feat(healthcheck): make healtcheck bind address configurable

docs/user-guide.md

@@ -129,6 +129,7 @@ Usage of kube-router:
       --excluded-cidrs strings                        Excluded CIDRs are used to exclude IPVS rules from deletion.
       --gobgp-admin-port uint16                       Port to connect to GoBGP for administrative purposes. Setting this to 0 will disable the GoBGP gRPC server. (default 50051)
       --hairpin-mode                                  Add iptables rules for every Service Endpoint to support hairpin traffic.
+      --health-addr string                            Health check address to listen on, (Default: all interfaces)
       --health-port uint16                            Health check port, 0 = Disabled (default 20244)
   -h, --help                                          Print usage information.
       --hostname-override string                      Overrides the NodeName of the node. Set this if kube-router is unable to determine your NodeName automatically.

pkg/cmd/kube-router.go

@@ -107,6 +107,14 @@ func (kr *KubeRouter) Run() error {
 	defer close(healthChan)
 	stopCh := make(chan struct{})
 
+	// Verify the health address/port combo provided is listenable
+	if err := utils.TCPAddressBindable(kr.Config.HealthAddr, kr.Config.HealthPort); err != nil {
+		return fmt.Errorf("failed to listen on %s:%d for heath controller: %w",
+			kr.Config.HealthAddr,
+			int(kr.Config.HealthPort),
+			err)
+	}
+
 	hc, err := healthcheck.NewHealthController(kr.Config)
 	if err != nil {
 		return fmt.Errorf("failed to create health controller: %v", err)

pkg/healthcheck/health_controller.go

@@ -48,6 +48,7 @@ type ControllerHeartbeat struct {
 
 // HealthController reports the health of the controller loops as a http endpoint
 type HealthController struct {
+	HealthAddr  string
 	HealthPort  uint16
 	HTTPEnabled bool
 	Status      HealthStats
@@ -225,7 +226,7 @@ func (hc *HealthController) RunServer(stopCh <-chan struct{}, wg *sync.WaitGroup
 	mux := http.NewServeMux()
 
 	srv := &http.Server{
-		Addr:              ":" + strconv.Itoa(int(hc.HealthPort)),
+		Addr:              hc.HealthAddr + ":" + strconv.Itoa(int(hc.HealthPort)),
 		Handler:           mux,
 		ReadHeaderTimeout: 5 * time.Second,
 	}
@@ -290,6 +291,7 @@ func (hc *HealthController) SetAlive() {
 func NewHealthController(config *options.KubeRouterConfig) (*HealthController, error) {
 	hc := HealthController{
 		Config:     config,
+		HealthAddr: config.HealthAddr,
 		HealthPort: config.HealthPort,
 		Status: HealthStats{
 			Healthy: true,

pkg/options/options.go

@@ -44,6 +44,7 @@ type KubeRouterConfig struct {
 	FullMeshMode                   bool
 	GlobalHairpinMode              bool
 	GoBGPAdminPort                 uint16
+	HealthAddr                     string
 	HealthPort                     uint16
 	HelpRequested                  bool
 	HostnameOverride               string
@@ -169,6 +170,7 @@ func (s *KubeRouterConfig) AddFlags(fs *pflag.FlagSet) {
 		"Add iptables rules for every Service Endpoint to support hairpin traffic.")
 	fs.Uint16Var(&s.GoBGPAdminPort, "gobgp-admin-port", defaultGoBGPAdminPort,
 		"Port to connect to GoBGP for administrative purposes. Setting this to 0 will disable the GoBGP gRPC server.")
+	fs.StringVar(&s.HealthAddr, "health-addr", "", "Health check address to listen on, (Default: all interfaces)")
 	fs.Uint16Var(&s.HealthPort, "health-port", defaultHealthCheckPort, "Health check port, 0 = Disabled")
 	fs.BoolVarP(&s.HelpRequested, "help", "h", false,
 		"Print usage information.")