vrr/cozystack
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[vm-instance] Set wholeIP annotation conditionally on externalMethod

Browse source 
Render `networking.cozystack.io/wholeIP: "false"` on the Service when
`externalMethod: PortList` is configured (was always `"true"` before).
Combined with cozy-proxy v0.3.0+ which adds per-port filtering for
"false"-annotated services, this makes `externalMethod: PortList`
behave as documented: only ports listed in `externalPorts` are
reachable from the LoadBalancer IP.

Backward-compatible: existing services with `externalMethod: WholeIP`
continue to set `wholeIP: "true"` and behave identically. cozy-proxy
versions older than v0.3.0 ignore Services with `wholeIP: "false"`,
which means PortList Services on older cozy-proxy will lose their
egress IP preservation — but that path was already non-functional
ingress-wise, so this is not a regression for users actually relying
on PortList.

Signed-off-by: mattia-eleuteri <mattia@hidora.io>
This commit is contained in:
mattia-eleuteri 2026-04-27 16:29:05 +02:00
parent bdf23e66d1
commit 80631bc916
No known key found for this signature in database
2 changed files with 12 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
docs/changelogs/v1.3.1.md Normal file
View file

@ -0,0 +1,11 @@
<!--
https://github.com/cozystack/cozystack/releases/tag/v1.3.1
-->
## Bug Fixes
* **[vm-instance] Fix `externalMethod: PortList` not filtering ingress ports**: The `vm-instance` chart now sets `networking.cozystack.io/wholeIP: "false"` on the rendered Service when `externalMethod: PortList` is configured, signaling cozy-proxy to install per-port ingress filtering based on `Service.spec.ports`. Previously the annotation was always `"true"`, which kept cozy-proxy in whole-IP passthrough mode and made `PortList` non-functional. **Requires cozy-proxy v0.3.0 or later** (bundled with this chart). ([@mattia-eleuteri](https://github.com/mattia-eleuteri) in #<TBD>).
---
**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.3.0...v1.3.1

2
packages/apps/vm-instance/templates/service.yaml
View file

@ -9,7 +9,7 @@ metadata:
{{- if .Values.external }}
service.kubernetes.io/service-proxy-name: "cozy-proxy"
annotations:
networking.cozystack.io/wholeIP: "true"
networking.cozystack.io/wholeIP: {{ ternary "true" "false" (eq .Values.externalMethod "WholeIP") | quote }}
{{- end }}
spec:
type: {{ ternary "LoadBalancer" "ClusterIP" .Values.external }}