WIP: Add Application Load Balancer Controller Manager by kamilprzybyl · Pull Request #879 · stackitcloud/cloud-provider-stackit

kamilprzybyl · 2026-03-17T09:27:48Z

How to categorize this PR?

What this PR does / why we need it:

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:

Breaking changes:

ske-prow · 2026-03-17T09:27:55Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign timebertt for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Added ExactMatch -Path- to change detection

Adi146 · 2026-03-18T08:30:26Z

cmd/application-load-balancer-controller-manager/main.go

+	// generate self-signed certificates for the metrics server. While convenient for development and testing,
+	// this setup is not recommended for production.
+	//
+	// TODO(user): If you enable certManager, uncomment the following lines:


might be good to create separate examples for that

cmd/application-load-balancer-controller-manager/main.go

Adi146 · 2026-03-18T08:41:26Z

pkg/alb/ingress/alb_spec.go

+)
+
+const (
+	// externalIPAnnotation references an OpenStack floating IP that should be used by the application load balancer.


do we want to reference openstack here as its deprecated?

Adi146 · 2026-03-18T08:47:38Z

pkg/alb/ingress/alb_spec.go

+		if err != nil {
+			log.Printf("failed to load tls certificates: %v", err)
+			//nolint:gocritic // TODO: Rework error handling.
+			// return nil, fmt.Errorf("failed to load tls certificates: %w", err)


why is this commented out?

Adi146 · 2026-03-18T08:48:39Z

pkg/alb/ingress/alb_spec.go

+	sort.SliceStable(ruleMetadataList, func(i, j int) bool {
+		a, b := ruleMetadataList[i], ruleMetadataList[j]
+		// 1. Host name (lexicographically)
+		if a.host != b.host {


does this work with * host matcher?

Adi146 · 2026-03-18T08:56:24Z

pkg/alb/ingress/alb_spec.go

+}
+
+// cleanupCerts deletes the certificates from the Certificates API that are no longer associated with any Ingress in the IngressClass
+func (r *IngressClassReconciler) cleanupCerts(ctx context.Context, ingressClass *networkingv1.IngressClass, ingresses []*networkingv1.Ingress) error {


do we really want to delete certificates? That could be very dangerous as users might just not associate the certificate anymore and want to keep it.

Each Ingress TLS secret reference is mapped to a unique ALB Certificate resource. Even if multiple Ingresses reference the same k8s Secret, they will each trigger the creation of a separate, independent certificate on the ALB. That means, deleting one Ingress (and its associated ALB Certificate) does not impact the certificates still being used by other Ingresses.

Adi146 · 2026-03-18T08:57:19Z

pkg/alb/ingress/alb_spec.go

+
+// isCertValid checks if the certificate chain is complete. It is used for checking if
+// the cert-manager's ACME challenge is completed, or if it's sill ongoing.
+func isCertValid(secret *corev1.Secret) (bool, error) {


isn't that already handled by the certificate api?

The Cert API only checks if the public and private keys are matching + if the certificate is a valid X.509 format but it does not reject incomplete chains.

Renamed the function from isCertValid to isCertReady and clarified the function in the comment above.

samples/ingress/issuer.yaml

ske-prow · 2026-03-19T11:29:02Z

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

fischerman · 2026-03-19T15:06:54Z

pkg/alb/ingress/ingressclass_controller.go

+	}
+
+	if len(albIngressList) < 1 {
+		err := r.handleIngressClassWithoutIngresses(ctx, albIngressList, ingressClass)


It doesn't make sense to pass albIngressList if it is always empty.

ske-prow · 2026-03-20T19:26:36Z

@kamilprzybyl: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-cloud-provider-stackit-verify	`3c1cc68`	link	true	`/test pull-cloud-provider-stackit-verify`

Full PR test history. Your PR dashboard. Command help for this repository.
Please help us cut down on flakes by linking this test failure to an open flake report or filing a new flake report if you can't find an existing one. Also see the gardener testing guideline for how to avoid and hunt flakes.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

add application load balancer controller manager

ae98179

ske-prow bot added do-not-merge/needs-kind Indicates a PR lacks a `kind/foo` label and requires one. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Mar 17, 2026

kamilprzybyl changed the title ~~Add Application Load Balancer Controller Manager~~ WIP: Add Application Load Balancer Controller Manager Mar 17, 2026

ske-prow bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 17, 2026

chore: add alb ingress controller docs run-it-locally how-to

86bdf1d

kamilprzybyl force-pushed the feat/kp/add-alb-ingress-controller branch from 7ecc416 to 86bdf1d Compare March 17, 2026 09:37

fischerman and others added 11 commits March 17, 2026 10:47

Fix errors in stackit package

9de2144

chore: add new Makefile build for alb ingress controller manager

77b29bf

Fix errors in ingress package (only non-test files)

fc6f95f

Add mocks for ALB and certificates API

088ee78

Fix syntax errors in test in ingress package

714d80d

wip: Add alb-controller-manager deploy files

7a770aa

Fix main.go

7d6d1f5

Add mock generation for ALB and certificates API

45c973d

Fix linter issues

612f42f

Added waf config to change detection

f619aa1

Added ExactMatch -Path- to change detection

Update docs for ALBCM

32e60f2

Adi146 reviewed Mar 18, 2026

View reviewed changes

Fix ALB unit tests

e07f91b

Adi146 reviewed Mar 18, 2026

View reviewed changes

Kamil Przybyl and others added 6 commits March 18, 2026 10:24

feat: read configuration from cloud config

66e932c

chore: add a short description for setIPAddresses function

ea81edb

Include envtest for controller tests

b24cf41

Undo temporary changes

0bf5fc6

Fix linter issues

a68cbc7

Remove license from code

6d9842d

ske-prow bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 19, 2026

fischerman reviewed Mar 19, 2026

View reviewed changes

chore: adjust issuer sample

4a8352c

kamilprzybyl force-pushed the feat/kp/add-alb-ingress-controller branch from 4a5c760 to d8de28a Compare March 20, 2026 16:39

chore: clarify isCertValid

f903b25

kamilprzybyl force-pushed the feat/kp/add-alb-ingress-controller branch from d8de28a to f903b25 Compare March 20, 2026 19:05

chore: remove debug messages

3c1cc68

Conversation

kamilprzybyl commented Mar 17, 2026

Uh oh!

ske-prow bot commented Mar 17, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kamilprzybyl Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ske-prow bot commented Mar 19, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ske-prow bot commented Mar 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

kamilprzybyl Mar 20, 2026 •

edited

Loading