Kubeadm: allow users to use 127.0.0.1 as advertise address

[fabriziopandini]

What type of PR is this?
/kind feature

What this PR does / why we need it:
There are network setups where default routes are present, but network interfaces use only link-local addresses (e.g. as described in RFC5549); It is likely that matching global unicast IP address for this family of default route can be found on loopback interface.

This PR add support for kubeadm for the above scenario

Which issue(s) this PR fixes:

Special notes for your reviewer:
This is a rework of #69578, but with this PR we are not altering any existing defaulting rule.

Instead, the user has to explicitly opt-in in this scenario by specifying 127.0.0.1 and kubeadm will try to resolve this to a global unicast IP.

Does this PR introduce a user-facing change?:

Kubeadm: add support for 127.0.0.1 as advertise address. kubeadm will automatically replace this value with matching global unicast IP address on the loopback interface. 

/area kubeadm
/sig cluster-lifecycle
/priority critical-urgent
/cc @kad

[timothysc]

seems like 'lo' would be a constant in the util library, otherwise lgtm
/approve
/assign @liggitt

[fabriziopandini]

Done!

[timothysc]

This PR requires making a utility function public, and I don't see why not.

[neolit123]

i haven't tested loopback setups at all.
if @fabriziopandini have confirmed that this works and if the pk/util/net maintainers are fine, i guess this is good.

/assign @bowei

[liggitt]

/approve
/retest

This looks much safer than #69578 to me, thanks for the rework.

/hold
I agree that I'd like someone from the networking team to lgtm this. Feel free to unhold once that's done.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: fabriziopandini, liggitt, timothysc

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• cmd/kubeadm/OWNERS [fabriziopandini,liggitt,timothysc]
• staging/src/k8s.io/apimachinery/pkg/OWNERS [liggitt]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[timothysc]

/assign @johnbelamaric
^ Can you take a quick look.

[johnbelamaric]

RFC5549 is about MP-BGP "Advertising IPv4 Network Layer Reachability Information with an IPv6 Next Hop". Is that really the RFC you meant? I am confused a little as to the use case. Can you provide more description?

[timothysc]

@johnbelamaric ... It is.. It's a leaf and spine deployment where IPv4 addresses are proxied through localhost. This is not uncommon for some on-prem environments and the patch has been tested. The ask for review is really about exposing the function Publicly.

[johnbelamaric]

@timothysc ok, yes, I don't see any issue there. lgtm

[timothysc]

Thanks @johnbelamaric !
/hold cancel

[timothysc]

/lgtm

[aojea]

just double checking, sorry if this is so obvious was already discussed.
The setup for using loopback addresses for routing is as this

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet 1.1.1.1/32 scope global lo
       valid_lft forever preferred_lft forever

you configure a global address in a loopback interface and is the one that you distribute via routing.
This guarantee availability if you have multiple interfaces, the routing protocol will pick the right interface to forward the traffic to the global address in the loopback interface.

I don't have clear if this PR enable the use of 127.0.0.1 in this case or the use of 1.1.1.1 in my example.

The correct behavior should be checking the loopback interface and see if there is a global address there.
If you announce an address like 127.0.0.1 it will cause that all router that receive that route and install in their dataplane will start to black hole all the traffic forwarding it to their own loopback interfaces

[timothysc]

It should check the loopback interface and see if there is a global address there.

That's exactly what this PR does and it then uses that address as the advertise address of the API-server.

[aojea]

It should check the loopback interface and see if there is a global address there.

That's exactly what this PR does and it then uses that address as the advertise address of the API-server.

thanks for clarifying, the title confused me ... had bad experiences with similar configs in the past 😓

[kad]

One thing that bothers me in this PR (and I mentioned that to @fabriziopandini in Slack) is the missing verification of ipv4/v6 between addressIP.IsLoopback() and netutil.ChooseBindAddressForInterface().
addressIP can be ::1 and ChooseBindAddressForInterface might return some valid IPv4 address assigned to lo interface and vice versa.

/cc @scheuk if he can verify that this solves his original problem.

[fabriziopandini]

@kad sorry this PR merged before having the chance to address your comment. I will contact you to better understand your concern and understand how it can be addressed.