Repository navigation
feat(vpn): move the vpn app off Service.spec.externalIPs onto CiliumLoadBalancerIPPool #2477
Description
Activity
Hi, Aleksei Sviridkin (@lexfrei). I'm Dosu, and I'm helping the cozystack team manage their backlog and am marking this issue as stale.
Issue Summary
- The vpn chart currently templates
Service.spec.externalIPsdirectly. - This will become problematic once Kubernetes removes support for that field.
- I requested a
loadBalancerexposure mode, similar to the ingress-nginx/CiliumLoadBalancerIPPool approach, while keepingexternalIPsas the default for now. - I also asked for tests and a render guard so the chart does not emit invalid output when no external IPs are configured.
Next Steps
- Please let us know if this is still relevant on the latest version of the cozystack repository; if it is, you can keep the discussion open by commenting here.
- Otherwise, this issue will be automatically closed in 7 days.
Thanks for your understanding and contribution.
- The vpn chart currently templates
- added and removed
on Sep 23, 2026
Context
KEP-5707 deprecates
Service.spec.externalIPs. Timeline:AllowServiceExternalIPsfeature gate introduced with a warning on use.#2468 moved ingress-nginx onto a
CiliumLoadBalancerIPPool-backed mode gated bypublishing.exposure=loadBalancer, butpackages/apps/vpn/templates/service.yamlstill writesexternalIPsdirectly. The vpn app will break once the feature gate flips.Work
Port the #2468 pattern to the vpn chart:
loadBalancerexposure mode to the vpn Service, rendered as a Service of typeLoadBalancerplus aCiliumLoadBalancerIPPoolscoped to the vpn Service viaserviceSelector.externalIPsas the default for backwards compat; flip the default in a later release once the rest of the platform migration is done.Scope
Fairly mechanical — the pattern is fully worked out in #2468 and was recently ported to
packages/extra/gateway/templates/cilium-lb-pool.yamlas part of #2470. Needs unit tests and a bats smoke to assert the Service stays functional after the flip.