AGheller opened a new issue, #1019:
URL: https://github.com/apache/apisix-helm-chart/issues/1019
### Current behavior
Since chart 2.18.0 (#950, fix for #755), `templates/service-gateway.yaml`
renders `externalTrafficPolicy` only when `service.type` is `LoadBalancer` or
`NodePort`:
```yaml
{{- if or (eq .Values.service.type "LoadBalancer") (eq .Values.service.type
"NodePort") }}
externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy }}
{{- end }}
```
This fixes #755 (Kubernetes rejects `externalTrafficPolicy` on a plain
ClusterIP Service), but Kubernetes also accepts the field on a `ClusterIP`
Service that has `externalIPs`, and kube-proxy honors it for traffic received
on those IPs.
Our setup: single-node clusters, APISIX exposed through `type: ClusterIP` +
`externalIPs: [<node IP>]` + `externalTrafficPolicy: Local`, so that APISIX
(and the upstreams through `X-Forwarded-For`) see the real client IP.
After upgrading to 2.18.0 the field is no longer rendered: Helm removes it
from the live Service, Kubernetes defaults it to `Cluster` and kube-proxy SNATs
the traffic. APISIX access logs and every upstream (in our case Keycloak login
events) now see the node IP instead of the client IP. There is no error or
warning: the value is still in the values file but is silently ignored.
### Expected behavior
`externalTrafficPolicy` is rendered when `service.externalIPs` is set, as it
was up to 2.17.x.
### Steps to reproduce
1. Install chart 2.16.0 with `service.type=ClusterIP`,
`service.externalIPs={<ip>}`, `service.externalTrafficPolicy=Local`: the
Service has `externalTrafficPolicy: Local`.
2. Upgrade to 2.18.0 with the same values: the Service has
`externalTrafficPolicy: Cluster`.
### Proposed fix
Also render the field when `externalIPs` is set:
```yaml
{{- if or (eq .Values.service.type "LoadBalancer") (eq .Values.service.type
"NodePort") .Values.service.externalIPs }}
```
This keeps the #755 fix (plain ClusterIP without `externalIPs` still omits
the field). I'll open a PR.
Workaround until then: `kubectl patch svc apisix-gateway -n ingress-apisix
-p '{"spec":{"externalTrafficPolicy":"Local"}}'` after each upgrade.
### Environment
- Chart 2.18.0, APISIX 3.19.0
- Kubernetes 1.35
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
