docs: TargetGroupBinding with unspecified ports does not behave as described

[bardiharborow]

In Guide > TargetGroupBinding > Specification > NetworkingIngressRule, it says:

If ports is empty or unspecified, it defaults to all ports with TCP.

This does not appear to be true. If unspecified, the admission webhook fails to accept the TargetGroupBinding. If empty, no security group rule is not created to allow the ELB to connect to the EC2 instance, rather than the expected rule allowing all TCP ports.

As a side note: It is awkward to be required to provide the assigned node port for the security group, since the controller is already capable of determining this and updating the target group.

[shraddhabang]

@bardiharborow Could you provide more context on this failure. This is not a required field in TGB so this should not fail. Can you give us the manifest for tgb you are applying and webhook failure message.

If unspecified, the admission webhook fails to accept the TargetGroupBinding.

If empty, no security group rule is not created to allow the ELB to connect to the EC2 instance, rather than the expected rule allowing all TCP ports.

This is expected behaviour. We generally assume that security group rules necessary for ELB-to-instance connectivity will be managed outside the LBC when using TGB.

[shraddhabang]

Ohh I see what you are saying. If you specify the ingress rule, the port is required otherwise the webhook fails. we will update our doc to reflect this.