Chapter 11. Configuring an egress service

Procedure

1. Create an IPAddressPool CR with the desired IP for the service:

   1. Create a file, such as ip-addr-pool.yaml, with content like the following example:

      apiVersion: metallb.io/v1beta1
      kind: IPAddressPool
      metadata:
        name: example-pool
        namespace: metallb-system
      spec:
        addresses:
        - 172.19.0.100/32

      Copy to Clipboard Toggle word wrap

   2. Apply the configuration for the IP address pool by running the following command:

      $ oc apply -f ip-addr-pool.yaml

      Copy to Clipboard Toggle word wrap

2. Create Service and EgressService CRs:

   1. Create a file, such as service-egress-service.yaml, with content like the following example:

      apiVersion: v1
      kind: Service
      metadata:
        name: example-service
        namespace: example-namespace
        annotations:
          metallb.io/address-pool: example-pool 

      1

      
      spec:
        selector:
          app: example
        ports:
          - name: http
            protocol: TCP
            port: 8080
            targetPort: 8080
        type: LoadBalancer
      ---
      apiVersion: k8s.ovn.org/v1
      kind: EgressService
      metadata:
        name: example-service
        namespace: example-namespace
      spec:
        sourceIPBy: "LoadBalancerIP" 

      2

      
        nodeSelector: 

      3

      
          matchLabels:
            node-role.kubernetes.io/worker: ""

      Copy to Clipboard Toggle word wrap

      1

      The LoadBalancer service uses the IP address assigned by MetalLB from the example-pool IP address pool.

      2

      This example uses the LoadBalancerIP value to assign the ingress IP address of the LoadBalancer service as the source IP address of egress traffic.

      3

      When you specify the LoadBalancerIP value, a single node handles the LoadBalancer service’s traffic. In this example, only nodes with the worker label can be selected to handle the traffic. When a node is selected, OVN-Kubernetes labels the node in the following format egress-service.k8s.ovn.org/<svc-namespace>-<svc-name>: "".

      Note

      If you use the sourceIPBy: "LoadBalancerIP" setting, you must specify the load-balancer node in the BGPAdvertisement custom resource (CR).

   2. Apply the configuration for the service and egress service by running the following command:

      $ oc apply -f service-egress-service.yaml

      Copy to Clipboard Toggle word wrap

3. Create a BGPAdvertisement CR to advertise the service:

   1. Create a file, such as service-bgp-advertisement.yaml, with content like the following example:

      apiVersion: metallb.io/v1beta1
      kind: BGPAdvertisement
      metadata:
        name: example-bgp-adv
        namespace: metallb-system
      spec:
        ipAddressPools:
        - example-pool
        nodeSelectors:
        - matchLabels:
            egress-service.k8s.ovn.org/example-namespace-example-service: "" 

      1

      Copy to Clipboard Toggle word wrap

      1

      In this example, the EgressService CR configures the source IP address for egress traffic to use the load-balancer service IP address. Therefore, you must specify the load-balancer node for return traffic to use the same return path for the traffic originating from the pod.

Verification

1. Verify that you can access the application endpoint of the pods running behind the MetalLB service by running the following command:

   $ curl <external_ip_address>:<port_number> 

   1

   Copy to Clipboard Toggle word wrap

   1

   Update the external IP address and port number to suit your application endpoint.

2. If you assigned the LoadBalancer service’s ingress IP address as the source IP address for egress traffic, verify this configuration by using tools such as tcpdump to analyze packets received at the external client.