Add clusterip exposure for in-cluster-only access

CHANGES.rst

@@ -5,6 +5,8 @@ Changelog
 Unreleased
 ----------
 
+* Added ``clusterip`` exposure for clusters reachable only inside Kubernetes.
+
 * Fixed changing ``spec.cluster.exposure`` failing while the cluster is suspended.
 
 * Bumped sql_exporter to ``0.24.10`` for CVE fixes.

crate/operator/create.py

@@ -1361,18 +1361,18 @@ def get_data_service(
     dns_record: Optional[str],
     source_ranges: Optional[List[str]] = None,
     additional_annotations: Optional[Dict] = None,
-    use_traefik: bool = False,
+    use_load_balancer: bool = True,
     has_dedicated_masters: bool = False,
 ) -> V1Service:
     res_annotations = {}
 
-    if not use_traefik:
+    if use_load_balancer:
         res_annotations.update(_lb_annotations_to_add(dns_record))
 
     if additional_annotations:
         res_annotations.update(additional_annotations)
 
-    service_type = "ClusterIP" if use_traefik else "LoadBalancer"
+    service_type = "LoadBalancer" if use_load_balancer else "ClusterIP"
 
     selector = {LABEL_COMPONENT: "cratedb", LABEL_NAME: name}
     if has_dedicated_masters:
@@ -1393,7 +1393,7 @@ def get_data_service(
         type=service_type,
     )
 
-    if not use_traefik:
+    if use_load_balancer:
         spec_kwargs["external_traffic_policy"] = "Local"
         if source_ranges:
             spec_kwargs["load_balancer_source_ranges"] = source_ranges
@@ -1488,7 +1488,7 @@ async def create_services(
     logger: logging.Logger,
     source_ranges: Optional[List[str]] = None,
     additional_annotations: Optional[Dict] = None,
-    use_traefik: bool = False,
+    use_load_balancer: bool = True,
     has_dedicated_masters: bool = False,
 ) -> None:
     async with GlobalApiClient() as api_client:
@@ -1504,7 +1504,7 @@ async def create_services(
             dns_record,
             source_ranges,
             additional_annotations=additional_annotations,
-            use_traefik=use_traefik,
+            use_load_balancer=use_load_balancer,
             has_dedicated_masters=has_dedicated_masters,
         )
         await call_kubeapi(
@@ -1559,7 +1559,6 @@ async def recreate_services(
     dns_record = spec.get("cluster", {}).get("externalDNS", None)
 
     exposure = spec.get("cluster", {}).get("exposure", "loadbalancer")
-    use_traefik = exposure == "traefik"
 
     await create_services(
         owner_references,
@@ -1573,7 +1572,7 @@ async def recreate_services(
         logger,
         source_ranges,
         additional_annotations,
-        use_traefik=use_traefik,
+        use_load_balancer=exposure == "loadbalancer",
         has_dedicated_masters="master" in spec["nodes"],
     )
 
@@ -1809,7 +1808,6 @@ async def handle(  # type: ignore
         has_dedicated_masters: bool = False,
         **kwargs: Any,
     ):
-        use_traefik = exposure == "traefik"
         await create_services(
             owner_references,
             namespace,
@@ -1822,7 +1820,7 @@ async def handle(  # type: ignore
             logger,
             source_ranges,
             additional_annotations,
-            use_traefik=use_traefik,
+            use_load_balancer=exposure == "loadbalancer",
             has_dedicated_masters=has_dedicated_masters,
         )
 

crate/operator/exposure.py

@@ -484,10 +484,10 @@ async def patch_service_exposure(
     LoadBalancer and ClusterIP.
     """
     service_name = f"crate-{name}"
-    use_traefik = new_exposure == "traefik"
+    use_load_balancer = new_exposure == "loadbalancer"
 
     new_annotations: dict[str, Optional[str]] = {}
-    if use_traefik:
+    if not use_load_balancer:
         # Drop the LB tuning annotations, but keep aws-load-balancer-type so the
         # service controller can delete the NLB instead of orphaning it.
         new_annotations.update(_lb_annotations_to_remove())
@@ -500,7 +500,7 @@ async def patch_service_exposure(
     # When switching away from LoadBalancer, explicitly null out LB-specific
     # fields - Kubernetes requires them to be absent for ClusterIP.
     spec_patch: dict[str, Any] = {}
-    if use_traefik:
+    if not use_load_balancer:
         spec_patch = {
             "type": "ClusterIP",
             "externalTrafficPolicy": None,
@@ -609,7 +609,7 @@ async def handle(
 
 class ChangeExposureSubHandler(StateBasedSubHandler):
     """
-    Handles changes to spec.cluster.exposure between 'loadbalancer' and 'traefik'.
+    Handles changes to spec.cluster.exposure.
     Deletes old resources and creates new ones accordingly.
     """
 
