Busyloop when installed alongside MetalLB

[imax9000]

Describe the bug

When using LoadBalancer service type, NGF and MetalLB are constantly updating the same Service objects: MetalLB adds metallb.io/ip-allocated-from-pool annotation and NGF immediately deletes it, MetalLB adds it back and so on.

To Reproduce
Steps to reproduce the behavior:

1. Install and configure NGF and MetalLB.
2. Create a Gateway resource.
3. Run kubectl proxy and curl -s "http://127.0.0.1:8001/api/v1/namespaces/${NAMESPACE:-default}/services?watch=1" | jq -c .object.metadata.annotations

{"metallb.io/ip-allocated-from-pool":"extra"}
null
{"metallb.io/ip-allocated-from-pool":"extra"}
null
{"metallb.io/ip-allocated-from-pool":"extra"}
null
{"metallb.io/ip-allocated-from-pool":"extra"}
null
{"metallb.io/ip-allocated-from-pool":"extra"}
null
{"metallb.io/ip-allocated-from-pool":"extra"}
null
{"metallb.io/ip-allocated-from-pool":"extra"}
null

Expected behavior

Peaceful coexistence and proper functioning of both NGF and MetalLB.

Your environment

• nginx-gateway-fabric: 2.1.4
• MetalLB: v0.14.9
• Kubernetes: v1.33.0, on-prem via kubeadm

[nginx-bot]

Hi @imax9000! Welcome to the project! 🎉

Thanks for opening this issue!
Be sure to check out our Contributing Guidelines and the Issue Lifecycle while you wait for someone on the team to take a look at this.

[salonichf5]

Hey @imax9000 — I tested this on my setup and can confirm the bug does exist. I found a workaround that stops the annotation fight.

You can use the patches option
in the NGF Helm chart to add the MetalLB annotation directly to the NGINX Service.
For example:

# values.yaml
patches:
  - type: JSONPatch
    value:
      - op: add
        path: /metadata/annotations/metallb.io~1ip-allocated-from-pool
        value: "default-address-pool"

Then run a helm upgrade for your NGF installation with the updated values file.

After upgrading, the annotation stays on the Service as expected:

kubectl describe svc gateway-nginx

Annotations:              metallb.io/ip-allocated-from-pool: default-address-pool
Type:                     LoadBalancer
LoadBalancer Ingress:     172.18.255.1 (VIP)

This keeps MetalLB’s ip-allocated-from-pool annotation from getting wiped by NGF.

[imax9000]

Thanks, I also thought about that, but decided against it: MetalLB relies on these annotations to keep track of resource state, and I'd prefer to not have a possibility of NGF confusing MetalLB into an invalid configuration.