Bug report: When `cilium clustermesh connect`, DNS resolution fails if the NLB of ClusterMesh API Server is in Private Network

[kahirokunn]

Bug report

General Information

• Cilium CLI version (run cilium version) cilium-cli: 0.13.2 compiled with go1.20.2 on darwin/arm64 cilium image (default): v1.13.1 cilium image (stable): v1.13.1 cilium image (running): v1.13.1

• Orchestration system version in use (e.g. kubectl version, ...)

• Platform / infrastructure information AWS・EKS

• Link to relevant artifacts (policies, deployments scripts, ...)

• Generate and upload a system zip: cilium sysdump

How to reproduce the issue

You can check the error by preparing two clusters built with the following values in Helm.

clustermesh:
  apiserver:
    service:
      annotations:
        service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
        service.beta.kubernetes.io/aws-load-balancer-internal: "true"
      type: LoadBalancer
      externalTrafficPolicy: Local

Solution

The Private IPs of CLB and NLB can be obtained by executing the following command.

If you could not get the IP, you can do it for each vendor. For example, in case of AWS, you can get the Private IP without going through DNS by doing the following.

Reference: https://dev.classmethod.jp/articles/check_elb_private_ip/

NLB

NLB_NAME=fugafuga
NLB_ID=$(aws elbv2 describe-load-balancers --name "$NLB_NAME" --query "LoadBalancers[].[LoadBalancerName,LoadBalancerArn]" --output json | jq '.[0][1] | match("^.*/(net/.*)$").captures[0].string' --raw-output)

aws ec2 describe-network-interfaces --filters Name=description,Values="ELB $NLB_ID" --query 'NetworkInterfaces[*].PrivateIpAddresses[*].PrivateIpAddress' --output text

Result

10.0.17.3
10.0.44.4
10.0.5.5

CLB

CLB_NAME=hogehoge
aws ec2 describe-network-interfaces --filters Name=description,Values="ELB $CLB_NAME" --query 'NetworkInterfaces[*].PrivateIpAddresses[*].PrivateIpAddress' --output text

Whether the deployed LB is NLB or CLB is included in the ELB information.

[reoring]

I have same issues.

[github-actions[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.

[github-actions[bot]]

This issue has not seen any activity since it was marked stale. Closing.

[kahirokunn]

/reopen