Add support for VPC Endpoint Services #2636

hintofbasil · 2022-05-02T19:41:09Z

Issue

Description

This change adds support for creating, deleting and updating VPC endpoint
services along with their permissions. It supports the three suggested
configuration options - allowed priciples, acceptance required, and private DNS
name.

An enable annotation was also added so support enabling/disabling the feature
on a per load balancer basis. The proposed design only supported
enabling/disabling this at the controller level.

Outputting the created VPC Endpoint Service parameters is deliberatly not
supported as there are still open questions as to the best approach to be used
and this change is already far too big and adding more to it does not seem
sensible. This feature can be added in a follow-up change.

This change has been manually tested on a Kubernetes service.

I apologise for the large PR. I couldn't determine suitable breakpoints to split
this change up into smaller changes. I can do so if you can suggest the break
points. I'm also fairly new to Golang so am very happy for any feedback as I
know the code quality isn't amazing here.

Checklist

Added tests that cover your change (if possible)
Added/modified documentation as required (such as the README.md, or the docs directory)
Manually tested
Made sure the title of the PR is a good description that can go into the release notes

BONUS POINTS checklist: complete for good vibes and maybe prizes?! 🤯

Backfilled missing tests for code in same general area 🎉
Refactored something and made the world a better place 🌟

k8s-ci-robot · 2022-05-02T19:41:17Z

Hi @hintofbasil. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

maruina

Generally LGTM, just a couple of questions

maruina · 2022-05-03T07:37:53Z

pkg/algorithm/strings.go

@@ -12,3 +14,25 @@ func ChunkStrings(targets []string, chunkSize int) [][]string {
 	}
 	return chunks
 }
+
+func DiffStringSlice(first, second []string) ([]*string, []*string, []*string) {


Can we add a comment here to explain what this function does?

maruina · 2022-05-03T07:44:34Z

pkg/deploy/ec2/endpoint_service_manager.go

+}
+
+func (m *defaultEndpointServiceManager) ReconcileTags(ctx context.Context, resID string, desiredTags map[string]string, opts ...ReconcileTagsOption) error {
+	return nil


Is this missing the implementation, or am I missing something?

This was templated by rifelpet but I ended up using the tagging manager implementation instead of duplicating the logic. Removed it.

maruina · 2022-05-05T12:28:02Z

pkg/service/model_build_endpoint_service_test.go

+			if tt.wantErr {
+				assert.Error(t, err)
+			} else {
+				assert.Equal(t, tt.want, got)


Why not adding a wantErr to every test case and just assert.Equal(t, tt.want, got)?

The errors returned are generally wrapped errors. Wrapped errors include a stack trace so can't be compared an error generated in the test.
If there is a nice way to tests for equality with wrapped errors I'd be very happy to change it.

kishorj · 2022-05-05T21:11:41Z

@hintofbasil, thanks for your changes. We are currently finalizing the v2.4.2 patch release, I will review your changes after the patch release.

codecov-commenter · 2022-05-05T21:17:13Z

Codecov Report

Patch coverage: 63.57% and project coverage change: +0.48 🎉

Comparison is base (ff8c13d) 55.05% compared to head (afa4b7e) 55.53%.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2636      +/-   ##
==========================================
+ Coverage   55.05%   55.53%   +0.48%     
==========================================
  Files         148      157       +9     
  Lines        8532     9002     +470     
==========================================
+ Hits         4697     4999     +302     
- Misses       3505     3662     +157     
- Partials      330      341      +11

Impacted Files	Coverage Δ
pkg/config/addons_config.go	`0.00% <0.00%> (ø)`
pkg/deploy/elbv2/listener_manager.go	`1.08% <ø> (ø)`
pkg/deploy/stack_deployer.go	`0.00% <0.00%> (ø)`
pkg/deploy/tracking/provider_mocks.go	`0.00% <0.00%> (ø)`
pkg/networking/vpc_endpoint_service_info.go	`0.00% <0.00%> (ø)`
pkg/networking/vpc_endpoint_service_manager.go	`0.00% <0.00%> (ø)`
...g/networking/vpc_endpoint_service_manager_mocks.go	`0.00% <0.00%> (ø)`
pkg/service/model_build_endpoint_service.go	`54.00% <54.00%> (ø)`
pkg/service/model_builder.go	`86.86% <60.00%> (-1.43%)`	⬇️
pkg/deploy/ec2/tagging_manager__mocks.go	`69.69% <69.69%> (ø)`
... and 5 more

