Do not create HTTP monitors for UDP on old Octavia (kubernetes#2000)

Octavia API before 2.16 doesn't support HTTP monitors on UDP pools. It
will however allow creation of such if all-in-one LB creation call is
used. This is a problem for UDP `ETP=Local` Services, where
`healthCheckNodePort` is allocated and CCM will try to create HTTP
monitor there. This monitor will be completely not functional.

OVN Octavia provider doesn't support HTTP health monitors either.

This commit fixes that by making sure we're checking Octavia API version
and if it's lower than 2.16 we fall back to creating UDP-CONNECT health
monitors on a regular port instead. Moreover same is done when provider
is set to "ovn".

Author: dulek

pkg/openstack/loadbalancer.go

@@ -1232,10 +1232,21 @@ func (lbaas *LbaasV2) buildMonitorCreateOpts(svcConf *serviceConfig, port corev1
 		opts.Type = "UDP-CONNECT"
 	}
 	if svcConf.healthCheckNodePort > 0 {
-		opts.Type = "HTTP"
-		opts.URLPath = "/healthz"
-		opts.HTTPMethod = "GET"
-		opts.ExpectedCodes = "200"
+		setHTTPHealthMonitor := true
+		if lbaas.opts.LBProvider == "ovn" {
+			// ovn-octavia-provider doesn't support HTTP monitors at all. We got to avoid creating it with ovn.
+			setHTTPHealthMonitor = false
+		} else if opts.Type == "UDP-CONNECT" {
+			// Older Octavia versions or OVN provider doesn't support HTTP monitors on UDP pools. We got to check if that's the case.
+			setHTTPHealthMonitor = openstackutil.IsOctaviaFeatureSupported(lbaas.lb, openstackutil.OctaviaFeatureHTTPMonitorsOnUDP, lbaas.opts.LBProvider)
+		}
+
+		if setHTTPHealthMonitor {
+			opts.Type = "HTTP"
+			opts.URLPath = "/healthz"
+			opts.HTTPMethod = "GET"
+			opts.ExpectedCodes = "200"
+		}
 	}
 	return opts
 }
@@ -1361,7 +1372,19 @@ func (lbaas *LbaasV2) buildBatchUpdateMemberOpts(port corev1.ServicePort, nodes
 			SubnetID:     &svcConf.lbMemberSubnetID,
 		}
 		if svcConf.healthCheckNodePort > 0 {
-			member.MonitorPort = &svcConf.healthCheckNodePort
+			useHealthCheckNodePort := true
+			if lbaas.opts.LBProvider == "ovn" {
+				// ovn-octavia-provider doesn't support HTTP monitors at all, if we have it we got to rely on NodePort
+				// and UDP-CONNECT health monitor.
+				useHealthCheckNodePort = false
+			} else if port.Protocol == "UDP" {
+				// Older Octavia versions doesn't support HTTP monitors on UDP pools. If we have one like that, we got
+				// to rely on checking the NodePort instead.
+				useHealthCheckNodePort = openstackutil.IsOctaviaFeatureSupported(lbaas.lb, openstackutil.OctaviaFeatureHTTPMonitorsOnUDP, lbaas.opts.LBProvider)
+			}
+			if useHealthCheckNodePort {
+				member.MonitorPort = &svcConf.healthCheckNodePort
+			}
 		}
 		members = append(members, member)
 		newMembers.Insert(fmt.Sprintf("%s-%s-%d-%d", node.Name, addr, member.ProtocolPort, svcConf.healthCheckNodePort))

pkg/util/openstack/loadbalancer.go

@@ -42,6 +42,7 @@ const (
 	OctaviaFeatureFlavors           = 2
 	OctaviaFeatureTimeout           = 3
 	OctaviaFeatureAvailabilityZones = 4
+	OctaviaFeatureHTTPMonitorsOnUDP = 5
 
 	waitLoadbalancerInitDelay   = 1 * time.Second
 	waitLoadbalancerFactor      = 1.2
@@ -143,6 +144,14 @@ func IsOctaviaFeatureSupported(client *gophercloud.ServiceClient, feature int, l
 		if currentVer.GreaterThanOrEqual(verAvailabilityZones) {
 			return true
 		}
+	case OctaviaFeatureHTTPMonitorsOnUDP:
+		if lbProvider == "ovn" {
+			return false
+		}
+		verHTTPMonitorsOnUDP, _ := version.NewVersion("v2.16")
+		if currentVer.GreaterThanOrEqual(verHTTPMonitorsOnUDP) {
+			return true
+		}
 	default:
 		klog.Warningf("Feature %d not recognized", feature)
 	}