Extend servicePublishingStrategies in HostedCluster configuration

[mihivagyok]

Today, Hypershift offers the following kind of servicePublishingStrategies in the HostedCluster configuration.

• NodePort
• LoadBalancer
• Route
• S3
• None

And the following services can be exposed:

• APIServer
• Konnectivity
• OAuthServer
• Ignition

Our goal is to expose these services using Hostname and Port (default: 443). In our use-case, the HostedControlPlaneOperator would create a clusterIP service on the control plane and a custom solution would be implemented to integrate this behavior.

Example configuration:

apiVersion: hypershift.openshift.io/v1alpha1
kind: HostedCluster
metadata:
  name: clusterid
spec:
  services:
    - service: APIServer
      servicePublishingStrategy:
        type: ClusterIP
        clusterIP:
          hostname: clusterid.api.example.com
          port: 443
    - service: Konnectivity
      servicePublishingStrategy:
        type: ClusterIP
        clusterIP:
          hostname: clusterid.tunnel.example.com
          port: 443

The traffic flow would look like this:

Load Balancer listens on 443 ----> Ingress gateway (SNI based routing, TLS passthru) ----> ClusterIP service ----> Application (TLS termination)

As user services are running in the data plane (e.g. ha-proxy (for kube-api), konnectivity-agent (konnectivity), etc), the HostedClusterConfigOperator would configure these components with the Hostname and Port set in the servicePublishingStrategy configuration.

That's why our suggestion is to add new servicePublishingStrategy called "ClusterIP".

• it would create a ClusterIP service for the application
• on data plane, it would configure the applications with Hostname and Port parameter (e.g. konnectivity-agent)
• hostname and port would be validated. It would align with existing DNS best practices or standards (e.g., RFC 1123)
• default port would be 443
• empty hostname would be mean invalid configuration

Testing:

• the change would be backward compatible
• it would be directly additive new servicePublishingStrategy
• Unit tests
• Manual integration tests
• Would decide on further automated testing as it requires additional networking solution to test it

Plese share your thoughts. Thanks!