☔ View full report in Codecov by Sentry.
📢 Do you have feedback about the report comment? Let us know in this issue.

hintofbasil · 2022-05-06T11:43:39Z

Hi @kishorj, thanks for agreeing to take a look. A few people in Skyscanner have agreed to review it in the mean time. Matteo has already put one review in. Hopefully this makes things easier for you.

We are planning on deploying this internally in the next few weeks. We understand it likely won't be reviewed by then - but would it be possible to get the e2e tests ran against this? I would make us feel much more confident in running a fork and setting these up ourselves seems unrealistic.

kishorj · 2022-05-11T16:28:06Z

/ok-to-test

gjtempleton

I've only got through 11 of the files, but a few nits and some style questions.

gjtempleton · 2022-05-17T12:57:14Z

docs/guide/service/annotations.md

@@ -47,6 +47,10 @@
 | [service.beta.kubernetes.io/aws-load-balancer-target-node-labels](#target-node-labels)           | stringMap               |                           |                                                        |
 | [service.beta.kubernetes.io/aws-load-balancer-attributes](#load-balancer-attributes)             | stringMap               |                           |                                                        |
 | [service.beta.kubernetes.io/aws-load-balancer-manage-backend-security-group-rules](#manage-backend-sg-rules)  | boolean    | true                      |                                                        |
+| [service.beta.kubernetes.io/aws-load-balancer-endpoint-service-enabled](#endpoint-service-enable)| boolean                 | false                     |                                                        |
+| [service.beta.kubernetes.io/aws-load-balancer-endpoint-service-acceptance-required](#endpoint-service-acceptance)| boolean |                           |                                                        |
+| [service.beta.kubernetes.io/aws-load-balancer-endpoint-service-allowed-principals](#endpoint-allowed-principles)| stringList |                         |                                                        |


Nit:

Suggested change

| [service.beta.kubernetes.io/aws-load-balancer-endpoint-service-allowed-principals](#endpoint-allowed-principles)| stringList | | |

| [service.beta.kubernetes.io/aws-load-balancer-endpoint-service-allowed-principals](#endpoint-allowed-principals)| stringList | | |

gjtempleton · 2022-05-17T12:58:14Z

docs/guide/service/annotations.md

+
+- <a name="endpoint-service-acceptance">`service.beta.kubernetes.io/aws-load-balancer-endpoint-service-acceptance-required`</a> specifies whether requests to attach an Endpoint to the Endpoint Service require manual acceptance.
+
+- <a name="endpoint-allowed-principles">`service.beta.kubernetes.io/aws-load-balancer-endpoint-service-allowed-principals`</a> is a list of principles from which an Endpoint can be attached to this Endpoint Service.


Matching nit:

Suggested change

- <a name="endpoint-allowed-principles">`service.beta.kubernetes.io/aws-load-balancer-endpoint-service-allowed-principals`</a> is a list of principles from which an Endpoint can be attached to this Endpoint Service.

- <a name="endpoint-allowed-principals">`service.beta.kubernetes.io/aws-load-balancer-endpoint-service-allowed-principals`</a> is a list of principles from which an Endpoint can be attached to this Endpoint Service.

gjtempleton · 2022-05-17T12:59:53Z

docs/guide/service/annotations.md

+
+- <a name="endpoint-allowed-principles">`service.beta.kubernetes.io/aws-load-balancer-endpoint-service-allowed-principals`</a> is a list of principles from which an Endpoint can be attached to this Endpoint Service.
+
+- <a name="endpoint-private-dns">`service.beta.kubernetes.io/aws-load-balancer-endpoint-service-private-dns-name`</a> is the private DNS name given to the Endpoint Service.  This will need to be verifies through a valid DNS record.


