[OCCM] Set Hostname in load balancer status when using PROXY protocol

[lingxiankong]

What this PR does / why we need it:
Related issues in other repos:

• Why kube-proxy add external-lb's address to node local iptables rule? kubernetes#66607
• DO Proxy Protocol broken header ingress-nginx#3996

In PROXY mode, set Hostname field using IP address and a suffix .nip.io to expose the Service of LoadBalancer type.

A new config option enable-ingress-hostname is introduced but may be removed in the future, please see the document change.

Which issue this PR fixes(if applicable):
fixes #1287

Special notes for reviewers:

Release note:

[openstack-cloud-controller-manager] Fixed the broken header issue when accessing the load balancer service with PROXY protocol enabled from within the cluster.

[theopenlab-ci]

Build succeeded.

• cloud-provider-openstack-sanity-test-csi-cinder : SUCCESS in 2m 50s

[theopenlab-ci]

Build succeeded.

• cloud-provider-openstack-unittest : SUCCESS in 3m 40s

[theopenlab-ci]

Build failed.

• cloud-provider-openstack-acceptance-test-lb-octavia : FAILURE in 10m 39s

[theopenlab-ci]

Build succeeded.

• cloud-provider-openstack-format : SUCCESS in 2m 26s

[theopenlab-ci]

Build succeeded.

• cloud-provider-openstack-acceptance-test-keystone-authentication-authorization : SUCCESS in 18m 19s

[theopenlab-ci]

Build succeeded.

• cloud-provider-openstack-acceptance-test-csi-manila : SUCCESS in 35m 12s

[theopenlab-ci]

Build failed.

• cloud-provider-openstack-acceptance-test-e2e-conformance-stable-branch-v1.19 : POST_FAILURE in 24m 04s

[theopenlab-ci]

Build failed.

• cloud-provider-openstack-acceptance-test-e2e-conformance-stable-branch-v1.18 : POST_FAILURE in 20m 04s

[theopenlab-ci]

Build failed.

• cloud-provider-openstack-e2e-test-csi-cinder : FAILURE in 1h 34m 22s

[lingxiankong]

/test cloud-provider-openstack-acceptance-test-lb-octavia

[k8s-ci-robot]

@lingxiankong: The specified target(s) for /test were not found.
The following commands are available to trigger jobs:

• /test pull-cloud-provider-openstack-check
• /test pull-cloud-provider-openstack-test

Use /test all to run all jobs.

In response to this:

/test cloud-provider-openstack-acceptance-test-lb-octavia

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[lingxiankong]

/test cloud-provider-openstack-acceptance-test-e2e-conformance-stable-branch-v1.19

[k8s-ci-robot]

@lingxiankong: The specified target(s) for /test were not found.
The following commands are available to trigger jobs:

• /test pull-cloud-provider-openstack-check
• /test pull-cloud-provider-openstack-test

Use /test all to run all jobs.

In response to this:

/test cloud-provider-openstack-acceptance-test-e2e-conformance-stable-branch-v1.19

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[lingxiankong]

/test cloud-provider-openstack-acceptance-test-e2e-conformance-stable-branch-v1.18

[k8s-ci-robot]

@lingxiankong: The specified target(s) for /test were not found.
The following commands are available to trigger jobs:

• /test pull-cloud-provider-openstack-check
• /test pull-cloud-provider-openstack-test

Use /test all to run all jobs.

In response to this:

/test cloud-provider-openstack-acceptance-test-e2e-conformance-stable-branch-v1.18

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[theopenlab-ci]

Build failed.

• cloud-provider-openstack-acceptance-test-lb-octavia : FAILURE in 9m 10s

[theopenlab-ci]

Build succeeded.

• cloud-provider-openstack-acceptance-test-e2e-conformance : SUCCESS in 2h 05m 32s

[theopenlab-ci]

Build succeeded.

• cloud-provider-openstack-multinode-csi-migration-test : SUCCESS in 45m 53s

[theopenlab-ci]

Build succeeded.

• cloud-provider-openstack-sanity-test-csi-cinder : SUCCESS in 2m 22s

[theopenlab-ci]

Build succeeded.

• cloud-provider-openstack-unittest : SUCCESS in 3m 42s

[theopenlab-ci]

Build failed.

• cloud-provider-openstack-acceptance-test-lb-octavia : FAILURE in 12m 52s

[lingxiankong]

/test cloud-provider-openstack-acceptance-test-lb-octavia

[k8s-ci-robot]

@lingxiankong: The specified target(s) for /test were not found.
The following commands are available to trigger jobs:

• /test pull-cloud-provider-openstack-check
• /test pull-cloud-provider-openstack-test

Use /test all to run all jobs.

In response to this:

/test cloud-provider-openstack-acceptance-test-lb-octavia

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[k8s-ci-robot]

@lingxiankong: The specified target(s) for /test were not found.
The following commands are available to trigger jobs:

• /test pull-cloud-provider-openstack-check
• /test pull-cloud-provider-openstack-test

Use /test all to run all jobs.

