Doc: Add note for rename behavior of IngressGroup #3283

yubingjiaocn · 2023-07-17T07:44:18Z

Issue

Description

Add a warning to describe rename behavior of IngressGroup.

When rename a IngressGroup with only an Ingress, ALB will be recreated. Deletion protection will be ignored during recreate. However, this behavior is not documented and caused confuse and interruption of customer usage.

By adding description about ALB to IngressGroup relationship and rename behavior, customer will have a clearer view on how IngressGroup run under the hood.

Checklist

Added tests that cover your change (if possible)
Added/modified documentation as required (such as the README.md, or the docs directory)
Manually tested
Made sure the title of the PR is a good description that can go into the release notes

BONUS POINTS checklist: complete for good vibes and maybe prizes?! 🤯

Backfilled missing tests for code in same general area 🎉
Refactored something and made the world a better place 🌟

linux-foundation-easycla · 2023-07-17T07:44:22Z

The committers listed above are authorized under a signed CLA.

✅ login: yubingjiaocn / name: Yu Bingjiao (66d49f1, c3eaa90, 85ea2b1)

k8s-ci-robot · 2023-07-17T07:44:26Z

Welcome @yubingjiaocn!

It looks like this is your first PR to kubernetes-sigs/aws-load-balancer-controller 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/aws-load-balancer-controller has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2023-07-17T07:44:27Z

Hi @yubingjiaocn. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

M00nF1sh · 2023-07-18T17:18:39Z

docs/guide/ingress/annotations.md

+
+    !!!warning "Rename behavior"
+        ALB is uniquely identified by it's tag `ingress.k8s.aws/stack`, whose value is the name of IngressGroup.
+


i think we can remove this "There is no way to rename an existing IngressGroup while keeping ALB", since

the following text already clarified the recreation behavior.

technically there is a way, e.g. by manually change the AWS Tags on the existing provisioned ALB. But i don't want to call this hacky solution out in this document.

When the groupName of IngressGroup for Ingress is changed, the Ingress will be moved to new IngressGroup and supported by ALB for the new IngressGroup. If ALB for the new IngressGroup doesn't exist, a new ALB will be created. If the old IngressGroup no longer contain any Ingresses, ALB for old IngressGroup will be deleted, and deletion protection of ALB will be ignored.

we can remove the "If an IngressGroup has only one Ingress (or IngressGroup is not explicit specified), changing name of IngressGroup will cause recreation of Load Balancer. If an IngressGroup has no Ingress, the corrsponding ALB will be removed. In both cases, deletion protection of ALB will be ignored." given the Refactor josh #2 clarified it.

johngmyers · 2023-07-19T00:36:13Z

docs/guide/ingress/annotations.md

@@ -79,6 +79,13 @@ By default, Ingresses don't belong to any IngressGroup, and we treat it as a "im
        other Kubernetes users may create/modify their Ingresses to belong to the same IngressGroup, and can thus add more rules or overwrite existing rules with higher priority to the ALB for your Ingress.

        We'll add more fine-grained access-control in future versions.
+
+    !!!warning "Rename behavior"
+        ALB is uniquely identified by it's tag `ingress.k8s.aws/stack`, whose value is the name of IngressGroup.


Suggested change

ALB is uniquely identified by it's tag `ingress.k8s.aws/stack`, whose value is the name of IngressGroup.

The ALB for an IngressGroup is found by searching for an AWS tag `ingress.k8s.aws/stack` tag with the name of the IngressGroup as its value.

johngmyers · 2023-07-19T00:37:44Z

docs/guide/ingress/annotations.md

+
+        There is no way to rename an existing IngressGroup while keeping ALB. When the `groupName` of IngressGroup of Ingress is changed, the Ingress will be moved to corresponding IngressGroup and ALB. If target IngressGroup doesn't exist, a new ALB will be created.
+
+        If an IngressGroup has only one Ingress (or IngressGroup is not explicit specified), changing name of IngressGroup will cause recreation of Load Balancer. If an IngressGroup has no Ingress, the corrsponding ALB will be removed. In both cases, deletion protection of ALB will be ignored.