Suggested change

- <a name="endpoint-private-dns">`service.beta.kubernetes.io/aws-load-balancer-endpoint-service-private-dns-name`</a> is the private DNS name given to the Endpoint Service. This will need to be verifies through a valid DNS record.

- <a name="endpoint-private-dns">`service.beta.kubernetes.io/aws-load-balancer-endpoint-service-private-dns-name`</a> is the private DNS name given to the Endpoint Service. This will need to be verified through a valid DNS record.

gjtempleton · 2022-05-17T13:17:15Z

pkg/deploy/ec2/endpoint_service_manager.go

+	ReconcilePermissions(ctx context.Context, permissions *ec2model.VPCEndpointServicePermissions) error
+}
+
+// NewdefaultEndpointServiceManager constructs new defaultEndpointServiceManager.


Nit:

Suggested change

// NewdefaultEndpointServiceManager constructs new defaultEndpointServiceManager.

// NewDefaultEndpointServiceManager constructs new defaultEndpointServiceManager.

gjtempleton · 2022-05-17T13:19:22Z

pkg/deploy/ec2/endpoint_service_manager.go

+	externalManagedTags []string
+}
+
+func (m *defaultEndpointServiceManager) Create(ctx context.Context, resSG *ec2model.VPCEndpointService) (ec2model.VPCEndpointServiceStatus, error) {


Seems there's still a few references to SG rather than ES throughout this function.

Suggested change

func (m *defaultEndpointServiceManager) Create(ctx context.Context, resSG *ec2model.VPCEndpointService) (ec2model.VPCEndpointServiceStatus, error) {

func (m *defaultEndpointServiceManager) Create(ctx context.Context, resES *ec2model.VPCEndpointService) (ec2model.VPCEndpointServiceStatus, error) {

gjtempleton · 2022-05-17T13:29:34Z

pkg/deploy/ec2/endpoint_service_manager.go

+
+func (m *defaultEndpointServiceManager) Update(ctx context.Context, resES *ec2model.VPCEndpointService, sdkES networking.VPCEndpointServiceInfo) (ec2model.VPCEndpointServiceStatus, error) {
+
+	m.logger.Info("Updating", "resES", resES, "sdkES", sdkES)


Do we want to log this if no changes are being made?

In pkg/deploy/ec2/endpoint_service_synthesizer.go we calculate the endpoint services that need created, deleted and updated and only call the relevant function. If no endpoint services need updated then this function is never called. It feels safe to me.

gjtempleton · 2022-05-17T13:34:08Z

pkg/deploy/ec2/endpoint_service_manager.go

+}
+
+func (m *defaultEndpointServiceManager) ReconcilePermissions(ctx context.Context, permissions *ec2model.VPCEndpointServicePermissions) error {
+	m.logger.Info("Reconciling Permissions")


The pattern through the rest of the codebase is lower case logging. Do we want to deviate from that here?

gjtempleton · 2022-05-17T13:35:29Z

pkg/deploy/ec2/endpoint_service_manager.go

+	m.logger.Info("Build priciples",
+		"AddPrinciples", addPrinciples,
+		"RemovePrinciples", removePrinciples,
+	)


Suggested change

m.logger.Info("Build priciples",

"AddPrinciples", addPrinciples,

"RemovePrinciples", removePrinciples,

)

m.logger.Info("build principals",

"addPrinciples", addPrincipals,

"removePrinciples", removePrincipals,

)

gjtempleton · 2022-05-17T13:36:07Z

docs/guide/ingress/annotations.md

@@ -57,6 +57,10 @@ You can add annotations to kubernetes Ingress and Service objects to customize t
 |[alb.ingress.kubernetes.io/actions.${action-name}](#actions)|json|N/A|Ingress|N/A|
 |[alb.ingress.kubernetes.io/conditions.${conditions-name}](#conditions)|json|N/A|Ingress|N/A|
 |[alb.ingress.kubernetes.io/target-node-labels](#target-node-labels)|stringMap|N/A|Ingress,Service|N/A|
+|[alb.ingress.kubernetes.io/aws-load-balancer-endpoint-service-enabled](#endpoint-service-enable)|boolean|false|
+|[alb.ingress.kubernetes.io/aws-load-balancer-endpoint-service-acceptance-required](#endpoint-service-acceptance)|boolean||
+|[alb.ingress.kubernetes.io/aws-load-balancer-endpoint-service-allowed-principals](#endpoint-allowed-principles)|stringList||


