Service for LoadBalancer seems to not use externalIps properly - using deprecated / removed loadBalancerIP setting

[EugenMayer]

could be related to the CNI used (in my case it is callico)

deploying via

service:
  type: LoadBalancer
  loadBalancerIP: ${externalIp}
  ipFamilyPolicy: SingleStack

will never actually bind the load-balancer, it will stay pending. AFAICS you are not using externalIPs at all, which makes the difference here.

When i deploy the same service using terraform

resource "kubernetes_service" "externalLdapAccess" {
  metadata {
    name      = "kw-auth-openldap"
    namespace = module.hardened_namespace.namespace.id
  }

  spec {
    type = "LoadBalancer"
    selector = {
      "app.kubernetes.io/component": "openldap"
      "release" : "openldap"
    }
    port {
      port        = var.ldap_port
      name        = "ldap"
      protocol    = "TCP"
      target_port = 1389
    }
    port {
      port        = var.ldaps_port
      name        = "ldap-ssl"
      protocol    = "TCP"
      target_port = 1636
    }
    external_ips = [var.external_ip]
  }

  wait_for_load_balancer = false
}

the service binds instantly.

You are using loadBalancerIP, which has been deprecated and does no longer work with my k8s version (1.30) we should start using https://kubernetes.io/docs/concepts/services-networking/service/#external-ips which is the replacement

loadBalancerIP is no longer part of the spec https://kubernetes.io/docs/reference/kubernetes-api/service-resources/service-v1/#ServiceSpec

[jp-gouin]

What provider are you using for your LoadBalancer ?

It's not provided by default in kubernetes and you need a component that will allocate a load balancer and provide/attach an IP to your service .

[EugenMayer]

i'am not sure in which direction you are arguing? this flag has been deprecated AFAICS 1.21 and has a replacement, externalIPs - it has nothing to do with my CNI(callico) or Ingress (nginx)

[jp-gouin]

Yes the field needs to be updated to reflect the newest spec of kubernetes. But this field is also optional so I wanted to understand why your service type LB stay pending

[EugenMayer]

That i'am not fully able to explain. Since it is not ClusterIP, and we expose a port, i assume it is not possible to understand what ip to bind too. I think this is part of the spec, if found that.

Probably this is related to use driving a multi-eth setup on our k8s, means the decision cannot be made for sure, which one to use, thus it does not make any?

[EugenMayer]

any chance to move this forward? Thanks for your effort

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[EugenMayer]

@jp-gouin any reason to let this become "wontfix" - i mean it is a standing issue with current k8s - there is no way around fixing that AFAICS?