diff --git a/control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go b/control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go index 7f0b2f3d2743..8f3564f246f6 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go +++ b/control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go @@ -1176,7 +1176,7 @@ func (r *HostedControlPlaneReconciler) reconcileAPIServerService(ctx context.Con p := kas.NewKubeAPIServerServiceParams(hcp) apiServerService := manifests.KubeAPIServerService(hcp.Namespace) if _, err := createOrUpdate(ctx, r.Client, apiServerService, func() error { - return kas.ReconcileService(apiServerService, serviceStrategy, p.OwnerReference, p.APIServerPort, p.APIServerListenPort, p.AllowedCIDRBlocks, util.IsPublicHCP(hcp), util.IsPrivateHCP(hcp)) + return kas.ReconcileService(apiServerService, serviceStrategy, p.OwnerReference, p.APIServerPort, p.AllowedCIDRBlocks, util.IsPublicHCP(hcp), util.IsPrivateHCP(hcp)) }); err != nil { return fmt.Errorf("failed to reconcile API server service: %w", err) } @@ -2393,7 +2393,7 @@ func (r *HostedControlPlaneReconciler) reconcileKubeAPIServer(ctx context.Contex serviceMonitor := manifests.KASServiceMonitor(hcp.Namespace) if result, err := createOrUpdate(ctx, r, serviceMonitor, func() error { - return kas.ReconcileServiceMonitor(serviceMonitor, int(p.APIServerPort), config.OwnerRefFrom(hcp), hcp.Spec.ClusterID, r.MetricsSet) + return kas.ReconcileServiceMonitor(serviceMonitor, config.OwnerRefFrom(hcp), hcp.Spec.ClusterID, r.MetricsSet) }); err != nil { return fmt.Errorf("failed to reconcile kas service monitor: %w", err) } else { diff --git a/control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller_test.go b/control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller_test.go index a055c3a98ed6..d5d89d0f9013 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller_test.go +++ b/control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller_test.go @@ -216,6 +216,7 @@ func TestBuildOAuthVolumeTemplates(t *testing.T) { func TestReconcileAPIServerService(t *testing.T) { targetNamespace := "test" apiPort := int32(1234) + kasPort := "client" hostname := "test.example.com" allowCIDR := []hyperv1.CIDRBlock{"1.2.3.4/24"} allowCIDRString := []string{"1.2.3.4/24"} @@ -248,7 +249,7 @@ func TestReconcileAPIServerService(t *testing.T) { { Protocol: corev1.ProtocolTCP, Port: apiPort, - TargetPort: intstr.FromInt(int(apiPort)), + TargetPort: intstr.FromString(kasPort), }, }, LoadBalancerSourceRanges: allowCIDRString, diff --git a/control-plane-operator/controllers/hostedcontrolplane/kas/params.go b/control-plane-operator/controllers/hostedcontrolplane/kas/params.go index fb7a5bbe6e32..689ed35446c4 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/kas/params.go +++ b/control-plane-operator/controllers/hostedcontrolplane/kas/params.go @@ -73,11 +73,9 @@ type KubeAPIServerParams struct { type KubeAPIServerServiceParams struct { // APIServerPort is the port used for the SVC. - APIServerPort int - // APIServerListenPort is the port used for the TargetPort. - APIServerListenPort int - AllowedCIDRBlocks []string - OwnerReference *metav1.OwnerReference + APIServerPort int + AllowedCIDRBlocks []string + OwnerReference *metav1.OwnerReference } const ( @@ -123,7 +121,7 @@ func NewKubeAPIServerParams(ctx context.Context, hcp *hyperv1.HostedControlPlane params.AdvertiseAddress = util.GetAdvertiseAddress(hcp, config.DefaultAdvertiseIPv4Address, config.DefaultAdvertiseIPv6Address) - params.APIServerPort = util.BindAPIPortWithDefault(hcp, config.DefaultAPIServerPort) + params.APIServerPort = util.BindAPIPortWithDefault(hcp) if _, ok := hcp.Annotations[hyperv1.PortierisImageAnnotation]; ok { params.Images.Portieris = hcp.Annotations[hyperv1.PortierisImageAnnotation] } @@ -146,7 +144,7 @@ func NewKubeAPIServerParams(ctx context.Context, hcp *hyperv1.HostedControlPlane ProbeHandler: corev1.ProbeHandler{ HTTPGet: &corev1.HTTPGetAction{ Scheme: corev1.URISchemeHTTPS, - Port: intstr.FromInt(int(params.APIServerPort)), + Port: intstr.FromString("client"), Path: "livez?exclude=etcd", }, }, @@ -261,7 +259,7 @@ func NewKubeAPIServerParams(ctx context.Context, hcp *hyperv1.HostedControlPlane ProbeHandler: corev1.ProbeHandler{ HTTPGet: &corev1.HTTPGetAction{ Scheme: corev1.URISchemeHTTPS, - Port: intstr.FromInt(int(params.APIServerPort)), + Port: intstr.FromString("client"), Path: "readyz", }, }, @@ -532,16 +530,14 @@ func (p *KubeAPIServerParams) ServiceNodePortRange() string { } func NewKubeAPIServerServiceParams(hcp *hyperv1.HostedControlPlane) *KubeAPIServerServiceParams { - listenPort := util.BindAPIPortWithDefault(hcp, config.DefaultAPIServerPort) port := util.InternalAPIPortWithDefault(hcp, config.DefaultAPIServerPort) var allowedCIDRBlocks []string for _, block := range util.AllowedCIDRBlocks(hcp) { allowedCIDRBlocks = append(allowedCIDRBlocks, string(block)) } return &KubeAPIServerServiceParams{ - APIServerPort: int(port), - APIServerListenPort: int(listenPort), - AllowedCIDRBlocks: allowedCIDRBlocks, - OwnerReference: config.ControllerOwnerRef(hcp), + APIServerPort: int(port), + AllowedCIDRBlocks: allowedCIDRBlocks, + OwnerReference: config.ControllerOwnerRef(hcp), } } diff --git a/control-plane-operator/controllers/hostedcontrolplane/kas/service.go b/control-plane-operator/controllers/hostedcontrolplane/kas/service.go index a55a48b69ff6..5cbc1d90479b 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/kas/service.go +++ b/control-plane-operator/controllers/hostedcontrolplane/kas/service.go @@ -18,7 +18,7 @@ import ( "github.com/openshift/hypershift/support/util" ) -func ReconcileService(svc *corev1.Service, strategy *hyperv1.ServicePublishingStrategy, owner *metav1.OwnerReference, apiServerServicePort int, apiServerListenPort int, apiAllowedCIDRBlocks []string, isPublic, isPrivate bool) error { +func ReconcileService(svc *corev1.Service, strategy *hyperv1.ServicePublishingStrategy, owner *metav1.OwnerReference, apiServerServicePort int, apiAllowedCIDRBlocks []string, isPublic, isPrivate bool) error { util.EnsureOwnerRef(svc, owner) if svc.Spec.Selector == nil { svc.Spec.Selector = kasLabels() @@ -40,7 +40,7 @@ func ReconcileService(svc *corev1.Service, strategy *hyperv1.ServicePublishingSt } portSpec.Port = int32(apiServerServicePort) portSpec.Protocol = corev1.ProtocolTCP - portSpec.TargetPort = intstr.FromInt(apiServerListenPort) + portSpec.TargetPort = intstr.FromString("client") if svc.Annotations == nil { svc.Annotations = map[string]string{} } @@ -117,7 +117,6 @@ func ReconcileServiceStatus(svc *corev1.Service, strategy *hyperv1.ServicePublis func ReconcilePrivateService(svc *corev1.Service, hcp *hyperv1.HostedControlPlane, owner *metav1.OwnerReference) error { apiServerPort := util.InternalAPIPortWithDefault(hcp, config.DefaultAPIServerPort) - apiServerListenPort := util.BindAPIPortWithDefault(hcp, config.DefaultAPIServerPort) util.EnsureOwnerRef(svc, owner) svc.Spec.Selector = kasLabels() var portSpec corev1.ServicePort @@ -128,7 +127,7 @@ func ReconcilePrivateService(svc *corev1.Service, hcp *hyperv1.HostedControlPlan } portSpec.Port = int32(apiServerPort) portSpec.Protocol = corev1.ProtocolTCP - portSpec.TargetPort = intstr.FromInt(int(apiServerListenPort)) + portSpec.TargetPort = intstr.FromString("client") svc.Spec.Type = corev1.ServiceTypeLoadBalancer if svc.Annotations == nil { svc.Annotations = map[string]string{} diff --git a/control-plane-operator/controllers/hostedcontrolplane/kas/servicemonitor.go b/control-plane-operator/controllers/hostedcontrolplane/kas/servicemonitor.go index 70ef2e1233b5..633b9d4eb887 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/kas/servicemonitor.go +++ b/control-plane-operator/controllers/hostedcontrolplane/kas/servicemonitor.go @@ -15,14 +15,14 @@ import ( "k8s.io/apimachinery/pkg/util/yaml" ) -func ReconcileServiceMonitor(sm *prometheusoperatorv1.ServiceMonitor, apiServerPort int, ownerRef config.OwnerRef, clusterID string, metricsSet metrics.MetricsSet) error { +func ReconcileServiceMonitor(sm *prometheusoperatorv1.ServiceMonitor, ownerRef config.OwnerRef, clusterID string, metricsSet metrics.MetricsSet) error { ownerRef.ApplyTo(sm) sm.Spec.Selector.MatchLabels = kasLabels() sm.Spec.NamespaceSelector = prometheusoperatorv1.NamespaceSelector{ MatchNames: []string{sm.Namespace}, } - targetPort := intstr.FromInt(apiServerPort) + targetPort := intstr.FromString("client") sm.Spec.Endpoints = []prometheusoperatorv1.Endpoint{ { TargetPort: &targetPort, diff --git a/support/util/networking.go b/support/util/networking.go index caf35dd834a0..6e90a7eb0732 100644 --- a/support/util/networking.go +++ b/support/util/networking.go @@ -61,7 +61,7 @@ func APIPort(hcp *hyperv1.HostedControlPlane) *int32 { // BindAPIPortWithDefault will retrieve the port the kube-apiserver binds on locally in the pod. // This comes from hcp.Spec.Networking.APIServer.Port if set and != 443 -func BindAPIPortWithDefault(hcp *hyperv1.HostedControlPlane, defaultValue int32) int32 { +func BindAPIPortWithDefault(hcp *hyperv1.HostedControlPlane) int32 { // Binding on 443 is not allowed. So returning default for that case. // This provides backward compatibility for existing clusters which were defaulting to that value, ignoring it here and // enforcing it in the data plane proxy by reconciling the endpoint. 443 API input is not allowed now. @@ -69,7 +69,7 @@ func BindAPIPortWithDefault(hcp *hyperv1.HostedControlPlane, defaultValue int32) if hcp.Spec.Networking.APIServer != nil && hcp.Spec.Networking.APIServer.Port != nil && *hcp.Spec.Networking.APIServer.Port != 443 { return *hcp.Spec.Networking.APIServer.Port } - return defaultValue + return 6443 } // BindAPIPortWithDefaultFromHostedCluster will retrieve the port the kube-apiserver binds on locally in the pod.