Initial VPC Endpoint Service (Private Link) Interface

[rifelpet]

This adds a stubbed interface for VPC Endpoint Service support. This was mostly copied from the security group implementation since I view them as similar auxiliary resources to the main loadbalancer/listener/targetgroup resource types.

A few discussion topics and notes for the future implementation:

• Should the controller detach other NLBs or GWLBs besides the Service's NLB?
• I haven't checked whether Endpoint Services are supported in all regions and partitions, but I anticipate the new addon CLI flag should be sufficient if not.
• EndpointServices can't be deleted if they're currently used by an interface Endpoint in another VPC, should this block the finalizer on k8s Service deletion?
• We'll want to decide on how to expose the DNS verification information (record name, type, and value). If we choose to use annotations, I believe this would be the first case of the controller writing annotations back to the resource so we would need to think through the implications of doing so. If we can define the records in a way compatible with external-dns that would be ideal.
• I plan on including the same tags as on the NLB itself and using them in the tagging filter of DescribeVpcEndpointServiceConfigurations to find existing endpoint services.
• The AWS docs recommend exposing Endpoint Services in all AZs of the region which requires the NLB be configured for a subnet in every AZ, this is probably worth mentioning in the docs.

ref: https://github.com/kubernetes-sigs/aws-load-balancer-controller/issues/1859

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: rifelpet To complete the pull request process, please assign m00nf1sh after the PR has been reviewed. You can assign the PR to them by writing /assign @m00nf1sh in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment Approvers can cancel approval by writing /approve cancel in a comment

[rifelpet]

/cc @M00nF1sh

[codecov-commenter]

Codecov Report

Merging #1948 (f840443) into main (6f4cbbf) will decrease coverage by 0.24%. The diff coverage is 8.88%.

@@            Coverage Diff             @@
##             main    #1948      +/-   ##
==========================================
- Coverage   53.51%   53.27%   -0.25%     
==========================================
  Files         142      147       +5     
  Lines        8040     8085      +45     
==========================================
+ Hits         4303     4307       +4     
- Misses       3415     3455      +40     
- Partials      322      323       +1     

Impacted Files	Coverage Δ
pkg/config/addons_config.go	0.00% <0.00%> (ø)
pkg/deploy/ec2/endpoint_service_manager.go	0.00% <0.00%> (ø)
pkg/deploy/ec2/endpoint_service_synthesizer.go	0.00% <0.00%> (ø)
pkg/deploy/stack_deployer.go	0.00% <0.00%> (ø)
pkg/networking/vpc_endpoint_service_info.go	0.00% <0.00%> (ø)
pkg/networking/vpc_endpoint_service_manager.go	0.00% <0.00%> (ø)
pkg/service/model_builder.go	86.02% <60.00%> (-1.48%)	:arrow_down:
pkg/service/model_build_endpoint_service.go	100.00% <100.00%> (ø)

---

Continue to review full report at Codecov.

Legend - Click here to learn more Δ = absolute <relative> (impact), ø = not affected, ? = missing data Powered by Codecov. Last update 6f4cbbf...f840443. Read the comment docs.

[rifelpet]

/test all

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[rifelpet]

/remove-lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[seh]

/remove-lifecycle stale

[hintofbasil]

Hi @rifelpet,

My work is very interested in getting this functionality added in. Is there anything we can do to help you push this feature over the line?

[rifelpet]

I'm likely not going to continue working on this but as it stands the maintainers and EKS team were going to review the interface proposal and then someone can begin the implementation work. It looks like it has been bumped out to 2.5.0 so I'm not sure how soon the review will occur.

[hintofbasil]

Thanks for the context. We will bring this up with AWS ourselves. If we decide that we need this feature before AWS can provide it do you mind if we build on top of your existing work?

[rifelpet]

Go ahead 👍🏻

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[seh]

/remove-lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[seh]

/remove-lifecycle rotten

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

• Reopen this PR with /reopen
• Mark this PR as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

[k8s-ci-robot]

@k8s-triage-robot: Closed this PR.

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

• Reopen this PR with /reopen
• Mark this PR as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.