Skip to content

Derive load balancer IP from manually provisioned certificates #302

Open

Description

@nightkr

(For other SBLE staff, see https://stackable.atlassian.net/browse/SUP-187)

Currently, we support nudging NodePort services onto Nodes that have certificates provisioned, but we don't support anything similar for LoadBalancer services. That can make them difficult to use for short-lived listeners (like Kafka broker (non-bootstrap) listeners) if you require manually provisioned certificates.

Activity

  1. nightkr commented on Apr 25, 2025

    @nightkr
    ContributorAuthor

    As a workaround, Kubernetes can be configured to avoid deleting the Listener object by attaching a secondary owner beyond the PVC:

    kubectl create configmap simple-kafka-broker-listener-owner
    for listener in simple-kafka-broker-default-{0..2}-listener-broker; do
      kubectl get listener/$listener -o json \
        | jq '.metadata.ownerReferences += [$owner | {apiVersion, kind, name: .metadata.name, uid: .metadata.uid}]' \
          --argjson owner "$(kubectl get cm/simple-kafka-broker-listener-owner -o json)" \
        | kubectl replace -f-
    done

    When doing this, don't use a SDP-managed resource (like a KafkaCluster) as the owner, since SDP operators will delete any child objects that it doesn't recognize as having created.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions