Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Change Workbench default service.type and other service generation items #477

Merged
merged 9 commits into from
Mar 7, 2024

Conversation

tnederlof
Copy link
Contributor

@tnederlof tnederlof commented Mar 6, 2024

This PR contains the following changes, following the changes made to RSPM by @atheriel in 2021 (PR here: #122) This change to RSPM was made over 2 years ago and went pretty smoothly, now bringing it to Workbench.

  • Use a ClusterIP service by default instead of a NodePort.
  • Add support for controlling loadBalancerIP and clusterIP, which are commonly-used service features.
  • Ignore nodePort settings when the service type is not NodePort. Otherwise, this will generate server-side validation errors.
  • Simplify handling of Service annotations by removing the existing YAML helper is not actually necessary and has a confusing name.
  • Tweak documentation for service.nodePort and service.annotations.

Since the first of these is a breaking change, I bumped the minor version for the chart.

Moving to ClusterIP

ClusterIP is the Kubernetes default, exposing the service in-cluster only. This is a secure, well-understood default. For external users, there are a few options:

  • Use an Ingress. We support this already and it works with ClusterIP.
  • Use a LoadBalancer. This can be expensive so it makes a poor default.
  • Use a NodePort and some kind of external load balancing solution.

It seems like the last route (which is the current default) is much more uncommon than the first two, so I'd advocate for this change.

In addition:

  • NodePorts are a very limited cluster resource, so we should avoid consuming them if we can avoid it.
  • Defaulting to NodePort is a poor security choice, especially if we have users that don't understand the consequences.

Testing

  • Service comes up as ClusterIP by default as expected
  • Setting service.clusterIP also takes effect
  • Service comes up as NodePort when service.type: "NodePort"
  • Annotations flow through under service.annotations for all types of services

@tnederlof tnederlof added the rsw label Mar 6, 2024
@tnederlof tnederlof self-assigned this Mar 6, 2024
@tnederlof tnederlof requested a review from SamEdwardes March 6, 2024 14:38
Copy link
Contributor

@atheriel atheriel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@tnederlof tnederlof merged commit 2997b1d into main Mar 7, 2024
5 checks passed
@tnederlof tnederlof deleted the tn-change-workbench-service branch March 7, 2024 20:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants