Skip to content

Cannot register nodes with target group outside host VPC #3084

@zeevallin

Description

@zeevallin

Describe the bug
When trying to register the IP of a pod with a target group that is outside of the current VPC, the controller don't set the all value for AvailabilityZone resulting in the request to register the instance failing.

Steps to reproduce

  1. Have a IP target group in a peered VPC
  2. Set up a target group binding against the target group of type IP
  3. Wait for the controller to reconcile
  4. Get an error message in the logs
{"level":"error","ts":1677695808.508565,"logger":"controller.targetGroupBinding","msg":"Reconciler error","reconciler group":"elbv2.k8s.aws","reconciler kind":"TargetGroupBinding","name":"external-app-lb","namespace":"projectcontour","error":"ValidationError: You must specify a valid Availability Zone or select 'all' for all enabled Availability zones, since the IP address '10.130.6.97' is outside the VPC\n\tstatus code: 400, request id: e9f1daa7-be4a-41fb-907f-9d10ffa6781c"} {"level":"info","ts":1677695972.3855486,"msg":"registering targets","arn":"...","targets":[{"AvailabilityZone":null,"Id":"10.130.175.52","Port":8080},{"AvailabilityZone":null,"Id":"10.130.6.97","Port":8080},{"AvailabilityZone":null,"Id":"10.130.80.237","Port":8080}]}

Expected outcome
I expect that the request to register the ip with the target group sets the AvailabilityZone parameter to all if the pod IP address is outside the CIDR range of the VPC of the target group instead of the VPC of the host machine.

Environment

  • AWS Load Balancer controller version
    2.4.7

  • Kubernetes version
    1.24

  • Using EKS (yes/no), if so version?
    Yes (1.24)

Additional Context:
This is where in the code the AvailabilityZone is set. My suggestion is to look at the CIDR range for the target group's VPC rather than inferring it from the VPC of the host before defaulting back to this behaviour.

if !networking.IsIPWithinCIDRs(podIP, vpcCIDRs) {
target.AvailabilityZone = awssdk.String("all")
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    lifecycle/rottenDenotes an issue or PR that has aged beyond stale and will be auto-closed.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions