[feature request] Create 'fake' hostPort(s)

[mtougeron]

It would be nice to have a way for a user of vCluster to create a deployment using hostPort(s) (which is normally for us blocked by a PodSecurityPolicy) and have it create a 'fake' hostPort mapping to the underlying Kubernetes system. This would allow users to test services that would normally use hostPort but not actually expose a hostPort during the testing/validation process.

[FabianKramm]

@mtougeron thanks for creating this issue! Interesting idea, how would this fake hostPort mapping look like? What should vcluster respond to connections on these ports?

[mtougeron]

The best idea I can come up with at the moment would be a ClusterIP Service on the host k8s system per pod in the vCluster deployment. That way each pod would still have a ip on the service network layer that routes directly to it. I don't know if I'd be entirely happy with that approach but it would kind of simulate what would happen.

If it helps, I'm digging more into the way vCluster code works this week and might have a better answer once I understand more about how the virtual nodes are handled.

[olljanat]

@mtougeron if I understood correctly from #251 (comment) your use case is that you want to be able to test that manifest which modify it?

One way to do it would be to run policy engine like Kyverno inside of vcluster and mutate those services on fly. Here is example about policy like that:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: use-clusterip
spec:
  validationFailureAction: enforce
  background: false
  rules:
  - name: nodeport
    match:
      resources:
        kinds:
        - Service
        namespaces:
        - "vcluster-*"
    preconditions:
      all:
      - key: "{{request.operation}}"
        operator: In
        value:
        - CREATE
      - key: "{{request.object.spec.type}}"
        operator: Equals
        value: NodePort
    mutate:
      patchesJson6902: |-
        - path: "/spec/type"
          op: replace
          value: ClusterIP
        - path: "/spec/externalTrafficPolicy"
          op: remove

[mtougeron]

Interesting. I'll have to give that a try and see what it can do for the hostPort & hostNetworking flags. Thanks for the suggestion!

[sgreene570]

Friendly bump on this feature; it would be really neat and make moving workloads to vcluster easier!