projectcalico/calico

select nodes to expose NodePort service in eBPF mode

Open

#5,495 opened on Jan 24, 2022

View on GitHub
 (11 comments) (0 reactions) (0 assignees)Go (1,594 forks)auto 404
area/bpfhelp wantedkind/enhancement

Repository metrics

Stars
 (7,292 stars)
PR merge metrics
 (PR metrics pending)

Description

Is it possible to select only specific nodes to expose NodePort service when we use the eBPF mode?

Expected Behavior

Calico could allow the cluster administrator to select specific nodes to expose NodePort service. In a multi-tenant environment, suppose that each tenant has its own set of dedicated worker nodes in the cluster. It should be useful to open ports only in tenant's owned nodes instead of all the cluster nodes, where also other tenants have their own nodes.

Contributor guide

Research direction
Investigate how Calico's eBPF mode currently handles NodePort services and design a mechanism to allow node selection via annotations or configuration. Look at the existing NodePort handling code in the eBPF data plane and identify where node filtering can be applied.
Tech stack
gokubernetes
Domain
networking
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
GoKubernetes networkingeBPF
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
30