In response to this:

/test cloud-provider-openstack-acceptance-test-e2e-conformance-stable-branch-v1.18

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[theopenlab-ci]

Build succeeded.

• cloud-provider-openstack-acceptance-test-e2e-conformance-stable-branch-v1.20 : SUCCESS in 2h 16m 03s

[theopenlab-ci]

Build failed.

• cloud-provider-openstack-acceptance-test-e2e-conformance-stable-branch-v1.19 : POST_FAILURE in 20m 22s

[lingxiankong]

/test cloud-provider-openstack-acceptance-test-e2e-conformance-stable-branch-v1.19

[k8s-ci-robot]

@lingxiankong: The specified target(s) for /test were not found.
The following commands are available to trigger jobs:

• /test pull-cloud-provider-openstack-check
• /test pull-cloud-provider-openstack-test

Use /test all to run all jobs.

In response to this:

/test cloud-provider-openstack-acceptance-test-e2e-conformance-stable-branch-v1.19

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[theopenlab-ci]

Build failed.

• cloud-provider-openstack-acceptance-test-e2e-conformance-stable-branch-v1.19 : POST_FAILURE in 19m 57s

[lingxiankong]

/test cloud-provider-openstack-acceptance-test-e2e-conformance-stable-branch-v1.19

[k8s-ci-robot]

@lingxiankong: The specified target(s) for /test were not found.
The following commands are available to trigger jobs:

• /test pull-cloud-provider-openstack-check
• /test pull-cloud-provider-openstack-test

Use /test all to run all jobs.

In response to this:

/test cloud-provider-openstack-acceptance-test-e2e-conformance-stable-branch-v1.19

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[theopenlab-ci]

Build succeeded.

• cloud-provider-openstack-acceptance-test-e2e-conformance-stable-branch-v1.18 : SUCCESS in 1h 24m 10s

[theopenlab-ci]

Build succeeded.

• cloud-provider-openstack-acceptance-test-e2e-conformance-stable-branch-v1.19 : SUCCESS in 2h 03m 50s

[lingxiankong]

@jichenjc @ramineni please help review this PR

[ramineni]

Thanks. changes looks ok to me .
/lgtm

[jichenjc]

/approve
thanks~

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jichenjc

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [jichenjc]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[multi-io]

Looks like this breaks external-dns, which sees that status.loadBalancer.ingress[].hostname (of the service or of an ingress resource if you use an ingress controller with the service) now contains <IP>.nip.io instead of just <IP> and as a consequence deletes the A record (removing the service from DNS) and tries to create a CNAME record, which DNS APIs (only tested Openstack Designate for now, but probably true for others as well) reject because apparently RFC 1033 forbids CNAME records with the same name as other records (and external-dns already creates a TXT record with the same name).

time="2021-04-12T12:40:47Z" level=info msg="Creating records: ingresstest.scratch.io-multi.de./CNAME: 185.56.132.175.nip.io."
time="2021-04-12T12:40:47Z" level=info msg="Creating records: ingresstest.scratch.io-multi.de./TXT: \"heritage=external-dns,external-dns/owner=default,external-dns/resource=ingress/ingress-test/ingress-test\""
time="2021-04-12T12:40:48Z" level=info msg="Deleting records for ingresstest.scratch.io-multi.de./A"
time="2021-04-12T12:40:48Z" level=error msg="Bad request with: [POST https://designate.cloud.syseleven.net:9001/v2/zones/7b2f1706-e0d3-4bb3-8400-7ecc78eb463c/recordsets], error message: {\"message\": \"CNAME recordsets may not share a name with any other records\", \"code\": 400, \"type\": \"invalid_recordset_location\", \"request_id\": \"req-949d736b-1e8a-4e53-a423-3048c8da55ea\"}"

[lingxiankong]

Hi @multi-io, I'm not familiar with external-dns, but if using external-dns, I would assume the pod is using dns (rather than external IP) to access the service, so without enabling the config enable-ingress-hostname, that would work, right?

[multi-io]

Hi @lingxiankong, external-dns just connects to some external DNS service like AWS Route53 or Openstack Designate and sets up DNS records for your ingress hostnames, pointing to the LB IP. The pod looks up those names and they resolve to the LB IP, which the pod then tries to connect to, which will fail without the new enable-ingress-hostname config enabled. But with this config enabled, the status.loadBalancer.ingress[].hostname of a service or ingress resource now contains <IP>.nip.io instead of just <IP>, which causes external-DNS to try to create a CNAME record for <IP>.nip.io instead of just an A record for <IP>, and this breaks because the CNAME record clashes with a TXT record of the same name that external-dns also creates for internal purposes (storing some metadata). I've created a PR to external-DNS that circumvents this, see kubernetes-sigs/external-dns#2049 for more information.

[lingxiankong]

Thanks for the detailed clarification, I understand now.

Yes, this workaround doesn't work properly with external-dns, to fully fix this issue, we have to wait for the k8s upstream solution. I will propose a PR to add something in the doc.