[bug] Exposing RC on Talos Linux results in invalid IP range for Endpoint

[jitteryjuice]

Hello,

I am running this in a 3 node Talos Linux cluster, with the exposeRC flag set to true. I can see the Service is created, however it fails to create the Endpoints due to IP address selection:

rclone W0724 07:55:16.904971 7 nodeserver.go:573] Failed to create service for rclone RC: Endpoints "rclone-a0edcbd3-bd8a-47d1-bcaa-1c5271bc0612" is invalid: subsets[0].addresses[0].ip: Invalid value: "169.254.116.108": may not be in the link-local range (169.254.0.0/16, fe80::/10)

My nodes have a single NIC, with a Node IP, and Cilium as the CNI.

I have debugged the go function that finds addresses which for me has returned:

169.254.116.108 192.168.6.60 192.168.6.55

I suggest we should add a check for dynamically configured link-local addresses. I am happy to work up a PR that adds this if you're open to it.

[marcelofernandez]

Hi! I apologize that I didn't see this bug report before.

We're running this in EKS clusters with kube-proxy, and we've never seen this issue. In any case, 169.254.116.108 is inside the subnet range (169.254.0.0/16), so I doubt the error is actually reflecting the actual problem.

Feel free to work on any PR, of course.

[jitteryjuice]

Hey @marcelofernandez , thanks for the reply.

The error does state the endpoint IP selected (via getLocalIP()) is in the link-local range which violates the Kubernetes Endpoint requirement (i.e., not in 169.254.0.0/16). I am referencing the Kubernetes Service docs:

https://kubernetes.io/docs/concepts/services-networking/service/#custom-endpointslices:

The endpoint IPs must not be: loopback (127.0.0.0/8 for IPv4, ::1/128 for IPv6), or link-local (169.254.0.0/16 and 224.0.0.0/24 for IPv4, fe80::/64 for IPv6).

I am happy to continue this discussion if you have other ideas regarding the issue, otherwise I will raise a PR for review to address the above.

[marcelofernandez]

Oh, I see. Yes, please feel free to create a PR to filter out forbidden IPs.