Service Internal Traffic Policy

[maplain]

What type of PR is this?
/kind feature

What this PR does / why we need it:
This PR implements the Service Internal Traffic Policy KEP

Which issue(s) this PR fixes:
Fixes kubernetes/enhancements#2086

Special notes for your reviewer:

Does this PR introduce a user-facing change?:
Yes

One new field "InternalTrafficPolicy" in Service is added.
It specifies if the cluster internal traffic should be routed to all endpoints or node-local endpoints only.
"Cluster" routes internal traffic to a Service to all endpoints.
"Local" routes traffic to node-local endpoints only, and traffic is dropped if no node-local endpoints are ready.
The default value is "Cluster".

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

TBD

[k8s-ci-robot]

Hi @maplain. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[andrewsykim]

/triage accepted
/milestone v1.21
/assign

Thanks for starting this @maplain!

[andrewsykim]

I know this PR is a WIP, but some comments for what is still required:

1. We need a ServiceInternalTrafficPolicy feature gate in https://github.com/kubernetes/kubernetes/blob/master/pkg/features/kube_features.go that is alpha status and off by default.
2. We need to drop the new field in the Service REST code when the feature gate is off. See spec.allocateLoadBalancerNodePorts as one example: https://github.com/kubernetes/kubernetes/blob/master/pkg/registry/core/service/strategy.go#L185-L190
3. We need to set the default value to Cluster if the feature gate is enabeld, see SetDefaults_Service: https://github.com/kubernetes/kubernetes/blob/master/pkg/apis/core/v1/defaults.go#L97
4. kube-proxy changes

[maplain]

/test pull-kubernetes-verify

[thockin]

Needs rebase

[JornShen]

for failed check pull-kubernetes-verify, need to run hack/update-openapi-spec.sh

[maplain]

@JornShen I've tried to run it a few times, but it doesn't update anything locally.. I actually run FORCE_ALL=true make update every time before I push to make sure it is in sync.

let me try it one more time

[maplain]

➜  kubernetes git:(internal-traffic-policy) hack/update-openapi-spec.sh
+++ [0307 18:48:44] Building go targets for darwin/amd64:
    ./vendor/k8s.io/code-generator/cmd/prerelease-lifecycle-gen
Generating prerelease lifecycle code for       26 targets
+++ [0307 18:48:51] Building go targets for darwin/amd64:
    ./vendor/k8s.io/code-generator/cmd/deepcopy-gen
Generating deepcopy code for      226 targets
+++ [0307 18:49:03] Building go targets for darwin/amd64:
    ./vendor/k8s.io/code-generator/cmd/defaulter-gen
Generating defaulter code for       88 targets
+++ [0307 18:49:14] Building go targets for darwin/amd64:
    ./vendor/k8s.io/code-generator/cmd/conversion-gen
Generating conversion code for      123 targets
+++ [0307 18:49:37] Building go targets for darwin/amd64:
    ./vendor/k8s.io/kube-openapi/cmd/openapi-gen
Generating openapi code for KUBE
Generating openapi code for AGGREGATOR
Generating openapi code for APIEXTENSIONS
^A^KGenerating openapi code for CODEGEN
Generating openapi code for SAMPLEAPISERVER
+++ [0307 18:49:52] Building go targets for darwin/amd64:
    ./vendor/github.com/go-bindata/go-bindata/go-bindata
+++ [0307 18:49:54] Building go targets for darwin/amd64:
    cmd/kube-apiserver
etcd --advertise-client-urls http://127.0.0.1:2379 --data-dir /var/folders/l5/66tl8_29065g0jrk7t92qdjm0000gn/T/tmp.vlrfbPAq --listen-client-urls http://127.0.0.1:2379 --log-level=debug > "/dev/null" 2>/dev/null
Waiting for etcd to come up.
+++ [0307 18:51:25] On try 3, etcd: : {"health":"true"}
{"header":{"cluster_id":"14841639068965178418","member_id":"10276657743932975437","revision":"2","raft_term":"2"}}+++ [0307 18:51:25] Starting kube-apiserver
+++ [0307 18:51:34] On try 9, apiserver: : ok
+++ [0307 18:51:34] Updating
    hack/../api/openapi-spec
+++ [0307 18:51:35] SUCCESS
+++ [0307 18:52:35] Clean up complete


➜  kubernetes git:(internal-traffic-policy) gst
On branch internal-traffic-policy
Your branch is up to date with 'my/internal-traffic-policy'.

nothing to commit, working tree clean

@JornShen is it possible that this is related to the go version?

go version go1.16 darwin/amd64

[maplain]

/test pull-kubernetes-e2e-gce-alpha-features

[maplain]

/test pull-kubernetes-verify

[JornShen]

@maplain using linux robot will be ok.

JornShen@c1a7b78

I have upload it to my repo. You can cherry-pick it, maybe.

[andrewsykim]

Go version seems right, I think we're on 1.16

[thockin]

/lgtm

[maplain]

Thanks @thockin for approval, and @andrewsykim and @JornShen for your help!

I manually copied the file attached by Shen and it passed the test.

Though after copying the file and running hack/update-openapi-spec.sh locally again, I do see changes this time, which is clearly wrong:

diff --git a/api/openapi-spec/swagger.json b/api/openapi-spec/swagger.json
index 39807afb663..ec45c84199a 100644
--- a/api/openapi-spec/swagger.json
+++ b/api/openapi-spec/swagger.json
@@ -11795,6 +11795,552 @@
       },
       "type": "object"
     },
+    "io.k8s.api.flowcontrol.v1alpha1.FlowDistinguisherMethod": {
+      "description": "FlowDistinguisherMethod specifies the method of a flow distinguisher.",
+      "properties": {
+        "type": {
+          "description": "`type` is the type of flow distinguisher method The supported types are \"ByUser\" and \"ByNamespace\". Required.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "type"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.flowcontrol.v1alpha1.FlowSchema": {
+      "description": "FlowSchema defines the schema of a group of flows. Note that a flow is made up of a set of inbound API requests with similar attributes and is identified by a pair of strings: the name of the FlowSchema and a \"flow distinguisher\".",