Nit:

Suggested change

|[alb.ingress.kubernetes.io/aws-load-balancer-endpoint-service-allowed-principals](#endpoint-allowed-principles)|stringList||

|[alb.ingress.kubernetes.io/aws-load-balancer-endpoint-service-allowed-principals](#endpoint-allowed-principals)|stringList||

gjtempleton · 2022-05-17T13:38:48Z

pkg/deploy/ec2/endpoint_service_manager.go

+
+	serviceId, err := permissions.Spec.ServiceId.Resolve(ctx)
+	if err != nil {
+		return errors.Wrap(err, "Failed to resolve VPCEndpointServicePermissions serviceID")


Same question as with logging casing.

hintofbasil · 2022-05-23T20:47:45Z

This has been rebased and the formatting changes above implemented.

hintofbasil · 2022-05-24T17:40:09Z

I'm unable to replicate the e2e test failure.

I've added the following resources to a cluster running this branch of the controller.

apiVersion: v1
kind: Namespace
metadata:
  name: test
---
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  name: aws-load-balancer-controller-test
spec:
  controller: ingress.k8s.aws/alb
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: aws-load-balancer-controller-test
  namespace: test
  annotations:
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/subnets: subnet-id-1,subnet-id-2
spec:
  ingressClassName: aws-load-balancer-controller-test
  rules:
  - host: ""
    http:
      paths:
      - path: /path
        pathType: Exact
        backend:
          service:
            name: aws-load-balancer-controller-test
            port:
              name: http
---
apiVersion: v1
kind: Service
metadata:
  name: aws-load-balancer-controller-test
  namespace: test
spec:
  ports:
  - name: http
    port: 80
    targetPort: http
  selector:
    service: 'null'
  type: NodePort

This brings up a load balancer which successfully provisions.

I've then deleted the Ingress and the load balancer successfully deletes. Then deleted the namespace which also successfully deletes.

From what I can see this follows the exact logic of the test.

As such I'm going to trigger a rerun to see if it was a flake.

hintofbasil · 2022-05-24T17:41:13Z

/retest

seh · 2022-05-30T02:00:35Z

How does this approach differ from @rifelpet's initial pass in #1948?

seh · 2022-05-30T02:04:39Z

I didn't see it while reading the code, but I'm wondering whether there are more IAM actions that we'll need to allow in the IAM policy used by this controller.

hintofbasil · 2022-05-30T13:43:52Z

I didn't see it while reading the code, but I'm wondering whether there are more IAM actions that we'll need to allow in the IAM policy used by this controller.

You were correct, after adding these the tests are passing. Thanks!

hintofbasil · 2022-05-30T13:46:31Z

How does this approach differ from @rifelpet's initial pass in #1948?

This is a continuation of their work. Rifelpet provided a rough outline for the code; function definitions and structs mainly. This adds the actual implementation to make the feature work. It sticks pretty closely to Rifelpet's original design - and even includes their commits showing how it was built up from there.

seh · 2022-05-30T14:06:43Z

This is a continuation of their work.

Thank you for the detailed explanation.

