have to start to override if you are using kubespray, but hopefully the main clusters should use capi from here on.

I'll try to make it possible to have separate configs for separate installers instead. Feels like as long as we support multiple installers this will be necessary.

@aarnq
Copy link
Contributor

aarnq commented Dec 9, 2025

I'm unsure why this is being changed?

Will this mean that we only support Safespring on CAPI from this moment onwards? If so then fine, note that we will then have the additional requirement of always having Elastic IPs available there.

Why this wasn't changed to match how we setup MetalLB (which is the same configuration as this) was due to it requiring internal steps to setup, and Elastic IPs. So it wasn't considered something that someone could pick up and use by default.

@simonklb simonklb requested a review from a team as a code owner December 9, 2025 09:44
@simonklb
Copy link
Contributor Author

simonklb commented Dec 9, 2025

I'm unsure why this is being changed?

Will this mean that we only support Safespring on CAPI from this moment onwards? If so then fine,

Not anymore: b9d990d

note that we will then have the additional requirement of always having Elastic IPs available there.

Someone that has more insight will have to answer this.

Why this wasn't changed to match how we setup MetalLB (which is the same configuration as this) was due to it requiring internal steps to setup, and Elastic IPs. So it wasn't considered something that someone could pick up and use by default.

Someone that has more insight will have to answer this.

vomba
vomba approved these changes Dec 9, 2025
View reviewed changes
Copy link
Contributor

@vomba vomba left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚀

aarnq
aarnq reviewed Dec 9, 2025
View reviewed changes
Zash
Zash reviewed Dec 9, 2025
View reviewed changes
bin/init.bash Outdated
if [[ -f "${config_template_path}/providers/${CK8S_CLOUD_PROVIDER}/${config_name}" ]]; then
if [[ -f "${config_template_path}/providers/${CK8S_CLOUD_PROVIDER}/${CK8S_K8S_INSTALLER}/${config_name}" ]]; then
files+=("${config_template_path}/providers/${CK8S_CLOUD_PROVIDER}/${CK8S_K8S_INSTALLER}/${config_name}")
elif [[ -f "${config_template_path}/providers/${CK8S_CLOUD_PROVIDER}/${config_name}" ]]; then
Copy link
Contributor

@Zash Zash Dec 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What if the installer-specific one was last and contained only installer-specific overrides? I'm thinking there's a lot of duplication

Copy link
Contributor Author

@simonklb simonklb Dec 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed!
Verify: e4753c3
Your requested change: 7edf200

@simonklb simonklb requested a review from a team as a code owner December 9, 2025 12:13
@simonklb simonklb requested review from Zash and aarnq December 9, 2025 12:14
aarnq
aarnq reviewed Dec 10, 2025
View reviewed changes
Zash
Zash approved these changes Dec 10, 2025
View reviewed changes
Copy link
Contributor

@Zash Zash left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice code to test ratio 😃

@simonklb simonklb requested a review from aarnq December 11, 2025 12:14
@simonklb
Copy link
Contributor Author

simonklb commented Dec 11, 2025

Odd... The new commit I pushed should not have caused the tests to fail like this

@simonklb
Copy link
Contributor Author

simonklb commented Dec 11, 2025

Odd... The new commit I pushed should not have caused the tests to fail like this

GitHub had issues so the downloaded yq binary was just the HTML of an error page. 😄 We should start verifying the checksums... 😄

Xartos
Xartos approved these changes Dec 12, 2025
View reviewed changes
tests/Dockerfile

ARG YQ_VERSION="4.45.1"
RUN curl -LOs "https://github.com/mikefarah/yq/releases/download/v${YQ_VERSION}/yq_linux_amd64" && \
echo "654d2943ca1d3be2024089eb4f270f4070f491a0610481d128509b2834870049 yq_linux_amd64" | sha256sum -c - && \
Copy link
Contributor

@Xartos Xartos Dec 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Neat way of validating hash inline

@simonklb simonklb force-pushed the simonklb/safespring-capi-support branch from b3a0e4a to a90fa7a Compare December 15, 2025 08:28
@simonklb simonklb merged commit 1d9ffa8 into main Dec 15, 2025
12 checks passed
@simonklb simonklb deleted the simonklb/safespring-capi-support branch December 15, 2025 08:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Zash Zash Zash approved these changes

@Xartos Xartos Xartos approved these changes

@vomba vomba vomba approved these changes

@aarnq aarnq aarnq approved these changes

@viktor-f viktor-f Awaiting requested review from viktor-f

@Pavan-Gunda Pavan-Gunda Awaiting requested review from Pavan-Gunda

@lunkan93 lunkan93 Awaiting requested review from lunkan93

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@simonklb @vomba @Xartos @aarnq @Zash