Feature: Allow same load balancer for control plane and workloads

[ctholho]

Would it be possible to add an option that toggles if you would want to use the load balancer also as control plane load balancer? Which would mean that the normal load balancer also gets port 6443 and other related configs from a dedicated control plane load balancer.

Are there good reasons not to allow it? I would try myself on a PR if people are not too concerned about this set up.

[captnCC]

An interesting idea to save some cost for HA setups.

Yet it has a major catch, since the control plane load-balancer is managed by terraform and the ingress load-balancer by the ccm. So we can't just add the port to it for the kube-api. The only solution I see right now, is to publish the kube-api service via ingress.

If you find a solution to realise it this way, please share! Since this would be only done at Kubernetes level, it should be easily be switched on/off or be provided as an example

[ifeulner]

I think the load balancer will not be created by the ccm if it is already available / referenced via a name. For this it's necessary to set the "load-balancer.hetzner.cloud/nameannotation to the ingress controller.
Have't tried it yet though...

[mysticaltech]

@captnCC I think it's doable to actually reach the kube-api, via the LB if we use Traefik, and create an IngressRoute. I think the way that we already communicate with the Hetzner LB with proxy protocol will make this really easy.

A route definition like that one could be given a shot:

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: api-ingress-route
spec:
  entryPoints:
    - web
  routes:
  - match: Host(`api.example.com`)
    kind: Rule
    services:
    - name: api
      port: 6443

[captnCC]

This looks good! We would have a few prerequisites for this:

• A working domain to the cluster (maybe the load-balancer hostname) with set A/AAAA Records
• A working TLS setup (cert-manager with http/dns issuer)

[mysticaltech]

@captnCC Exactly! That's why it's maybe best to have a guide in the example folder on how to get there, instead of implementing it ourselves.