-
Notifications
You must be signed in to change notification settings - Fork 2
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Use service of type LoadBalancer instead of Ingress #264
Conversation
This decision was made due to the gardener's default denial of all traffic in the garden namespace, requiring network policies for Ingress controller use. This aligns with the gardener operator's default behavior, as per official documentation: > The virtual-garden-kube-apiserver Deployment is exposed via a Service of type LoadBalancer with the same name. In the future, we will switch to exposing it via Istio, similar to how the kube-apiservers of shoot clusters are exposed. > For the virtual cluster, it is essential to provide a DNS domain via .spec.virtualCluster.dns.domain. The respective DNS record is not managed by gardener-operator and should be manually created and pointed to the load balancer IP of the virtual-garden-kube-apiserver Service. The DNS domain is used for the server in the kubeconfig, and for configuring the --external-hostname flag of the API server.
42849c6
to
39ad105
Compare
69ce488
to
a5dc635
Compare
Needs rebase. |
{{- if .Values.kubeAPIServer.loadBalancerIP }} | ||
loadBalancerIP: {{ .Values.kubeAPIServer.loadBalancerIP }} | ||
{{- end }} | ||
type: LoadBalancer |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can we move the type: LoadBalancer
into the if-condition? I would like to maintain the original behavior and do not automatically acquire an IP address if someone forgets to set this.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We don't set the IP in our setup.
We will default to service type load balancer in the next release.
This decision was made due to the gardener's default denial of all traffic in the garden namespace, requiring network policies for Ingress controller use.
This aligns with the gardener operator's default behavior, as per official documentation: