Ability to set service externalTrafficPolicy & internalTrafficPolicy to Local

[yarosq]

Overview

We have some clients connecting to our databases from outside the Kubernetes cluster. By default service with type Loadbalancer set externalTrafficPolicy/internalTrafficPolicy to Cluster which mask the source IP with the Kubernetes nodes IP. In this case we can not control the access to the cluster based on source IP.

Use Case

Setting externalTrafficPolicy/internalTrafficPolicy to local allows us to preserve IPs of the client, thus we can restrict/allow access via pg_hba.

Desired Behavior

Ability to set service externalTrafficPolicy & internalTrafficPolicy to Local

kind: PostgresCluster
spec:
  service:
    externalTrafficPolicy: Local
    internalTrafficPolicy: Local
...

[benjaminjb]

Hi, sorry you're running into this, and I can definitely see how it would be necessary to adjust the services that PGO creates.

That said, for a short-term fix, could you create/manage services directly? That way you could define the service with exactly the specs that you need. (You could completely ignore the PGO-provided services or use them as models for your services, e.g., what selectors the service needs, etc.)

[benjaminjb]

I've just had another idea, but not sure it will work: PGO doesn't directly edit the externalTrafficPolicy and internalTrafficPolicy fields -- can you edit the fields of the services? And does PGO overwrite those fields if you do?

[yarosq]

I've just had another idea, but not sure it will work: PGO doesn't directly edit the externalTrafficPolicy and internalTrafficPolicy fields -- can you edit the fields of the services? And does PGO overwrite those fields if you do?

Thank you @benjaminjb
Yes that what I am using as a workaround at the moment as PGO does not update internalTrafficPolicy/externalTrafficPolicy. The only problem, it complicates the setup with CD tools such as Flux, so hoping this can be added in the future releases.

[dsessler7]

Just noting here that we have a story in our development backlog for this ability.