Suggested change

If an IngressGroup has only one Ingress (or IngressGroup is not explicit specified), changing name of IngressGroup will cause recreation of Load Balancer. If an IngressGroup has no Ingress, the corrsponding ALB will be removed. In both cases, deletion protection of ALB will be ignored.

If an IngressGroup has only one Ingress (or IngressGroup is not explicitly specified), changing the IngressGroup will cause recreation of its Load Balancer. If an IngressGroup has no Ingress, the corresponding ALB will be deleted. In both cases, the deletion protection of the ALB will be ignored.

Actually, the logic of this is not right. Changing the name of an IngressGroup will cause the ALB to be recreated regardless of the number of Ingresses using it. Separately, if an IngressGroup goes to zero Ingresses using it, the ALB will be deleted.

yubingjiaocn · 2023-07-19T02:32:00Z

@johngmyers @M00nF1sh Thank you for your suggestion, and I have change some wording to clarify the logic. Please take a look if you got time. Thx.

docs/guide/ingress/annotations.md

Co-authored-by: John Gardiner Myers <jgmyers@proofpoint.com>

johngmyers · 2023-07-30T13:11:02Z

/ok-to-test
/lgtm
/assign @M00nF1sh

M00nF1sh · 2023-08-07T16:41:05Z

/lgtm
/approve

k8s-ci-robot · 2023-08-07T16:41:10Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: M00nF1sh, yubingjiaocn

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [M00nF1sh]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

yubingjiaocn · 2023-08-08T00:51:52Z

Hi, thank you for merging this PR. Since this PR documents current behavior, is it possible to cherry-pick it to releases-2.4 branch so it can be seen by more customer? Thx.

…to 2.6.0 Merge in DEL/aws-load-balancer-controller-fork from merge-up to main * commit '195e896b0efbd467694bb9a19de7c5a12c5dde8c': (71 commits) check the canary test result and exit if it failed Apply suggestions from code review Update docs/guide/service/annotations.md Addressing the comment Remove dependency on aws-sdk-go-v2 (kubernetes-sigs#3320) Update live docs for NLB-SG feature release cut v2.6.0 release refactor targetGroupBinding network builder Add support for NLB security groups Allow TLS 1.2 with restricted ciphers for webhooks Update the RSA filter for Cert discovery Doc: Add note for rename behavior of IngressGroup (kubernetes-sigs#3283) Make Ingress validating webhook ignore ingresses not managed by AWS LBC (kubernetes-sigs#3272) add oliviassss as reviewer fix the race condition in pod cache and endpoint resolver Bump github.com/onsi/ginkgo/v2 from 2.6.0 to 2.11.0 Bump github.com/aws/aws-sdk-go from 1.44.184 to 1.44.294 (kubernetes-sigs#3271) Provide better explanation of failure to find a subnet (kubernetes-sigs#3292) test/framework: replace deprecated ioutil.ReadAll (kubernetes-sigs#3256) Add warning in doc for ServiceMutatorWebhook (kubernetes-sigs#3180) ...

* Add warning for rename behavior of IngressGroup * Change wording per suggestion from code review * Apply grammar suggestions from code review Co-authored-by: John Gardiner Myers <jgmyers@proofpoint.com> --------- Co-authored-by: John Gardiner Myers <jgmyers@proofpoint.com>

Add warning for rename behavior of IngressGroup

66d49f1

k8s-ci-robot added the cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. label Jul 17, 2023

