Wrong validation regex for service.beta.kubernetes.io/do-loadbalancer-allow-rules

[FabrizioFubelli]

My configuration:

apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    service.beta.kubernetes.io/do-loadbalancer-allow-rules: "cidr:103.21.244.0/22,cidr:103.22.200.0/22,cidr:103.31.4.0/22,cidr:104.16.0.0/13"
  name: ingress-nginx-controller
  namespace: ingress-nginx
spec:
  externalTrafficPolicy: Local
  ipFamilies:
    - IPv4
  ipFamilyPolicy: SingleStack
  ports:
    - appProtocol: http
      name: http
      port: 80
      protocol: TCP
      targetPort: http
    - appProtocol: https
      name: https
      port: 443
      protocol: TCP
      targetPort: https
  selector:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  type: LoadBalancer

Output of kubectl apply:

The Service "ingress-nginx-controller" is invalid: 
* metadata.labels: Invalid value: "cidr:103.21.244.0/22,cidr:103.22.200.0/22,cidr:103.31.4.0/22,cidr:104.16.0.0/13": must be no more than 63 characters
* metadata.labels: Invalid value: "cidr:103.21.244.0/22,cidr:103.22.200.0/22,cidr:103.31.4.0/22,cidr:104.16.0.0/13": a valid label must be an empty string or consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyValue',  or 'my_value',  or '12345', regex used for validation is '(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?')

I would like to add all Cloudflare IP Ranges, but it's not possible with these limitations.

[collimarco]

Probably related: https://github.com/digitalocean/digitalocean-cloud-controller-manager/issues/692

Any updates on this?

[timoreimann]

We may need to support specifying the allow list through the canonical Service field which supposedly does not have length limitations.

#584 was opened some time ago, which we should get back to.

[timoreimann]

CCM now supports the loadBalancerSourceRanges field for specifying allowed IP addresses, which should work better and is not subject to annotation-specific length limitation.

Closing ticket, please reopen a new one if problems are (still / newly) faced on the field.