Feature: Support specifying a custom subnet for L7 ILBs

[cezarsa]

Currently it's not possible to create a L7 Internal Load Balancer using Ingress objects in a subnet different from the one used for nodes. According to GKE networking best practices doc it's recommended to reserve a separated subnet for L4 ILBs and I can see that the same arguments for isolation would also hold for L7 ILBs, if that was possible.

For L4 ILBs created using a Service with type LoadBalancer, this can be done using the annotation networking.gke.io/internal-load-balancer-subnet from kubernetes/kubernetes#82257. Would it be possible for support for the same annotation to be added to Ingress objects? Another possibility would be a new field in FrontendConfig objects.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle rotten

[plgingembre]

@cezarsa, thanks for your question! I actually have a question for you, can you elaborate on the use case on your end for this option in Ingress? How are you working around that missing option today?

Thanks,
Pierre-Louis

[cezarsa]

Hey @plgingembre, since creating this feature request I moved on to a new job, working mostly with a different cloud provider. Answering based on what I remember and it's possible I'm incorrect.

I think the primary use case would be being able to create firewall rules matching a subset of L7 ILBs. Without this annotation, all L7 ILB IPs would be allocated from the node IP subnet and it would be impossible to tell at a glance if an IP belongs to a node or to an ILB.

The workaround I guess was creating individual firewall rules for each individual ILB IP, since they also didn't support network tags at the time at least.