Add frontend-nlb-private-ipv4-addresses annotation for internal NLB static IPs - #4867
Add frontend-nlb-private-ipv4-addresses annotation for internal NLB static IPs#4867danny6212000 wants to merge 2 commits into
Conversation
…tatic IPs This adds support for assigning static private IPv4 addresses to an internal frontend NLB via a new annotation: alb.ingress.kubernetes.io/frontend-nlb-private-ipv4-addresses The implementation mirrors the existing EIP allocation annotation: - Validates that the scheme is internal - Validates IPv4 address format - Checks mutual exclusivity with EIP allocations - Matches address count to subnet count Includes unit tests and documentation updates.
|
|
|
Welcome @danny6212000! |
kubernetes-prow
Bot
added
cncf-cla: no
|
Hi @danny6212000. Thanks for your PR. I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
kubernetes-prow
Bot
added
the
size/L
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: danny6212000 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
kubernetes-prow
Bot
added
cncf-cla: yes
wweiwei-li
added
ok-to-test
There was a problem hiding this comment.
Pull request overview
This pull request adds support for configuring static private IPv4 addresses for internal frontend NLBs created by the ingress model builder, via a new Ingress annotation. This extends the existing “frontend NLB” feature to cover internal static addressing needs (similar to the existing EIP support for internet-facing frontend NLBs).
Changes:
- Add parsing/validation for
alb.ingress.kubernetes.io/frontend-nlb-private-ipv4-addressesand plumb values into NLB subnet mappings. - Enforce mutual exclusivity between
frontend-nlb-eip-allocationsand the new private IPv4 annotation, and validate scheme/count/IP format. - Add unit tests and documentation entries for the new annotation.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| pkg/ingress/model_build_frontend_nlb.go | Implements new annotation parsing/validation and sets SubnetMapping.PrivateIPv4Address for internal frontend NLBs. |
| pkg/ingress/model_build_frontend_nlb_test.go | Adds unit tests covering core private IPv4 behaviors (happy path + validation failures). |
| pkg/annotations/constants.go | Introduces the new annotation suffix constant. |
| docs/guide/ingress/annotations.md | Documents the new annotation and adds it to the annotations index table. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| - If you include the subnets [annotation](#frontend-nlb-subnets) it must have the same number of subnets as this annotation has addresses | ||
| - NLB must be internal (scheme must be `internal`) | ||
| - Mutually exclusive with [frontend-nlb-eip-allocations](#frontend-nlb-eip-allocations) | ||
| - Each address must be a valid IPv4 address within the respective subnet's CIDR range |
There was a problem hiding this comment.
can we add the cidr range check instead?
There was a problem hiding this comment.
@oliviassss HI,Thanks for the review! Done in fc5c620. Added CIDR range validation using the same pattern as the service NLB implementation (networking.GetSubnetAssociatedIPv4CIDRs + FilterIPsWithinCIDRs). The controller auto-matches each IP to its corresponding subnet via CIDR.
Also added unit tests for:
- Ingress group consistency conflict (different addresses across group members → error)
- CIDR mismatch (IP not within any subnet's CIDR → error)
Manually re-validated on EKS (ap-northeast-2) with the updated image — tested correct CIDR matching (reversed IP order), out-of-CIDR rejection, and duplicate-subnet detection. All working as expected.
| for _, privateIPv4Addresses := range privateIPv4AddressesList[1:] { | ||
| if !cmp.Equal(chosenPrivateIPv4Addresses, privateIPv4Addresses, equality.IgnoreStringSliceOrder()) { | ||
| return nil, errors.Errorf("all private IPv4 addresses for the ingress group must be the same: %v | %v", chosenPrivateIPv4Addresses, privateIPv4Addresses) | ||
| } |
…tency test - Use CIDR-based matching (same pattern as service NLB) instead of index-based mapping. Address ordering no longer matters. - Validate each private IPv4 address falls within a subnet CIDR using networking.GetSubnetAssociatedIPv4CIDRs + FilterIPsWithinCIDRs. - Add unit test: ingress group members with different addresses → error. - Add unit test: IP not within subnet CIDR → error. - Update mock subnets with CidrBlock for CIDR validation.
Description
When frontend NLB is configured as internal via
alb.ingress.kubernetes.io/frontend-nlb-scheme: "internal", there is currently no way to assign static private IPv4 addresses to the NLB. This is neededfor scenarios where downstream consumers require stable IP addresses for allowlisting or DNS configuration.
This PR adds a new annotation:
alb.ingress.kubernetes.io/frontend-nlb-private-ipv4-addresses: "10.0.1.10, 10.0.2.10"The implementation mirrors the existing
frontend-nlb-eip-allocationsannotation:internalfrontend-nlb-eip-allocationsThe annotation is opt-in and has no effect on existing configurations.
Fixes #4857
Validation
format
pkg/ingress/test suite passesaddresses (
10.99.1.100,10.99.2.100) confirmed viaaws elbv2 describe-load-balancersChecklist