cloudflare / cloudflare-ingress-controller

A Kubernetes ingress controller for Cloudflare's Argo Tunnels
Apache License 2.0
364 stars 55 forks source link

hostname duplication without use of a load-balancer results in recreation #163

Open mattalberts opened 5 years ago

mattalberts commented 5 years ago

If an Ingress or two Ingresses present more than one route for a hostname without marking use of a load-balancer, two separate tunnels with the same hostname will attempt to be created. However, this conditions violates argo-tunnel constraints (it is the exact use-case for a load-balancer, to route traffic to two distinct origins). The condition will cause the tunnels to re-create each other as creating one will disconnect the other (its a j/k flip-flop of sorts). The repair cycle can lead to the account being rate-limited.

The goal of the ticket is to prevent this condition internally by blocking tunnel creation is an existing tunnel for the hostname exists and all references to not carry a load-balancer. The protection is very limited and could easily be violated by network splits or watch segmentation.