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jul 17, 2023

k8s-ci-robot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Jul 17, 2023

k8s-ci-robot requested review from kishorj and M00nF1sh July 17, 2023 07:44

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Jul 17, 2023

M00nF1sh reviewed Jul 18, 2023

View reviewed changes

johngmyers suggested changes Jul 19, 2023

View reviewed changes

Change wording per suggestion from code review

c3eaa90

johngmyers suggested changes Jul 29, 2023

View reviewed changes

docs/guide/ingress/annotations.md Outdated Show resolved Hide resolved

docs/guide/ingress/annotations.md Outdated Show resolved Hide resolved

docs/guide/ingress/annotations.md Outdated Show resolved Hide resolved

Apply grammar suggestions from code review

85ea2b1

Co-authored-by: John Gardiner Myers <jgmyers@proofpoint.com>

k8s-ci-robot assigned M00nF1sh Jul 30, 2023

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jul 30, 2023

k8s-ci-robot assigned johngmyers Jul 30, 2023

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 30, 2023

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 7, 2023

M00nF1sh merged commit 78d101d into kubernetes-sigs:main Aug 7, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Doc: Add note for rename behavior of IngressGroup #3283

Doc: Add note for rename behavior of IngressGroup #3283

yubingjiaocn commented Jul 17, 2023

linux-foundation-easycla bot commented Jul 17, 2023 •

edited

Loading

k8s-ci-robot commented Jul 17, 2023

k8s-ci-robot commented Jul 17, 2023

M00nF1sh Jul 18, 2023

johngmyers Jul 19, 2023

johngmyers Jul 19, 2023 •

edited

Loading

johngmyers Jul 19, 2023

yubingjiaocn commented Jul 19, 2023

johngmyers commented Jul 30, 2023

M00nF1sh commented Aug 7, 2023

k8s-ci-robot commented Aug 7, 2023

yubingjiaocn commented Aug 8, 2023 •

edited

Loading


		!!!warning "Rename behavior"
		ALB is uniquely identified by it's tag `ingress.k8s.aws/stack`, whose value is the name of IngressGroup.

	ALB is uniquely identified by it's tag `ingress.k8s.aws/stack`, whose value is the name of IngressGroup.
	The ALB for an IngressGroup is found by searching for an AWS tag `ingress.k8s.aws/stack` tag with the name of the IngressGroup as its value.


		There is no way to rename an existing IngressGroup while keeping ALB. When the `groupName` of IngressGroup of Ingress is changed, the Ingress will be moved to corresponding IngressGroup and ALB. If target IngressGroup doesn't exist, a new ALB will be created.

		If an IngressGroup has only one Ingress (or IngressGroup is not explicit specified), changing name of IngressGroup will cause recreation of Load Balancer. If an IngressGroup has no Ingress, the corrsponding ALB will be removed. In both cases, deletion protection of ALB will be ignored.

Doc: Add note for rename behavior of IngressGroup #3283

Doc: Add note for rename behavior of IngressGroup #3283

Conversation

yubingjiaocn commented Jul 17, 2023

Issue

Description

Checklist

BONUS POINTS checklist: complete for good vibes and maybe prizes?! 🤯

linux-foundation-easycla bot commented Jul 17, 2023 • edited Loading

k8s-ci-robot commented Jul 17, 2023

k8s-ci-robot commented Jul 17, 2023

M00nF1sh Jul 18, 2023

Choose a reason for hiding this comment

johngmyers Jul 19, 2023

Choose a reason for hiding this comment

johngmyers Jul 19, 2023 • edited Loading

Choose a reason for hiding this comment

johngmyers Jul 19, 2023

Choose a reason for hiding this comment

yubingjiaocn commented Jul 19, 2023

johngmyers commented Jul 30, 2023

M00nF1sh commented Aug 7, 2023

k8s-ci-robot commented Aug 7, 2023

yubingjiaocn commented Aug 8, 2023 • edited Loading

linux-foundation-easycla bot commented Jul 17, 2023 •

edited

Loading

johngmyers Jul 19, 2023 •

edited

Loading

yubingjiaocn commented Aug 8, 2023 •

edited

Loading