openelb: Service does not get external ip, state remains pending

Describe the bug

When I create a new service in kubernetes, openelb doesn’t assign an external ip address to the service. What am I missing here? By the way, is the slack channel still active? Because the link to it does not work anymore.

To Reproduce

Expected behaviour

Service receives an external ip address from the eip address pool kubectl

Output

#kubectl get svc/docker-registry -n registry

NAME              TYPE           CLUSTER-IP      EXTERNAL-IP   PORT(S)          AGE
docker-registry   LoadBalancer   10.104.39.118   <pending>     5000:32223/TCP   6h50m
#kubectl describe svc/docker-registry -n registry

Name:                     docker-registry
Namespace:                registry
Labels:                   <none>
Annotations:              eip.openelb.kubesphere.io/v1alpha2: eip-k8s-pool
                          lb.kubesphere.io/v1alpha1: openelb
                          protocol.openelb.kubesphere.io/v1alpha1: layer2
Selector:                 app=registry
Type:                     LoadBalancer
IP Family Policy:         SingleStack
IP Families:              IPv4
IP:                       10.104.39.118
IPs:                      10.104.39.118
Port:                     registry-port  5000/TCP
TargetPort:               5000/TCP
NodePort:                 registry-port  32223/TCP
Endpoints:                192.168.138.4:5000
Session Affinity:         None
External Traffic Policy:  Cluster
Events:                   <none>
#kubectl describe eip -n openelb-system

Name:         eip-k8s-pool
Namespace:    
Labels:       <none>
Annotations:  eip.openelb.kubesphere.io/is-default-eip: true
API Version:  network.kubesphere.io/v1alpha2
Kind:         Eip
Metadata:
  Creation Timestamp:  2022-11-23T23:53:31Z
  Finalizers:
    finalizer.ipam.kubesphere.io/v1alpha1
  Generation:  2
  Managed Fields:
    API Version:  network.kubesphere.io/v1alpha2
    Fields Type:  FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .:
          f:eip.openelb.kubesphere.io/is-default-eip:
      f:spec:
        .:
        f:address:
        f:interface:
        f:protocol:
    Manager:      OpenAPI-Generator
    Operation:    Update
    Time:         2022-11-23T23:53:31Z
    API Version:  network.kubesphere.io/v1alpha2
    Fields Type:  FieldsV1
    fieldsV1:
      f:metadata:
        f:finalizers:
          .:
          v:"finalizer.ipam.kubesphere.io/v1alpha1":
    Manager:      openelb-manager
    Operation:    Update
    Time:         2022-11-23T23:53:31Z
    API Version:  network.kubesphere.io/v1alpha2
    Fields Type:  FieldsV1
    fieldsV1:
      f:status:
        .:
        f:firstIP:
        f:lastIP:
        f:poolSize:
        f:v4:
    Manager:         openelb-manager
    Operation:       Update
    Subresource:     status
    Time:            2022-11-23T23:53:31Z
  Resource Version:  1475
  UID:               d7aa5153-0edb-4a23-b04d-318917f3af2b
Spec:
  Address:    192.167.56.91-192.167.56.140
  Interface:  can_reach:192.167.56.1
  Protocol:   layer2
Status:
  First IP:   192.167.56.91
  Last IP:    192.167.56.140
  Pool Size:  50
  v4:         true
Events:
  Type     Reason          Age                  From  Message
  ----     ------          ----                 ----  -------
  Warning  add/update eip  11m (x160 over 39h)  IPAM  k8s-n-1: operation not permitted
#kubectl logs pod/openelb-manager-748b4c9787-sgqmt -n openelb-system

{
  "level": "error",
  "ts": 1669366186.8409953,
  "logger": "controller-runtime.controller",
  "msg": "Reconciler error",
  "controller": "LBController",
  "request": "registry/docker-registry",
  "error": "no avliable eip",
  "stacktrace": "github.com/go-logr/zapr.(*zapLogger).Error\n\t/go/pkg/mod/github.com/go-logr/zapr@v0.1.0/zapr.go:128\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.6.0/pkg/internal/controller/controller.go:258\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.6.0/pkg/internal/controller/controller.go:232\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).worker\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.6.0/pkg/internal/controller/controller.go:211\nk8s.io/apimachinery/pkg/util/wait.BackoffUntil.func1\n\t/go/pkg/mod/k8s.io/apimachinery@v0.18.2/pkg/util/wait/wait.go:155\nk8s.io/apimachinery/pkg/util/wait.BackoffUntil\n\t/go/pkg/mod/k8s.io/apimachinery@v0.18.2/pkg/util/wait/wait.go:156\nk8s.io/apimachinery/pkg/util/wait.JitterUntil\n\t/go/pkg/mod/k8s.io/apimachinery@v0.18.2/pkg/util/wait/wait.go:133\nk8s.io/apimachinery/pkg/util/wait.Until\n\t/go/pkg/mod/k8s.io/apimachinery@v0.18.2/pkg/util/wait/wait.go:90"
}

Below the definition of the service:

apiVersion: v1
kind: Service
metadata:
  name: docker-registry
  namespace: registry
  annotations:
    lb.kubesphere.io/v1alpha1: openelb
    protocol.openelb.kubesphere.io/v1alpha1: layer2
    eip.openelb.kubesphere.io/v1alpha2: eip-k8s-pool
spec:
  selector:
    app: registry
  type: LoadBalancer
  ports:
    - name: registry-port
      port: 5000
      targetPort: 5000
  externalTrafficPolicy: Cluster

Version Info

  • Version of Kubernetes: 1.25.4
  • Version of OpenELB: 0.4.4

About this issue

  • Original URL
  • State: open
  • Created 2 years ago
  • Comments: 15 (5 by maintainers)

Most upvoted comments

It is caused by container securityContext. You can modify the securityContext of openelb-manager as shown below:

        securityContext:
          capabilities:
            add:
            - NET_ADMIN
            - SYS_TIME
            - NET_RAW
            - NET_BIND_SERVICE

more about capabilities: https://man7.org/linux/man-pages/man7/capabilities.7.html

I gave it another try and this works for me too! Will this be updated in the helm charts?

yes, we will update it later

它是由容器 securityContext 引起的。可以修改openelb-manager的securityContext如下图:

        securityContext:
          capabilities:
            add:
            - NET_ADMIN
            - SYS_TIME
            - NET_RAW
            - NET_BIND_SERVICE

有关功能的更多信息:https 😕/man7.org/linux/man-pages/man7/capabilities.7.html

this works for me!