I was going to say earlier this morning that configuring the private DNS name on the VPC endpoint service side seemed backwards to me, thinking that it would be consumers creating interface VPC endpoints that would decide on the name, but then I went back and read the AWS documentation on the feature, and see that your design matches that feature's interface: the service provider chooses a DNS name. I still find this so confusing. That's not your fault, though.

rifelpet · 2022-05-30T18:02:41Z

pkg/deploy/ec2/endpoint_service_manager.go

+	sgTags := m.trackingProvider.ResourceTags(resES.Stack(), resES, resES.Spec.Tags)
+	sdkTags := convertTagsToSDKTags(sgTags)


Suggested change

sgTags := m.trackingProvider.ResourceTags(resES.Stack(), resES, resES.Spec.Tags)

sdkTags := convertTagsToSDKTags(sgTags)

esTags := m.trackingProvider.ResourceTags(resES.Stack(), resES, resES.Spec.Tags)

sdkTags := convertTagsToSDKTags(esTags)

rifelpet · 2022-05-30T18:06:30Z

pkg/deploy/ec2/endpoint_service_synthesizer.go

+	for _, sdkSG := range unmatchedSDKESs {
+		if err := s.esManager.Delete(ctx, sdkSG); err != nil {


Suggested change

for _, sdkSG := range unmatchedSDKESs {

if err := s.esManager.Delete(ctx, sdkSG); err != nil {

for _, sdkES := range unmatchedSDKESs {

if err := s.esManager.Delete(ctx, sdkES); err != nil {

rifelpet · 2022-05-30T18:07:57Z

pkg/deploy/ec2/endpoint_service_synthesizer.go

+	sdk networking.VPCEndpointServiceInfo
+}
+
+func matchResAndSDKEndpointServices(resSGs []*ec2model.VPCEndpointService, sdkSGs []networking.VPCEndpointServiceInfo,


Suggested change

func matchResAndSDKEndpointServices(resSGs []*ec2model.VPCEndpointService, sdkSGs []networking.VPCEndpointServiceInfo,

func matchResAndSDKEndpointServices(resESs []*ec2model.VPCEndpointService, sdkESs []networking.VPCEndpointServiceInfo,

rifelpet · 2022-05-30T18:09:02Z

pkg/deploy/ec2/endpoint_service_synthesizer.go

+	sdk networking.VPCEndpointServiceInfo
+}
+
+func matchResAndSDKEndpointServices(resSGs []*ec2model.VPCEndpointService, sdkSGs []networking.VPCEndpointServiceInfo,


More references to 'sg' in this function that should be updated to 'es'

rifelpet · 2022-05-30T18:09:46Z

pkg/deploy/ec2/tagging_manager.go

+		for sgID, esInfo := range esInfoByIDForTagFilter {
+			esInfoByID[sgID] = esInfo


Suggested change

for sgID, esInfo := range esInfoByIDForTagFilter {

esInfoByID[sgID] = esInfo

for esID, esInfo := range esInfoByIDForTagFilter {

esInfoByID[esID] = esInfo

hintofbasil · 2022-05-30T21:39:24Z

Thanks @rifelpet, seems quite a few of these typos escaped me.
I've cleaned them all up in a single commit.

shoukoo · 2022-07-06T03:06:15Z

just wondering if it's ready to be merged? would like to have this feature in the default branch.

k8s-ci-robot · 2023-08-13T23:17:45Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: hintofbasil
Once this PR has been reviewed and has the lgtm label, please ask for approval from kishorj. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

tculp · 2023-10-03T19:28:11Z

Any update on this?

hintofbasil · 2023-10-09T09:21:10Z

Any update on this?

The code is up to date on my end. Just waiting for a review from kishorj and/or M00nf1sh. I presume it being added to the v2.7.0 roadmap means they are aware it still needs review.

k8s-triage-robot · 2024-01-22T04:21:53Z

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle stale
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

z0rc · 2024-01-22T10:27:53Z

/remove-lifecycle stale

dims · 2024-01-24T18:01:34Z

/assign @oliviassss

oliviassss · 2024-01-25T00:44:07Z

Thanks for your contribution, and sorry for the delay. I will discuss and review this PR internally with our approvers to gather opinions.

oliviassss · 2024-02-06T23:41:30Z

Sorry for the delay, we discussed this feature internally, it's a major feature that needs a minor release, and also we need to do a security review with it. So we aim at shipping it with v2.8.0

k8s-triage-robot · 2024-05-08T00:01:27Z

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle stale
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

aaroniscode · 2024-05-08T00:07:47Z

/remove-lifecycle stale

prianna · 2024-07-01T17:21:02Z

Hey @oliviassss AWS has released 2.8.1 of the LB controller and this PR still doesn't seem to have been merged. I don't see support for managing VPC private endpoints natively in the controller's release notes. Any idea what the blocker for this is? We'd love an update, as we have several major architectural changes that depend on this at Salesforce.