@@ -661,6 +661,9 @@ async def handle(
             if old_exposure == "traefik":
                 await delete_traefik_resources(namespace, name)
 
+        if new_exposure == "clusterip" and source_ranges:
+            logger.info("allowedCIDRs has no effect with exposure=clusterip")
+
         if new_exposure == "traefik":
             await create_traefik_resources(
                 owner_references,

crate/operator/handlers/handle_update_allowed_cidrs.py

@@ -92,6 +92,8 @@ async def update_service_allowed_cidrs(
 
         if exposure == "traefik":
             await update_traefik_ip_restriction(namespace, name, new_cidrs, logger)
+        elif exposure == "clusterip" and new_cidrs:
+            logger.info("allowedCIDRs has no effect with exposure=clusterip")
 
         # Grand-central IP allowlist follows its own exposure, which
         # may differ from the CrateDB service exposure.

crate/operator/operations.py

@@ -1189,6 +1189,7 @@ async def suspend_or_start_cluster(
         cratedb.get("spec", {}).get("cluster", {}).get("exposure", "loadbalancer")
     )
     use_traefik = exposure == "traefik"
+    use_load_balancer = exposure == "loadbalancer"
 
     # Dedicated master nodes are suspended/resumed in lockstep with the data
     # nodes, but with strict ordering: on resume the masters must come up
@@ -1217,7 +1218,7 @@ async def suspend_or_start_cluster(
                     await recreate_services(
                         namespace, name, cratedb["spec"], cratedb["metadata"], logger
                     )
-                if not use_traefik and not await is_lb_service_ready(
+                if use_load_balancer and not await is_lb_service_ready(
                     core, namespace, name
                 ):
                     raise TemporaryError(delay=config.BOOTSTRAP_RETRY_DELAY)
@@ -1354,9 +1355,11 @@ async def suspend_or_start_cluster(
                 await delete_traefik_resources(namespace, name)
                 # Also delete the ClusterIP service
                 await delete_clusterip_service(core, namespace, name)
-            else:
+            elif use_load_balancer:
                 # Delete the LoadBalancer service
                 await delete_lb_service(core, namespace, name)
+            # Keep a clusterip service. It costs nothing, and its cluster IP
+            # must not change on resume.
 
     if has_dedicated_masters and is_suspend:
         await scale_master_statefulset(apps, namespace, name, 0, logger)

deploy/charts/crate-operator-crds/templates/cratedbs-cloud-crate-io.yaml

@@ -583,7 +583,7 @@ spec:
                   exposure:
                     description: Service exposure type
                     type: string
-                    enum: ["loadbalancer", "traefik"]
+                    enum: ["loadbalancer", "traefik", "clusterip"]
                 required:
                 - imageRegistry
                 - name

docs/source/crd-reference.rst

@@ -199,7 +199,9 @@ Core identity and cluster-wide configuration. **Required.**
    * - ``exposure``
      - string
      - no
-     - Service exposure type. One of ``loadbalancer`` or ``traefik``.
+     - Service exposure type. One of ``loadbalancer`` (default), ``traefik``
+       or ``clusterip``. ``clusterip`` gives in-cluster access only, ignores
+       ``allowedCIDRs`` and keeps the service while the cluster is suspended.
    * - ``settings``
      - object
      - no

tests/test_create.py

@@ -1332,6 +1332,23 @@ def test_get_data_service(self, provider, dns, faker):
                 == dns
             )
 
+    def test_get_data_service_without_load_balancer(self, faker):
+        with mock.patch("crate.operator.create.config.CLOUD_PROVIDER", "aws"):
+            service = get_data_service(
+                None,
+                faker.domain_word(),
+                {},
+                faker.port_number(),
+                faker.port_number(),
+                "mycluster.example.com",
+                ["10.0.0.0/8"],
+                use_load_balancer=False,
+            )
+        assert service.spec.type == "ClusterIP"
+        assert service.spec.external_traffic_policy is None
+        assert service.spec.load_balancer_source_ranges is None
+        assert service.metadata.annotations == {}
+
     def test_lb_type_annotation_retained_when_switching_to_clusterip(self):
         # Switching to traefik (LoadBalancer -> ClusterIP) must keep
         # aws-load-balancer-type so the service controller can identify and