Egress + service without selector

[gulecroc]

Egress + service without selector

[gulecroc]

Workaround :

I create a fake service so kube-vip can update iptables with IP and port SNAT :

---
apiVersion: v1
kind: Service
metadata:
  annotations:
    kube-vip.io/egress: "true"
    kube-vip.io/egress-destination-ports: tcp:389
  name: kube-vip-egress-service-fake
  namespace: my-namespace
spec:
  externalTrafficPolicy: Local
  ports:
    - name: kube-vip-egress-service-fake
      port: 1234
  type: LoadBalancer
  loadBalancerIP: 4.5.6.7
  selector:
    app.kubernetes.io/instance: my-instance

the iptables is correctly updated :

guillaume.lecroc@lab-k8s-demo5:~$ sudo iptables-legacy -t nat -L POSTROUTING
Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
SNAT       tcp  --  10.42.4.83           anywhere             mark match 0x40/0x40 tcp dpt:ldap /* a3ViZS12aXAK=kube-vip-pod-name */ to:4.5.6.7

then I create the original service and endpoint :

---
apiVersion: v1
kind: Endpoints
metadata:
  name: my-service
  namespace: my-namespace
subsets:
  - addresses:
      - ip: 1.2.3.4
    ports:
      - name: ldap
        port: 389
        protocol: TCP
---
apiVersion: v1
kind: Service
metadata:
  annotations:
  name: my-service
  namespace: my-namespace
spec:
  ports:
    - name: service-port-name
      port: 1234
      protocol: TCP
      targetPort: 1234

And it works as expected.

So the question is : why kube-vip with egress need service selector to the load-balancer ip ?