oliviassss · 2024-07-02T21:53:08Z

/assign @M00nF1sh

…lancer-controller into endpoint-service

m17kea · 2024-07-12T09:49:34Z

Any update on this?

bsod90 · 2024-08-15T23:31:02Z

It would be so awesome if this one got merged. We're considering implementing an alternative solution, but doing it through the load balancer controller would be so much cleaner.

k8s-ci-robot · 2024-08-15T23:31:11Z

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

maruina · 2024-10-18T07:22:02Z

@M00nF1sh and update on this?

sudheer-gutta · 2024-11-21T22:29:09Z

We already have 2.10.0 version of load-balancer-controller and this PR is not part of it. We are trying to design a solution using multiple VPC endpoint services and having native support is helpful. Can you please share the plan on when this PR will make it into a release?

vazuev · 2025-01-17T14:53:45Z

Hello @oliviassss @kishorj @M00nF1sh !
This feature would be really liked in ALB-controller solution!

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels May 2, 2022

k8s-ci-robot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label May 2, 2022

k8s-ci-robot requested review from kishorj and M00nF1sh May 2, 2022 19:41

maruina reviewed May 5, 2022

View reviewed changes

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 11, 2022

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels May 11, 2022

gjtempleton reviewed May 17, 2022

View reviewed changes

hintofbasil force-pushed the endpoint-service branch from e0ca744 to 488bf6a Compare May 23, 2022 20:35

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 23, 2022

hintofbasil force-pushed the endpoint-service branch from 488bf6a to af0618d Compare May 23, 2022 20:46

rifelpet reviewed May 30, 2022

View reviewed changes

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 12, 2022

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 13, 2023

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 22, 2024

k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 22, 2024

k8s-ci-robot assigned oliviassss Jan 24, 2024

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 7, 2024

shraddhabang added this to the v2.8.0 milestone Feb 7, 2024

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label May 8, 2024

k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label May 8, 2024

Merge branch 'main' of https://github.com/kubernetes-sigs/aws-load-ba…

817935c

…lancer-controller into endpoint-service

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 9, 2024

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 15, 2024

	\| [service.beta.kubernetes.io/aws-load-balancer-endpoint-service-allowed-principals](#endpoint-allowed-principles)\| stringList \| \| \|
	\| [service.beta.kubernetes.io/aws-load-balancer-endpoint-service-allowed-principals](#endpoint-allowed-principals)\| stringList \| \| \|


		- <a name="endpoint-service-acceptance">`service.beta.kubernetes.io/aws-load-balancer-endpoint-service-acceptance-required`</a> specifies whether requests to attach an Endpoint to the Endpoint Service require manual acceptance.

		- <a name="endpoint-allowed-principles">`service.beta.kubernetes.io/aws-load-balancer-endpoint-service-allowed-principals`</a> is a list of principles from which an Endpoint can be attached to this Endpoint Service.

	- <a name="endpoint-allowed-principles">`service.beta.kubernetes.io/aws-load-balancer-endpoint-service-allowed-principals`</a> is a list of principles from which an Endpoint can be attached to this Endpoint Service.
	- <a name="endpoint-allowed-principals">`service.beta.kubernetes.io/aws-load-balancer-endpoint-service-allowed-principals`</a> is a list of principles from which an Endpoint can be attached to this Endpoint Service.


		- <a name="endpoint-allowed-principles">`service.beta.kubernetes.io/aws-load-balancer-endpoint-service-allowed-principals`</a> is a list of principles from which an Endpoint can be attached to this Endpoint Service.

		- <a name="endpoint-private-dns">`service.beta.kubernetes.io/aws-load-balancer-endpoint-service-private-dns-name`</a> is the private DNS name given to the Endpoint Service. This will need to be verifies through a valid DNS record.

