Skip to content

feat(vpn): move the vpn app off Service.spec.externalIPs onto CiliumLoadBalancerIPPool #2477

New issue
New issue
Open
Open
feat(vpn): move the vpn app off Service.spec.externalIPs onto CiliumLoadBalancerIPPool#2477
Labels
area/ciliumIssues or PRs related to Cilium (agent, operator, Gateway API, network policy, LB-IPAM)area/networkingIssues or PRs related to networking (ingress, gateway, vpn, metallb, kube-ovn)kind/featureCategorizes issue or PR as related to a new featurelifecycle/frozenIndicates that an issue or PR should not be auto-closed due to stalenesspriority/important-longtermImportant over the long term, but may not be staffed and/or may need multiple releases to completetriage/acceptedIndicates an issue is ready to be actively worked on

Description

@lexfrei
Aleksei Sviridkin (lexfrei)
opened on Apr 24, 2026

Context

KEP-5707 deprecates Service.spec.externalIPs. Timeline:

  • v1.36 — AllowServiceExternalIPs feature gate introduced with a warning on use.
  • v1.40 — feature gate defaults to off.
  • v1.43 — field removal.

#2468 moved ingress-nginx onto a CiliumLoadBalancerIPPool-backed mode gated by publishing.exposure=loadBalancer, but packages/apps/vpn/templates/service.yaml still writes externalIPs directly. The vpn app will break once the feature gate flips.

Work

Port the #2468 pattern to the vpn chart:

  • Add a loadBalancer exposure mode to the vpn Service, rendered as a Service of type LoadBalancer plus a CiliumLoadBalancerIPPool scoped to the vpn Service via serviceSelector.
  • Keep externalIPs as the default for backwards compat; flip the default in a later release once the rest of the platform migration is done.
  • Fail render if loadBalancer mode is selected with no external IP list (same guard as feat(ingress): add loadBalancer exposure mode via CiliumLoadBalancerIPPool #2468).

Scope

Fairly mechanical — the pattern is fully worked out in #2468 and was recently ported to packages/extra/gateway/templates/cilium-lb-pool.yaml as part of #2470. Needs unit tests and a bats smoke to assert the Service stays functional after the flip.

Activity

  1. dosubot
    added
    kind/featureCategorizes issue or PR as related to a new feature
    on Apr 24, 2026

  2. dosubot commented on Jul 24, 2026

    @dosubot
    dosubotBot
    on Jul 24, 2026 – with DosuBot

    Hi, Aleksei Sviridkin (@lexfrei). I'm Dosu, and I'm helping the cozystack team manage their backlog and am marking this issue as stale.

    Issue Summary

    • The vpn chart currently templates Service.spec.externalIPs directly.
    • This will become problematic once Kubernetes removes support for that field.
    • I requested a loadBalancer exposure mode, similar to the ingress-nginx/CiliumLoadBalancerIPPool approach, while keeping externalIPs as the default for now.
    • I also asked for tests and a render guard so the chart does not emit invalid output when no external IPs are configured.

    Next Steps

    • Please let us know if this is still relevant on the latest version of the cozystack repository; if it is, you can keep the discussion open by commenting here.
    • Otherwise, this issue will be automatically closed in 7 days.

    Thanks for your understanding and contribution.

  3. dosubot
    added
    stale
    on Jul 24, 2026
  4. github-actions
    added
    lifecycle/staleDenotes an issue or PR has remained open with no activity and has become stale
    and removed
    stale
    on Jul 27, 2026
  5. github-actions
    added
    triage/needs-triageIndicates an issue needs triage by a maintainer
    on Aug 12, 2026
  6. Aleksei Sviridkin (lexfrei)
    added
    area/ciliumIssues or PRs related to Cilium (agent, operator, Gateway API, network policy, LB-IPAM)
    on Aug 19, 2026
  7. Aleksei Sviridkin (lexfrei)
    added
    area/networkingIssues or PRs related to networking (ingress, gateway, vpn, metallb, kube-ovn)
    triage/acceptedIndicates an issue is ready to be actively worked on
    priority/important-longtermImportant over the long term, but may not be staffed and/or may need multiple releases to complete
    lifecycle/frozenIndicates that an issue or PR should not be auto-closed due to staleness
    and removed
    lifecycle/staleDenotes an issue or PR has remained open with no activity and has become stale
    triage/needs-triageIndicates an issue needs triage by a maintainer
    on Sep 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area/ciliumIssues or PRs related to Cilium (agent, operator, Gateway API, network policy, LB-IPAM)area/networkingIssues or PRs related to networking (ingress, gateway, vpn, metallb, kube-ovn)kind/featureCategorizes issue or PR as related to a new featurelifecycle/frozenIndicates that an issue or PR should not be auto-closed due to stalenesspriority/important-longtermImportant over the long term, but may not be staffed and/or may need multiple releases to completetriage/acceptedIndicates an issue is ready to be actively worked on

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions