Skip to content

feat: add gateway.healthCheckNodePort Helm value#15174

Open
AldoFusterTurpin wants to merge 1 commit intolinkerd:mainfrom
AldoFusterTurpin:aldo/feat/healthCheckNodePort
Open

feat: add gateway.healthCheckNodePort Helm value#15174
AldoFusterTurpin wants to merge 1 commit intolinkerd:mainfrom
AldoFusterTurpin:aldo/feat/healthCheckNodePort

Conversation

@AldoFusterTurpin
Copy link
Copy Markdown

@AldoFusterTurpin AldoFusterTurpin commented Apr 15, 2026

When externalTrafficPolicy is set to Local on the gateway service, Kubernetes auto-assigns a random healthCheckNodePort. This makes the port invisible, causes conflicts with other port controllers, and is inconsistent with the existing nodePort pinning support.

This PR adds an optional gateway.healthCheckNodePort value (and --gateway-healthcheck-nodeport CLI flag) following the same pattern as the existing gateway.nodePort and gateway.probe.nodePort.

Following TEST.md, I run

go test ./multicluster/cmd/... -run TestRender --update

to generate the contents of multicluster/cmd/testdata/install_healthcheck_nodeport.golden and ensure the code does what it should do.

I deliberately don't check serviceExternalTrafficPolicy=Local in the template, because:

  • Kubernetes API validation already enforces this constraint server-side
  • The template would get more complex for no real benefit
  • It mirrors how nodePort is handled today (no policy check there either)

Fixes #15172

References:

@AldoFusterTurpin AldoFusterTurpin requested a review from a team as a code owner April 15, 2026 09:01
@AldoFusterTurpin AldoFusterTurpin force-pushed the aldo/feat/healthCheckNodePort branch 2 times, most recently from 1b3099e to 7d4d57e Compare April 15, 2026 18:15
@zaharidichev zaharidichev self-assigned this Apr 16, 2026
@AldoFusterTurpin AldoFusterTurpin force-pushed the aldo/feat/healthCheckNodePort branch from bf02cfd to de2773d Compare April 17, 2026 09:30
When externalTrafficPolicy is set to Local on the gateway service,
Kubernetes auto-assigns a random healthCheckNodePort. This makes
the port invisible, causes conflicts with other port controllers,
and is inconsistent with the existing nodePort pinning support.

Add an optional gateway.healthCheckNodePort value (and
--gateway-healthcheck-nodeport CLI flag) following the same
pattern as the existing gateway.nodePort and gateway.probe.nodePort.

Fixes linkerd#15172

Signed-off-by: Aldo Fuster Turpin <aldo@timescale.com>
@AldoFusterTurpin AldoFusterTurpin force-pushed the aldo/feat/healthCheckNodePort branch from 02ad44b to 905eeb7 Compare April 20, 2026 08:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

multicluster: add configurable healthCheckNodePort for gateway service

2 participants