	// NewdefaultEndpointServiceManager constructs new defaultEndpointServiceManager.
	// NewDefaultEndpointServiceManager constructs new defaultEndpointServiceManager.

	func (m defaultEndpointServiceManager) Create(ctx context.Context, resSG ec2model.VPCEndpointService) (ec2model.VPCEndpointServiceStatus, error) {
	func (m defaultEndpointServiceManager) Create(ctx context.Context, resES ec2model.VPCEndpointService) (ec2model.VPCEndpointServiceStatus, error) {


		func (m defaultEndpointServiceManager) Update(ctx context.Context, resES ec2model.VPCEndpointService, sdkES networking.VPCEndpointServiceInfo) (ec2model.VPCEndpointServiceStatus, error) {

		m.logger.Info("Updating", "resES", resES, "sdkES", sdkES)

	\|[alb.ingress.kubernetes.io/aws-load-balancer-endpoint-service-allowed-principals](#endpoint-allowed-principles)\|stringList\|\|
	\|[alb.ingress.kubernetes.io/aws-load-balancer-endpoint-service-allowed-principals](#endpoint-allowed-principals)\|stringList\|\|

		sgTags := m.trackingProvider.ResourceTags(resES.Stack(), resES, resES.Spec.Tags)
		sdkTags := convertTagsToSDKTags(sgTags)

		for _, sdkSG := range unmatchedSDKESs {
		if err := s.esManager.Delete(ctx, sdkSG); err != nil {

	func matchResAndSDKEndpointServices(resSGs []*ec2model.VPCEndpointService, sdkSGs []networking.VPCEndpointServiceInfo,
	func matchResAndSDKEndpointServices(resESs []*ec2model.VPCEndpointService, sdkESs []networking.VPCEndpointServiceInfo,

		for sgID, esInfo := range esInfoByIDForTagFilter {
		esInfoByID[sgID] = esInfo

Add support for VPC Endpoint Services #2636

Are you sure you want to change the base?

Add support for VPC Endpoint Services #2636

Conversation

hintofbasil commented May 2, 2022

Issue

Description

Checklist

BONUS POINTS checklist: complete for good vibes and maybe prizes?! 🤯

k8s-ci-robot commented May 2, 2022

maruina left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kishorj commented May 5, 2022

codecov-commenter commented May 5, 2022 • edited Loading

Codecov Report

hintofbasil commented May 6, 2022

kishorj commented May 11, 2022

gjtempleton left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hintofbasil May 23, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hintofbasil commented May 23, 2022

hintofbasil commented May 24, 2022 • edited Loading

hintofbasil commented May 24, 2022

seh commented May 30, 2022

seh commented May 30, 2022

hintofbasil commented May 30, 2022

hintofbasil commented May 30, 2022

seh commented May 30, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hintofbasil commented May 30, 2022

shoukoo commented Jul 6, 2022

k8s-ci-robot commented Aug 13, 2023

tculp commented Oct 3, 2023

hintofbasil commented Oct 9, 2023 • edited Loading

k8s-triage-robot commented Jan 22, 2024

z0rc commented Jan 22, 2024

dims commented Jan 24, 2024

oliviassss commented Jan 25, 2024

oliviassss commented Feb 6, 2024 • edited Loading

k8s-triage-robot commented May 8, 2024

aaroniscode commented May 8, 2024

prianna commented Jul 1, 2024

oliviassss commented Jul 2, 2024

m17kea commented Jul 12, 2024

bsod90 commented Aug 15, 2024

k8s-ci-robot commented Aug 15, 2024

maruina commented Oct 18, 2024

sudheer-gutta commented Nov 21, 2024

vazuev commented Jan 17, 2025

codecov-commenter commented May 5, 2022 •

edited

Loading

hintofbasil May 23, 2022 •

edited

Loading

hintofbasil commented May 24, 2022 •

edited

Loading

hintofbasil commented Oct 9, 2023 •

edited

Loading

oliviassss commented Feb 6, 2024 •

edited

Loading