fix(lb): prevent empty backend pools on IPAM failures

[andreaswachs]

Summary

Prevents load balancer backend pools from being emptied when IPAM data is unavailable during node initialization.

Changes:

• Add IPAM fallback query when node InternalIPs are empty
• Refuse to clear existing backends when no replacement IPs are found
• Use internal IPs when service annotation scw-loadbalancer-pn-ids is set (not just global PN_ID env var)

This has been manually tested to work by:

• Deploying a Scaleway CCM container with these changes
• Manually removed all backends from the LB fronting our LoadBalancer type K8s service
• Waited and validated that the node IPs are added back ✅

[Tomy2e]

Hello, thanks for your contribution.

There was already a fix in #175 to handle internal IPs being missing during node initialization. It requires the node.cloudprovider.kubernetes.io/uninitialized taint to be present on the node. Do you start kubelet with the --cloud-provider=external flag?

[jtherin]

extractNodesInternalIps() return all private ips, but it can contains ips from pns not from pnIDs.
so in the case of this annotation, I think it would be better to not use extractNodesInternalIps ?

[andreaswachs]

Thanks for the comment - that makes sense.

I have updated the PR to make it work without the function

[andreaswachs]

Hello, thanks for your contribution.

There was already a fix in #175 to handle internal IPs being missing during node initialization. It requires the node.cloudprovider.kubernetes.io/uninitialized taint to be present on the node. Do you start kubelet with the --cloud-provider=external flag?

Thank you!

Yes, we start the kubelet with said flag

[Tomy2e]

Is this PR still needed if we update this

scaleway-cloud-controller-manager/scaleway/instances.go

Lines 238 to 239 in 8cbe826

	klog.Warningf("error getting IPs for private NIC %s on node %s: %v", pNIC.ID, server.Name, err)
	continue

to be:

return addresses, fmt.Errorf("unable to query ipam for node %s: %v", server.Name, err)

And also

scaleway-cloud-controller-manager/scaleway/instances.go

Line 184 in 8cbe826

klog.Warningf("error getting private network addresses for node %s: %v", server.Name, err)

to be:

return nil, fmt.Errorf("error getting private network addresses for node %s: %v", server.Name, err)

That would prevent Nodes to be initialized without InternalIPs when there is a transient IPAM failure.

If possible, I'd like to avoid putting additional pressure on the IPAM API.

[nfm-corti]

@andreaswachs I pushed some changes based on the above comment. Please test this and let us know the results. Once verified, this should be good to merge.

[andreaswachs]

@andreaswachs I pushed some changes based on the above comment. Please test this and let us know the results. Once verified, this should be good to merge.

I have just manually tested this to work:

1. Removed IPs from the backend pool for a Scaleway LB that fronts a LB type Kubernetes SVC 💣
2. Triggered a full reconsiliation by adding an annotation on said K8s SVC ⏯️
3. Observed the CCM to restore all needed IPs on the SCW LB ✅

[andreaswachs]

Thank you so much @Tomy2e and @jtherin! ❤️