Exposing deployment as ClusterIP and ExternalIP in Kubernetes/Openshift

1/8/2021

Our Openshift cluster created with a following definition in network/cluster :

spec:
  clusterNetwork:
  - cidr: 10.0.0.0/23
    hostPrefix: 26
  externalIP:
    autoAssignCIDRs:
    - 10.10.0.0/24
  networkType: Calico
  serviceNetwork:
  - 10.20.0.0/24

I am wondering if it possible to create service type ClusterIP (not LoadBalancer) and have ExternalIP automatically assigned to it ?

In case service defined as a LoadBalancer ( oc create svc loadblanacer my-service --tcp=80 ) auto-assignement works fine, however it expose the NodePort , which we are trying to avoid.

I can specify ExternalIP manually like oc expose deploy my-deployment --external-ip="10.10.0.100 --port=80" , but trying to figure out if it can be done automatically.

-- Andy
kubernetes
openshift

1 Answer

1/9/2021

Unfortunately, ExternalIPs field cannot be auto-filled under the ClusterIP service type. ClusterIP is designed for internal access only. The workaround in your case is not an intended behavior so it cannot be handled by the Service controller automatically.

Luckily saying, the issue you want to fix under the LoadBalancer type is a well-discussed issue in the community. A new patch has been merged into the latest Kubernetes code base.

Under the 1.20 CHANGELOG, you can see a change here.

Automatic allocation of NodePorts for services with type LoadBalancer can now be disabled by setting the (new) parameter Service.spec.allocateLoadBalancerNodePorts=false. The default is to allocate NodePorts for services with type LoadBalancer which is the existing behavior. (#92744, @uablrek) SIG Apps and Network

So, when you upgrade your cluster to Kubernetes v1.20 and apply something like this.

apiVersion: v1
kind: Service
metadata:
  name: example-service
spec:
  selector:
    app: example
  ports:
    - port: 8765
      targetPort: 9376
  allocateLoadBalancerNodePorts: false
  type: LoadBalancer

The node port allocation will be disabled and you can fix your issue without any hacky approach.

-- Ryan Siu
Source: StackOverflow