Merge pull request #5279 from juanluisvaladas/cplb-usrp

CPLB userspace reverse proxy load balancer

.golangci.yml

@@ -118,3 +118,9 @@ issues:
     - linters:
         - staticcheck
       text: "^SA1019:"
+
+    # tcpproxy is copied from https://github.com/inetaf/tcpproxy/, as per
+    # Apache 2.0 license section 4 (Redistribution) we must keep the original header.
+    - path: "pkg/component/controller/cplb/tcpproxy/.*"
+      linters:
+        - goheader

cmd/controller/controller.go

@@ -47,6 +47,7 @@ import (
 	"github.com/k0sproject/k0s/pkg/component/controller/cplb"
 	"github.com/k0sproject/k0s/pkg/component/controller/leaderelector"
 	"github.com/k0sproject/k0s/pkg/component/controller/workerconfig"
+	"github.com/k0sproject/k0s/pkg/component/iptables"
 	"github.com/k0sproject/k0s/pkg/component/manager"
 	"github.com/k0sproject/k0s/pkg/component/prober"
 	"github.com/k0sproject/k0s/pkg/component/status"
@@ -239,11 +240,24 @@ func (c *command) start(ctx context.Context) error {
 	// Assume a single active controller during startup
 	numActiveControllers := value.NewLatest[uint](1)
 
+	nodeComponents.Add(ctx, &iptables.Component{
+		IPTablesMode: c.WorkerOptions.IPTablesMode,
+		BinDir:       c.K0sVars.BinDir,
+	})
+
+	enableK0sEndpointReconciler := nodeConfig.Spec.API.ExternalAddress != "" &&
+		!slices.Contains(c.DisableComponents, constant.APIEndpointReconcilerComponentName)
+
 	if cplbCfg := nodeConfig.Spec.Network.ControlPlaneLoadBalancing; cplbCfg != nil && cplbCfg.Enabled {
 		if c.SingleNode {
 			return errors.New("control plane load balancing cannot be used in a single-node cluster")
 		}
 
+		if enableK0sEndpointReconciler {
+			enableK0sEndpointReconciler = false
+			logrus.Warn("Disabling k0s endpoint reconciler as it is incompatible with control plane load balancing")
+		}
+
 		nodeComponents.Add(ctx, &cplb.Keepalived{
 			K0sVars:         c.K0sVars,
 			Config:          cplbCfg.Keepalived,
@@ -255,8 +269,6 @@ func (c *command) start(ctx context.Context) error {
 	}
 
 	enableKonnectivity := !c.SingleNode && !slices.Contains(c.DisableComponents, constant.KonnectivityServerComponentName)
-	enableK0sEndpointReconciler := nodeConfig.Spec.API.ExternalAddress != "" &&
-		!slices.Contains(c.DisableComponents, constant.APIEndpointReconcilerComponentName)
 
 	if enableKonnectivity {
 		nodeComponents.Add(ctx, &controller.Konnectivity{
@@ -666,6 +678,7 @@ func (c *command) startWorker(ctx context.Context, profile string, nodeConfig *v
 	wc.TokenArg = bootstrapConfig
 	wc.WorkerProfile = profile
 	wc.Labels = append(wc.Labels, fields.OneTermEqualSelector(constant.K0SNodeRoleLabel, "control-plane").String())
+	wc.DisableIPTables = true
 	if !c.SingleNode && !c.NoTaints {
 		key := path.Join(constant.NodeRoleLabelNamespace, "master")
 		taint := fields.OneTermEqualSelector(key, ":NoSchedule")

cmd/worker/worker.go

@@ -149,11 +149,12 @@ func (c *Command) Start(ctx context.Context) error {
 		c.WorkerProfile = "default-windows"
 	}
 
-	componentManager.Add(ctx, &iptables.Component{
-		IPTablesMode: c.WorkerOptions.IPTablesMode,
-		BinDir:       c.K0sVars.BinDir,
-	})
-
+	if !c.DisableIPTables {
+		componentManager.Add(ctx, &iptables.Component{
+			IPTablesMode: c.WorkerOptions.IPTablesMode,
+			BinDir:       c.K0sVars.BinDir,
+		})
+	}
 	componentManager.Add(ctx,
 		&worker.Kubelet{
 			CRISocket:           c.CriSocket,