Preserve loadBalancerClass on Service updates #3641

diversario · 2024-04-10T09:32:30Z

Issue

Description

See the linked issue for the observed problem.

This PR enables service mutator to run on updates to service objects (the UPDATE operation needs to be added to the webhook configuration for this to work).

Update mutator will only act on service objects that have spec.loadBalancerClass set to a non-empty value. When this is true, the incoming (updated) Service object will be updated to have the same spec.loadBalancerClass as the existing Service object.

Considering that spec.loadBalancerClass, once set, cannot be unset or modified, this change prevents unexpected validation errors in cases of UPDATE operation with Service object that omits the spec.loadBalancerClass field. This is the case for helm rollback --force, described in the linked issue, as well as for kubectl replace command.

Documentation may need to be updated depending on the outcome of aws/eks-charts#1063 - that PR changes some chart values that are being referenced in the docs.

Testing

This change was tested using the helm chart built from #3653.

For testing, I had MWC with no UPDATE operation first (as it is currently configured), then I enabled it in the chart.

Tested by creating a Service via kubectl apply, updating it via kubectl apply, and then replacing it via kubectl replace. kubectl replace previously would fail with validation error due to attempt to modify spec.loadBalancerClass. No longer fails.

I submitted Service manifests with and without the spec.loadBalancerClass field.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Checklist

Added tests that cover your change (if possible)
Added/modified documentation as required (such as the README.md, or the docs directory)
Manually tested
Made sure the title of the PR is a good description that can go into the release notes

BONUS POINTS checklist: complete for good vibes and maybe prizes?! 🤯

Backfilled missing tests for code in same general area 🎉
Refactored something and made the world a better place 🌟

k8s-ci-robot · 2024-04-10T09:32:39Z

Welcome @diversario!

It looks like this is your first PR to kubernetes-sigs/aws-load-balancer-controller 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/aws-load-balancer-controller has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2024-04-10T09:32:39Z

Hi @diversario. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

When Service object is updated, ensure that load balancer class is preserved. Co-authored-by: Jack Andersen <[email protected]>

oliviassss · 2024-04-11T21:44:50Z

webhooks/core/service_mutator.go

+		// if yes, then leave it be because someone wanted it that way, let the user deal with the error
+		if newSvc.Spec.LoadBalancerClass == nil || *newSvc.Spec.LoadBalancerClass == "" {
+			newSvc.Spec.LoadBalancerClass = oldSvc.Spec.LoadBalancerClass
+


I was just thinking some corner cases - would this change cause some issue when this field in the newSvc is intended to be nil or ""?

Since this handler is for updates to an existing service only, there's a couple of reasons the field would be missing/empty:

User is updating the service object via patch, submitting only modified fields. In this case, tacking the LBC field onto the update is a noop, and there's no change in behavior.

User is updating the service object via put (this is the kubectl replace) and omits the field. The normal response would be an error, as the field is immutable.
With this handler, the error does not occur as we putting the field back. This is a change in behavior.
Whether this change is unexpected - I think it is not, because presumably user has enabled the webhook, is aware of the webhook effects, and expects LB Services in their cluster to be managed by AWS LBC. So this change, then, just prevents the user from running into an error (and this is the entire reason behind this PR because our deployment tooling - Helm - runs into this very error).
Importantly, because the handler inspects the existing Service, it will only touch service that are known to be managed by AWS LBC, and not something else.

oliviassss · 2024-04-15T17:40:24Z

/ok-to-test

oliviassss · 2024-04-17T21:59:03Z

@diversario, thanks for the contribution. I'm good with the changes, can you please add the manual tests you've done in the PR descriptions?
/lgtm

shraddhabang · 2024-04-17T22:40:59Z

/lgtm

diversario · 2024-04-18T12:19:30Z

@diversario, thanks for the contribution. I'm good with the changes, can you please add the manual tests you've done in the PR descriptions? /lgtm

Updated description.

oliviassss · 2024-04-18T16:55:51Z

/lgtm
/approve

k8s-ci-robot · 2024-04-18T16:55:56Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: diversario, oliviassss

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [oliviassss]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Apr 10, 2024

k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Apr 10, 2024

k8s-ci-robot requested review from johngmyers and M00nF1sh April 10, 2024 09:33

diversario mentioned this pull request Apr 10, 2024

Provide more customization options for the service mutator webhook aws/eks-charts#1087

Closed

4 tasks

diversario marked this pull request as ready for review April 10, 2024 10:37

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Apr 10, 2024

k8s-ci-robot requested a review from oliviassss April 10, 2024 10:37

[INF-12851] Make sure service updates preserve lb class

a1f49f9

When Service object is updated, ensure that load balancer class is preserved. Co-authored-by: Jack Andersen <[email protected]>

diversario force-pushed the svc-mutator-support-update-operation branch from df5666e to a1f49f9 Compare April 10, 2024 10:39

oliviassss reviewed Apr 11, 2024

View reviewed changes

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Apr 15, 2024

k8s-ci-robot assigned oliviassss Apr 17, 2024

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 17, 2024

oliviassss added the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Apr 17, 2024

k8s-ci-robot assigned shraddhabang Apr 17, 2024

diversario mentioned this pull request Apr 18, 2024

Provide more customization options for the service mutator webhook #3653

Merged

4 tasks

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 18, 2024

k8s-ci-robot merged commit 97e9bd1 into kubernetes-sigs:main Apr 18, 2024
5 checks passed

diversario deleted the svc-mutator-support-update-operation branch April 19, 2024 10:00

wweiwei-li mentioned this pull request May 17, 2024

aws-load-balancer-controller: v2.8.0 aws/eks-charts#1105

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Preserve loadBalancerClass on Service updates #3641

Preserve loadBalancerClass on Service updates #3641

diversario commented Apr 10, 2024 •

edited

Loading

k8s-ci-robot commented Apr 10, 2024

k8s-ci-robot commented Apr 10, 2024

oliviassss Apr 11, 2024 •

edited

Loading

diversario Apr 12, 2024

oliviassss commented Apr 15, 2024

oliviassss commented Apr 17, 2024

shraddhabang commented Apr 17, 2024

diversario commented Apr 18, 2024

oliviassss commented Apr 18, 2024

k8s-ci-robot commented Apr 18, 2024

Preserve loadBalancerClass on Service updates #3641

Preserve loadBalancerClass on Service updates #3641

Conversation

diversario commented Apr 10, 2024 • edited Loading

Issue

Description

Testing

Checklist

BONUS POINTS checklist: complete for good vibes and maybe prizes?! 🤯

k8s-ci-robot commented Apr 10, 2024

k8s-ci-robot commented Apr 10, 2024

oliviassss Apr 11, 2024 • edited Loading

Choose a reason for hiding this comment

diversario Apr 12, 2024

Choose a reason for hiding this comment

oliviassss commented Apr 15, 2024

oliviassss commented Apr 17, 2024

shraddhabang commented Apr 17, 2024

diversario commented Apr 18, 2024

oliviassss commented Apr 18, 2024

k8s-ci-robot commented Apr 18, 2024

diversario commented Apr 10, 2024 •

edited

Loading

oliviassss Apr 11, 2024 •

edited

Loading